What is the CVSS score of CVE-2026-2361?

CVE-2026-2361 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PostgreSQL are affected by CVE-2026-2361?

PostgreSQL Anonymizer users face a privilege escalation vulnerability that allows attackers to gain superuser access through malicious code execution.

How to fix or mitigate CVE-2026-2361?

Within 24 hours: Audit PostgreSQL instances for Anonymizer extension deployment and restrict database access to trusted users only. Within 7 days: Implement network segmentation to limit PostgreSQL connectivity and disable the anon.get_tablesample_ratio function if not actively required. Within 30 days: Monitor vendor communications for patch availability and prepare emergency patching procedures; consider migrating to alternative anonymization solutions if patches remain unavailable.

PostgreSQL CVE-2026-2361

HIGH

Uncontrolled Search Path Element (CWE-427)

2026-02-11 f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

PostgreSQL

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 18:16 nvd

HIGH 8.0

DescriptionCVE.org

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a temporary view based on a function containing malicious code. When the anon.get_tablesample_ratio function is then called, the malicious code is executed with superuser privileges. This privilege elevation can be exploited by users having the CREATE privilege in PostgreSQL 15 and later. The risk is higher with PostgreSQL 14 or with instances upgraded from PostgreSQL 14 or a prior version because the creation permission on the public schema is granted by default. The problem is resolved in PostgreSQL Anonymizer 3.0.1 and further versions

AnalysisAI

Privilege escalation in PostgreSQL Anonymizer allows authenticated users with CREATE privileges to gain superuser access by exploiting unsafe function execution within temporary views. This vulnerability affects PostgreSQL 15 and later, with heightened risk on PostgreSQL 14 instances due to default public schema permissions, and impacts all users unable to upgrade to version 3.0.1 or later. No patch is currently available for affected deployments.

Technical ContextAI

Classified as CWE-427 (Uncontrolled Search Path Element). PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a temporary view based on a function containing malicious code. When the anon.get_tablesample_ratio function is then called, the malicious code is executed with superuser privileges. This privilege elevation can be exploited by users having the CREATE privilege in PostgreSQL 15 and later. The risk is higher with PostgreSQL 14 or with instances upgraded from PostgreSQL 14 or a prior version