Timescale vulnerabilities
We track 7 vulnerabilities in Timescale products across 3 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on October 26, 2026.
Latest Timescale vulnerabilities
- 7.5 High severity
pgvectorscale: Access of Resource Using Incompatible Type
Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create
- 7.1 High severity
timescaledb: Out-of-bounds Read
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored
- 8.1 High severity
timescaledb: Out-of-bounds Read
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c). The forward path validates the decoded index; the reverse path uses an asserti
- 8.8 High severity
timescaledb: Untrusted Search Path
TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the search_path setting to locate unqualified database objects (tables, functions, operators). If th
- 9.1 Critical severity
pgai: Exposure of Sensitive Information to an Unauthorized Actor
pgai is a Python library that transforms PostgreSQL into a retrieval engine for RAG and Agentic applications. Prior to commit 8eb3567, the pgai repository was vulnerable to an attack allowing the exfiltration of all secrets used in one workflow. In particular,
- 8.8 High severity
timescaledb: Improper Privilege Management
TimescaleDB, an open-source time-series SQL database, has a privilege escalation vulnerability in versions 2.8.0 through 2.9.2. During installation, TimescaleDB creates a telemetry job that is runs as the installation user. The queries run as part of the telem
- 8.0 High severity
Timescaledb: Incorrect Authorization
Timescale TimescaleDB 1.x and 2.x before 2.5.2 may allow privilege escalation during extension installation. The installation process uses commands such as CREATE x IF NOT EXIST that allow an unprivileged user to precreate objects. These objects will be used b