VulnSocial

CVE-2026-29089Disclosure(timescale / timescaledb)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch timescale timescaledb systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the search_path setting to locate unqualified database objects (tables, functions, operators). If the search_path includes user-writable schemas a malicious user can create functions in that schema that shadow builtin postgres functions and will be called instead of the postgres functions leading to arbitrary code execution during extension upgrade. This issue has been patched in version 2.25.2.

timescale CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-426

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • timescaledb

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-03-06); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
timescale
Products
timescaledb

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-03-06: 2Mentions · 2026-03-07: 1Patch / Workaround · 2026-03-06: 1Technical Details · 2026-03-06: 2Technical Details · 2026-03-07: 103-0603-07
Signal classification3 categories
Disclosure
133.3%
Patch
133.3%
General
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-03-062
Disclosure1Patch1
2026-03-071
General1
Full discourse3 posts
  • CVEFind.com@CveFindCom
    Patch

    [CVE-2026-29089: HIGH] Critical security vulnerability in TimescaleDB versions 2.23.0 to 2.25.1 patched in 2.25.2. PostgreSQL search_path flaw could lead to arbitrary code execution during upgrade.#cve,CVE-2026-29089,#cybersecurity https://cvefind.com/CVE-2026-29089

    Post summary

    TimescaleDB versions 2.23.0 to 2.25.1 are vulnerable to an arbitrary code execution flaw during upgrade caused by a PostgreSQL search_path issue; the issue is fixed in 2.25.2.

    0000135
    597 followersView on X
  • The Hacker Wire@TheHackerWire
    General

    🟠 CVE-2026-29089 - High TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the search_path setting to loca... https://www.thehackerwire.com/vulnerability/CVE-2026-29089/ https://t.co/Q8GEj4UR1d

    Post summary

    The tweet references a high‑severity CVE (CVE‑2026‑29089) in TimescaleDB, providing only minimal context without any proof of concept, exploit code, new patch information, or evidence of active exploitation.

    0000048
    128 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-29089 TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the se… https://www.cve.org/CVERecord?id=CVE-2026-29089

    Post summary

    CVE-2026-29089 is disclosed as affecting TimescaleDB between versions 2.23.0 and 2.25.1, but the post lacks details on exploitation, mitigations, or proof-of-concept code.

    0000069
    56.6K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apptimescaletimescaledb---

Explore more

Back to dashboardtimescale CVEstimescaledb vulnerabilities