Vulnerability in Timescale Timescaledb
CVE-2026-29089
TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the search_path setting to locate unqualified database objects (tables, functions, operators). If the search_path includes user-writable schemas a malicious user can create functions in that schema that shadow builtin postgres functions and will be called instead of the postgres functions leading to arbitrary code execution during extension upgrade. This issue has been patched in version 2.25.2.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (7.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 8th percentile — 7.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.002 · change: +0.001
Affected products
- Timescale Timescaledb — versions >= 2.23.0, < 2.25.2
Weakness classification (CWE)
References
- github.com/timescale/timescaledb/security/advisories/GHSA-vgp2-jj5c-828m (Mitigation, Vendor Advisory)
- github.com/timescale/timescaledb/pull/9331 (Patch, Issue Tracking)
- github.com/timescale/timescaledb/commit/9a8f7f8bdeb99e6abae0786ffe526791a8628ce3 (Patch)
- github.com/timescale/timescaledb/releases/tag/2.25.2 (Product, Release Notes)
Frequently asked questions
- What is CVE-2026-29089?
- CVE-2026-29089 is a high-severity vulnerability in Timescale Timescaledb, classified under Untrusted Search Path. CVSS score: 8.8/10. Published 2026-03-06.
- How severe is CVE-2026-29089?
- High severity. CVSS v3 base score is 8.8 out of 10.