PT-2026-7634 · Unknown+1 · Postgresql Anonymizer+1

Published 2026-02-11 · Updated 2026-02-12 · CVE-2026-2361

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PostgreSQL Anonymizer versions prior to 3.0.1 PostgreSQL versions 14 and 15

Description A flaw exists in PostgreSQL Anonymizer that could allow a user with CREATE privileges to gain superuser privileges. This occurs by creating a temporary view based on a function containing malicious code. When the anon.get tablesample ratio function is called, the malicious code executes with elevated privileges. The risk is increased in PostgreSQL 14 or instances upgraded from PostgreSQL 14 or earlier due to default permissions on the public schema.

Recommendations Upgrade to PostgreSQL Anonymizer version 3.0.1 or a later version. For PostgreSQL versions 14 and 15, restrict the CREATE privilege to authorized users only.

Fix

LPE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2026-2361

Affected Products

Postgresql

Postgresql Anonymizer

References · 9

• https://osv.dev/vulnerability/CVE-2026-2361 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-2361 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2361 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-2361 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-2361 · Security Note
• https://t.me/CVEtracker/44455 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2021744150865916101 · Twitter Post
• https://gitlab.com/dalibo/postgresql_anonymizer/-/blob/latest/NEWS.md · Note
• https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/617 · Note