Read the docs
TI-2026-01996 Aliases CVE-2026-2360GHSA-r6q3-ww97-px52

Uncontrolled search path in DALIBO PostgreSQL Anonymizer

Priority LOW 37CWE-427Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-427.

Summary

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place malicious code in that operator. This operator will later be executed with superuser privileges when the extension is created. The risk is higher with PostgreSQL 14 or with instances upgraded from PostgreSQL 14 or a prior version. With PostgreSQL 15 and later, the creation permission on the public schema is revoked by default and this exploit can only be achieved if a superuser adds a new schema in her/his own search_path and grants the CREATE privilege on that schema to untrusted users, both actions being clearly discouraged by the PostgreSQL documentation. The problem is resolved in PostgreSQL Anonymizer 3.0.1 and further versions

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00495 42nd percentileScored 2026-11-07
Fix Fixed PostgreSQL Anonymizer (DALIBO): 3.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DALIBOPostgreSQL Anonymizer1 to before 3.0.13.0.1Patch availableCNA
  • PostgreSQL Anonymizer VendorDALIBO Affected 1 to before 3.0.1 Fixed in 3.0.1 Patch available CNA

Remediation

  • Fix · CNA PostgreSQL Anonymizer (DALIBO) Fixed in 3.0.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    DALIBO PostgreSQL Anonymizer 3.0.1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-01997 Uncontrolled search path in DALIBO PostgreSQL AnonymizerPriority LOW 37
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-2360
  2. 2026-10-03 Alias added: GHSA-r6q3-ww97-px52

References

Other 3

  • TI-2025-05130 Cursor allows PostgreSQL Anonymizer masked user to gain unauthorized access to authentic data CVSS 3.1MEDIUM 6.5
  • TI-2026-15944 PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries CVSS 3.1HIGH 8.8
  • TI-2024-02174 Improper Input Validation in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule CVSS 3.1HIGH 8.8
  • TI-2026-08447 PostgreSQL Anonymizer: malicious column name allows SQL injection via anon.k_anonymity() function CVSS 3.1HIGH 8.8
  • TI-2026-01997 Uncontrolled search path in DALIBO PostgreSQL Anonymizer CVSS 3.1HIGH 8.0
  • TI-2024-02173 SQL Injection in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule CVSS 3.1HIGH 8.0
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences