CVE-2026-2360

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2360", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-02-11T17:11:41.119Z", "datePublished": "2026-02-11T17:47:55.737Z", "dateUpdated": "2026-02-11T18:29:12.805Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-02-11T17:47:55.737Z"}, "title": "Improper search_path protection in PostgreSQL Anonymizer 2.5 allows any user to gain superuser privileges in PostgreSQL 14", "descriptions": [{"lang": "en", "value": "PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place malicious code in that operator. This operator will later be executed with superuser privileges when the extension is created. The risk is higher with PostgreSQL 14 or with instances upgraded from PostgreSQL 14 or a prior version. With PostgreSQL 15 and later, the creation permission on the public schema is revoked by default and this exploit can only be achieved if a superuser adds a new schema in her/his own search_path and grants the CREATE privilege on that schema to untrusted users, both actions being clearly discouraged by the PostgreSQL documentation. The problem is resolved in PostgreSQL Anonymizer 3.0.1 and further versions"}], "affected": [{"defaultStatus": "unaffected", "product": "PostgreSQL Anonymizer", "vendor": "DALIBO", "versions": [{"lessThan": "3.0.1", "status": "affected", "version": "1", "versionType": "rpm"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-427", "type": "CWE", "description": "Uncontrolled Search Path Element"}]}], "references": [{"url": "https://gitlab.com/dalibo/postgresql_anonymizer/-/blob/latest/NEWS.md"}, {"url": "https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/616"}, {"url": "https://www.postgresql.org/docs/current/ddl-schemas.html#DDL-SCHEMAS-PATH"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8, "baseSeverity": "HIGH"}}], "workarounds": [{"lang": "en", "value": "Do not allow users to create new objects in the public schema by running the following command in all of your databases: REVOKE CREATE ON SCHEMA public FROM PUBLIC;"}], "credits": [{"lang": "en", "value": "The PostgreSQL Anonymizer project thanks Daniel Bakker for reporting this problem."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T18:26:16.656159Z", "id": "CVE-2026-2360", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T18:29:12.805Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2360", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T18:26:16.656159Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T18:29:06.040Z"}}], "cna": {"title": "Improper search_path protection in PostgreSQL Anonymizer 2.5 allows any user to gain superuser privileges in PostgreSQL 14", "credits": [{"lang": "en", "value": "The PostgreSQL Anonymizer project thanks Daniel Bakker for reporting this problem."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"}}], "affected": [{"vendor": "DALIBO", "product": "PostgreSQL Anonymizer", "versions": [{"status": "affected", "version": "1", "lessThan": "3.0.1", "versionType": "rpm"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://gitlab.com/dalibo/postgresql_anonymizer/-/blob/latest/NEWS.md"}, {"url": "https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/616"}, {"url": "https://www.postgresql.org/docs/current/ddl-schemas.html#DDL-SCHEMAS-PATH"}], "workarounds": [{"lang": "en", "value": "Do not allow users to create new objects in the public schema by running the following command in all of your databases: REVOKE CREATE ON SCHEMA public FROM PUBLIC;"}], "descriptions": [{"lang": "en", "value": "PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place malicious code in that operator. This operator will later be executed with superuser privileges when the extension is created. The risk is higher with PostgreSQL 14 or with instances upgraded from PostgreSQL 14 or a prior version. With PostgreSQL 15 and later, the creation permission on the public schema is revoked by default and this exploit can only be achieved if a superuser adds a new schema in her/his own search_path and grants the CREATE privilege on that schema to untrusted users, both actions being clearly discouraged by the PostgreSQL documentation. The problem is resolved in PostgreSQL Anonymizer 3.0.1 and further versions"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-427", "description": "Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-02-11T17:47:55.737Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2360", "state": "PUBLISHED", "dateUpdated": "2026-02-11T18:29:12.805Z", "dateReserved": "2026-02-11T17:11:41.119Z", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "datePublished": "2026-02-11T17:47:55.737Z", "assignerShortName": "PostgreSQL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PostgreSQL