Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
TimescaleDB allows malicious users to execute arbitrary code during upgrade
CVE-2026-29089
Summary
A security risk exists in TimescaleDB versions 2.23.0 to 2.25.1 that allows a malicious user to execute unauthorized code during an upgrade. This could lead to data corruption or unauthorized access. To fix this issue, upgrade to version 2.25.2 or later.
Original title
TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the search_path setting to locate unq...
Original description
TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the search_path setting to locate unqualified database objects (tables, functions, operators). If the search_path includes user-writable schemas a malicious user can create functions in that schema that shadow builtin postgres functions and will be called instead of the postgres functions leading to arbitrary code execution during extension upgrade. This issue has been patched in version 2.25.2.
nvd CVSS3.1
8.8
Vulnerability type
CWE-426
Published: 6 Mar 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026