PostgreSQL Anonymizer Vulnerability Allowing Superuser Privileges

CVE-2026-2360

What is CVE-2026-2360?

The PostgreSQL Anonymizer has a vulnerability that allows a malicious user to gain superuser privileges by creating a custom operator within the public schema. By embedding harmful code in this operator, it can be executed with elevated privileges upon creation of the extension. This issue is particularly pronounced in PostgreSQL 14 or instances upgraded from earlier versions. It is mitigated in PostgreSQL 15 and later, where the ability to create new operators in the public schema is revoked by default, although risks remain if superusers improperly configure search paths. The issue is addressed in PostgreSQL Anonymizer version 3.0.1 and subsequent releases.

References