PT-2026-23731 · Timescale · Timescaledb

Svenklem · Published 2026-03-06 · Updated 2026-03-07 · CVE-2026-29089

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TimescaleDB versions 2.23.0 through 2.25.1

Description TimescaleDB is a time-series database that functions as a Postgres extension. A flaw exists where PostgreSQL’s use of the search path setting can allow a malicious user to create functions in user-writable schemas. These functions can shadow built-in Postgres functions and be executed instead during extension upgrades, potentially leading to arbitrary code execution. The issue stems from unqualified database object lookups when the search path includes schemas accessible for writing.

Recommendations Upgrade to TimescaleDB version 2.25.2 or later.

Exploit

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2026-29089

GHSA-VGP2-JJ5C-828M

Affected Products

Timescaledb

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29089.json · Exploit
• https://github.com/timescale/timescaledb/commit/9a8f7f8bdeb99e6abae0786ffe526791a8628ce3 · Patch
• https://github.com/timescale/timescaledb/pull/9331 · Patch
• https://github.com/timescale/timescaledb/security/advisories/GHSA-vgp2-jj5c-828m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29089 · Security Note
• https://osv.dev/vulnerability/CVE-2026-29089 · Vendor Advisory
• https://github.com/timescale/timescaledb/releases/tag/2.25.2 · Note
• https://twitter.com/CVEnew/status/2029975476035522774 · Twitter Post
• https://twitter.com/TheHackerWire/status/2030214356965937316 · Twitter Post
• https://t.me/CVEtracker/46633 · Telegram Post