CVE-2026-2361

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2361", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-02-11T17:11:41.858Z", "datePublished": "2026-02-11T17:48:03.805Z", "dateUpdated": "2026-02-11T18:24:03.242Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-02-11T17:48:03.805Z"}, "title": "Improper search_path protection in PostgreSQL Anonymizer 2.5 allows any user with create privilege to gain superuser privileges", "descriptions": [{"lang": "en", "value": "PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a temporary view based on a function containing malicious code. When the anon.get_tablesample_ratio function is then called, the malicious code is executed with superuser privileges. This privilege elevation can be exploited by users having the CREATE privilege in PostgreSQL 15 and later. The risk is higher with PostgreSQL 14 or with instances upgraded from PostgreSQL 14 or a prior version because the creation permission on the public schema is granted by default. The problem is resolved in PostgreSQL Anonymizer 3.0.1 and further versions"}], "affected": [{"defaultStatus": "unaffected", "product": "PostgreSQL Anonymizer", "vendor": "DALIBO", "versions": [{"lessThan": "3.0.1", "status": "affected", "version": "1", "versionType": "rpm"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-427", "type": "CWE", "description": "Uncontrolled Search Path Element"}]}], "references": [{"url": "https://gitlab.com/dalibo/postgresql_anonymizer/-/blob/latest/NEWS.md"}, {"url": "https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/617"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8, "baseSeverity": "HIGH"}}], "workarounds": [{"lang": "en", "value": "Drop the anon.get_tablesample_ratio function. It is obsolete."}], "credits": [{"lang": "en", "value": "The PostgreSQL Anonymizer project thanks Daniel Bakker for reporting this problem."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T18:23:47.877689Z", "id": "CVE-2026-2361", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T18:24:03.242Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2361", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T18:23:47.877689Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T18:23:50.433Z"}}], "cna": {"title": "Improper search_path protection in PostgreSQL Anonymizer 2.5 allows any user with create privilege to gain superuser privileges", "credits": [{"lang": "en", "value": "The PostgreSQL Anonymizer project thanks Daniel Bakker for reporting this problem."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"}}], "affected": [{"vendor": "DALIBO", "product": "PostgreSQL Anonymizer", "versions": [{"status": "affected", "version": "1", "lessThan": "3.0.1", "versionType": "rpm"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://gitlab.com/dalibo/postgresql_anonymizer/-/blob/latest/NEWS.md"}, {"url": "https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/617"}], "workarounds": [{"lang": "en", "value": "Drop the anon.get_tablesample_ratio function. It is obsolete."}], "descriptions": [{"lang": "en", "value": "PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a temporary view based on a function containing malicious code. When the anon.get_tablesample_ratio function is then called, the malicious code is executed with superuser privileges. This privilege elevation can be exploited by users having the CREATE privilege in PostgreSQL 15 and later. The risk is higher with PostgreSQL 14 or with instances upgraded from PostgreSQL 14 or a prior version because the creation permission on the public schema is granted by default. The problem is resolved in PostgreSQL Anonymizer 3.0.1 and further versions"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-427", "description": "Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-02-11T17:48:03.805Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2361", "state": "PUBLISHED", "dateUpdated": "2026-02-11T18:24:03.242Z", "dateReserved": "2026-02-11T17:11:41.858Z", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "datePublished": "2026-02-11T17:48:03.805Z", "assignerShortName": "PostgreSQL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PostgreSQL Anonymizer", "vendor": "DALIBO", "versions": [{"lessThan": "3.0.1", "status": "affected", "version": "1", "versionType": "rpm"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a temporary view based on a function containing malicious code. When the anon.get_tablesample_ratio function is then called, the malicious code is executed with superuser privileges. This privilege elevation can be exploited by users having the CREATE privilege in PostgreSQL 15 and later. The risk is higher with PostgreSQL 14 or with instances upgraded from PostgreSQL 14 or a prior version because the creation permission on the public schema is granted by default. The problem is resolved in PostgreSQL Anonymizer 3.0.1 and further versions"}, {"lang": "es", "value": "PostgreSQL Anonymizer contiene una vulnerabilidad que permite a un usuario obtener privilegios de superusuario creando una vista temporal basada en una funci\u00f3n que contiene c\u00f3digo malicioso. Cuando la funci\u00f3n anon.get_tablesample_ratio es luego llamada, el c\u00f3digo malicioso es ejecutado con privilegios de superusuario. Esta elevaci\u00f3n de privilegios puede ser explotada por usuarios que tienen el privilegio CREATE en PostgreSQL 15 y posteriores. El riesgo es mayor con PostgreSQL 14 o con instancias actualizadas desde PostgreSQL 14 o una versi\u00f3n anterior porque el permiso de creaci\u00f3n en el esquema p\u00fablico se concede por defecto. El problema est\u00e1 resuelto en PostgreSQL Anonymizer 3.0.1 y versiones posteriores."}], "id": "CVE-2026-2361", "lastModified": "2026-06-17T10:30:50.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 6.0, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2361", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T18:23:47.877689Z", "version": "2.0.3"}}]}, "published": "2026-02-11T18:16:08.313", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://gitlab.com/dalibo/postgresql_anonymizer/-/blob/latest/NEWS.md"}, {"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/617"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1,3.0.1)"}}], "product": "postgresql_anonymizer", "vendor": "dalibo"}], "analysis": {"en": {"generated_at": "2026-04-18T12:39:30.408024+00:00", "value": {"mitigation_remediation": ["Upgrade PostgreSQL Anonymizer to version 3.0.1 or later.", "Drop the anon.get_tablesample_ratio function, which is obsolete.", "Revoke or restrict the CREATE privilege on the public schema (or other schemas) to limit the ability to create temporary views that reference malicious functions."], "summary": {"action": "Apply Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Deployments of DALIBO PostgreSQL Anonymizer version 2.5 and any earlier releases that have not been upgraded to 3.0.1 or later. The vulnerability also affects PostgreSQL 15 and later, because users with CREATE privilege can exploit it. For PostgreSQL 14 or instances upgraded from PostgreSQL 14 or earlier, the risk is higher due to the default grant of CREATE on the public schema.", "description_and_impact": "PostgreSQL Anonymizer allows a user with CREATE privilege to elevate themselves to superuser by creating a temporary view that points to a function containing malicious code. When the anon.get_tablesample_ratio function is then invoked, the malicious code executes with superuser privileges, giving the attacker full control over the database instance and the ability to exfiltrate data, modify data, and disrupt services.", "risk_and_exploitability": "The CVSS score is 8, indicating high severity. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a user with database create privileges, possibly via a remote connection if credentials are obtained or through an insider role. This privilege escalation can lead to full database compromise, affecting confidentiality, integrity, and availability."}}}}, "created": "2026-02-11T21:37:45.370657+00:00", "updated": "2026-04-18T12:45:45.669598+00:00", "vendors": ["dalibo", "dalibo$PRODUCT$postgresql_anonymizer"]}