26.3.x Resolved issues¶
26.3.0-0¶
Updated 9/23/2026
| Issue Key | Application Module | Description |
|---|---|---|
| 114511 | UI - Management Console | Fixed an issue with a documentation link in the MC load monitor page. 修复了 MC 负载监控页面中文档链接的问题。 |
| 114340 | UI - Management Console | Validated that Vertica Management Console is not impacted by CVE-2024-22233, CVE-2024-22234, CVE-2024-22236, or CVE-2024-22243. 已验证 Vertica Management Console 不受 CVE-2024-22233、CVE-2024-22234、CVE-2024-22236 或 CVE-2024-22243 的影响。 |
| 100267 | UI - Management Console | Fixed an issue in the Management Console where the Query Plan screen showed no profile information for queries run from the Query Execution screen. 修复了 Management Console 中从 Query Execution 页面运行的查询在 Query Plan 页面不显示 profile 信息的问题。 |
| 25453 | UI - Management Console | This update addresses a security vulnerability, CVE-2022-35980, identified in the Management Console where user input fields were not properly sanitized against injection attacks. 本次更新修复了 Management Console 中的安全漏洞 CVE-2022-35980，该漏洞因用户输入字段未正确净化而面临注入攻击风险。 |
| 24877 | Third Party Tools Integration | This update addresses multiple security vulnerabilities (CVE-2023-32002, CVE-2023-32003, CVE-2023-32004, CVE-2023-32005, CVE-2023-32006, CVE-2023-32558, CVE-2023-32559, CVE-2024-28863) identified in Node.js and the node-tar module used by the Management Console. 本次更新修复了 Management Console 使用的 Node.js 和 node-tar 模块中的多个安全漏洞（CVE-2023-32002、CVE-2023-32003、CVE-2023-32004、CVE-2023-32005、CVE-2023-32006、CVE-2023-32558、CVE-2023-32559、CVE-2024-28863）。 |
| 11508 | UI - Management Console | This update addresses a critical security vulnerability, CVE-2025-12453, identified as a Reflected Cross-Site Scripting (XSS) flaw in Vertica, specifically affecting version 10.0.1. Prior to this fix, an authenticated attacker could exploit unmanaged input parameters in certain Web UI endpoints to inject and execute arbitrary JavaScript code. This update includes essential security enhancements to mitigate the identified XSS vulnerability and measures to ensure proper sanitization and neutralization of user-supplied input, preventing the execution of malicious scripts. Users are advised to update to the latest version to benefit from these security improvements. 本次更新修复了 Management Console 中的关键安全漏洞 CVE-2025-12453，该漏洞为反射型跨站脚本 (XSS) 漏洞，具体影响 10.0.1 版本。修复前，认证攻击者可利用某些 Web UI 端点中未受控的输入参数注入并执行任意 JavaScript 代码。本次更新包含必要的安全增强以缓解该 XSS 漏洞，并确保对用户输入的正确净化和中和，防止恶意脚本执行。建议用户更新到最新版本以获得这些安全改进。 |
| 4492 | Documentation | Corrected the CREATE FLEX TABLE documentation to indicate that the ENCODED BY clause is not supported when creating a flex table from a query (CREATE FLEX TABLE ... AS SELECT). 修正了 CREATE FLEX TABLE 文档，说明通过查询创建 flex 表（CREATE FLEX TABLE ... AS SELECT）时不支持 ENCODED BY 子句。 |
| 2923 | HTTP | Fixed an issue where the MCP Server DSN builder did not percent-encode passwords, causing connection failures for passwords containing URL-reserved characters such as @, :, or #. 修复了 MCP Server DSN 构建器未对密码进行百分号编码的问题，该问题会导致包含 @、: 或 # 等 URL 保留字符的密码连接失败。 |
| 2898 | Security | Strengthened the Management Console Content Security Policy (CSP) header by removing the unsafe-inline and unsafe-eval directives to reduce exposure to cross-site scripting attacks. 通过移除 unsafe-inline 和 unsafe-eval 指令强化了 Management Console 的 Content Security Policy (CSP) 响应头，以降低跨站脚本攻击风险。 |
| 2189 | UI - Management Console | Fixed an issue that was causing 'Connection timed out' errors when attempting to log in to the Vertica Management Console (MC) via a reverse proxy. 修复了通过反向代理登录 Vertica Management Console (MC) 时出现「Connection timed out」错误的问题。 |
| 1402 | Security | This update addresses multiple security vulnerabilities identified in third-party components bundled with Vertica Server and the Vertica Operator, including Python 3.13, Go standard library, and associated Go modules used by the Node Management Agent, Prometheus integration, and MCP Server. 本次更新修复了 Vertica Server 和 Vertica Operator 捆绑的第三方组件中的多个安全漏洞，涉及 Python 3.13、Go 标准库，以及 Node Management Agent、Prometheus 集成和 MCP Server 使用的相关 Go 模块。 |