Executive Summary

CVE-2026-2360 is a vulnerability in PostgreSQL Anonymizer that allows a user to gain superuser privileges by creating a custom operator in the public schema containing malicious code. When the extension is created, this operator is executed with superuser privileges, enabling privilege escalation.

The risk is higher in PostgreSQL 14 or instances upgraded from PostgreSQL 14 or earlier, because by default all users have CREATE privileges on the public schema. In PostgreSQL 15 and later, the default CREATE permission on the public schema is revoked, reducing the risk unless a superuser explicitly adds a new schema to the search path and grants CREATE privileges to untrusted users, which is discouraged.

The vulnerability is resolved in PostgreSQL Anonymizer version 3.0.1 and later.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized privilege escalation, allowing an attacker to gain superuser access to the PostgreSQL database. With superuser privileges, the attacker can execute arbitrary code, manipulate data, and compromise the entire database system.

The impact is more severe on PostgreSQL 14 or earlier versions where users have CREATE privileges on the public schema by default, making it easier to exploit. In later versions, exploitation requires misconfiguration by a superuser, which is discouraged.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability involves the creation of a custom operator in the public schema that executes malicious code with superuser privileges when the PostgreSQL Anonymizer extension is created.'}, {'type': 'paragraph', 'content': 'To detect this vulnerability, you should check if untrusted users have CREATE privileges on the public schema or any schema in the search path, and whether any suspicious custom operators exist in those schemas.'}, {'type': 'paragraph', 'content': 'Suggested commands to detect potential exploitation or risk include:'}, {'type': 'list_item', 'content': "Check schemas where untrusted users have CREATE privileges: \nSELECT nspname, rolname FROM pg_namespace JOIN pg_roles ON pg_namespace.nspowner = pg_roles.oid WHERE has_schema_privilege(rolname, nspname, 'CREATE');"}, {'type': 'list_item', 'content': "List operators in the public schema or other schemas in the search path: \nSELECT oprname, oprnamespace::regnamespace FROM pg_operator WHERE oprnamespace = 'public'::regnamespace;"}, {'type': 'list_item', 'content': 'Check the current search path for your database sessions: \nSHOW search_path;'}, {'type': 'paragraph', 'content': 'By auditing schema privileges and operators, you can identify if the conditions for this vulnerability exist.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include revoking CREATE privileges from untrusted users on the public schema and any other schemas in the search path.

Specifically:

• Revoke CREATE privilege on the public schema: REVOKE CREATE ON SCHEMA public FROM PUBLIC;
• Ensure that the search_path does not include schemas where untrusted users have CREATE privileges.
• Upgrade PostgreSQL Anonymizer to version 3.0.1 or later, where this vulnerability is resolved.

Additionally, avoid adding new schemas to the search_path that grant CREATE privileges to untrusted users, as this can enable exploitation.

Useful 0 Not Useful 0