Anonymizer", "vendor": "DALIBO", "versions": [{"lessThan": "3.0.1", "status": "affected", "version": "1", "versionType": "rpm"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place malicious code in that operator. This operator will later be executed with superuser privileges when the extension is created. The risk is higher with PostgreSQL 14 or with instances upgraded from PostgreSQL 14 or a prior version. With PostgreSQL 15 and later, the creation permission on the public schema is revoked by default and this exploit can only be achieved if a superuser adds a new schema in her/his own search_path and grants the CREATE privilege on that schema to untrusted users, both actions being clearly discouraged by the PostgreSQL documentation. The problem is resolved in PostgreSQL Anonymizer 3.0.1 and further versions"}, {"lang": "es", "value": "PostgreSQL Anonymizer contiene una vulnerabilidad que permite a un usuario obtener privilegios de superusuario al crear un operador personalizado en el esquema p\u00fablico y colocar c\u00f3digo malicioso en ese operador. Este operador ser\u00e1 ejecutado posteriormente con privilegios de superusuario cuando la extensi\u00f3n sea creada. El riesgo es mayor con PostgreSQL 14 o con instancias actualizadas desde PostgreSQL 14 o una versi\u00f3n anterior. Con PostgreSQL 15 y posteriores, el permiso de creaci\u00f3n en el esquema p\u00fablico es revocado por defecto y este exploit solo puede lograrse si un superusuario a\u00f1ade un nuevo esquema en su propio search_path y otorga el privilegio CREATE en ese esquema a usuarios no confiables, ambas acciones siendo claramente desaconsejadas por la documentaci\u00f3n de PostgreSQL. El problema est\u00e1 resuelto en PostgreSQL Anonymizer 3.0.1 y versiones posteriores."}], "id": "CVE-2026-2360", "lastModified": "2026-06-17T10:30:50.340", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 6.0, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2360", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T18:26:16.656159Z", "version": "2.0.3"}}]}, "published": "2026-02-11T18:16:08.153", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://gitlab.com/dalibo/postgresql_anonymizer/-/blob/latest/NEWS.md"}, {"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/616"}, {"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://www.postgresql.org/docs/current/ddl-schemas.html#DDL-SCHEMAS-PATH"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1,3.0.1)"}}], "product": "postgresql_anonymizer", "vendor": "dalibo"}], "analysis": {"en": {"generated_at": "2026-04-17T20:17:59.695655+00:00", "value": {"mitigation_remediation": ["Upgrade to PostgreSQL Anonymizer 3.0.1 or a later release.", "If an upgrade is not immediately possible, revoke the CREATE privilege on the public schema from PUBLIC using REVOKE CREATE ON SCHEMA public FROM PUBLIC;", "Ensure that any newly created schemas have restricted permissions and that superusers do not grant CREATE to untrusted roles."], "summary": {"action": "Apply Update", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The vulnerability impacts the Dalibo PostgreSQL Anonymizer extension version 2.5 running on PostgreSQL 14 databases, and on any PostgreSQL instance that has been upgraded from 14 where the public schema still grants CREATE rights to PUBLIC. PostgreSQL 15 and later are not affected by default, because CREATE is revoked on the public schema, but the exploit could still succeed if a superuser creates another schema on the search_path and grants CREATE to untrusted users \u2013 a configuration that is strongly discouraged.", "description_and_impact": "PostgreSQL Anonymizer 2.5 contains a missing search_path protection that allows an ordinary database user to create a malicious custom operator in the public schema. When the extension is later created, the operator is executed with superuser privileges, enabling the attacker to gain full administrative control over the PostgreSQL instance. This flaw is a classic privilege\u2011escalation vulnerability and is classified as CWE\u2011427.", "risk_and_exploitability": "The CVSS score is 8.0, indicating high severity. The EPSS score is less than 1%, so the likelihood of exploitation is considered very low, and the vulnerability is not in the CISA KEV catalog. The attack vector is inferred to be an authenticated database user that has permission to create operators in the public schema, which is common in a default PostgreSQL installation where PUBLIC has CREATE rights. Once the malicious operator is triggered during extension creation, it executes with superuser privileges, allowing the attacker to read, modify, or delete any data and execute arbitrary SQL commands."}}}}, "created": "2026-02-11T21:37:46.110987+00:00", "updated": "2026-04-17T20:30:15.805180+00:00", "vendors": ["dalibo", "dalibo$PRODUCT$postgresql_anonymizer"]}