DALIBO PostgreSQL Anonymizer up to 3.0.0 anon.get_tablesample_ratio uncontrolled search path

Summaryinfo

A vulnerability has been found in DALIBO PostgreSQL Anonymizer up to 3.0.0 and classified as problematic. This vulnerability affects the function anon.get_tablesample_ratio. Performing a manipulation results in uncontrolled search path. This vulnerability is cataloged as CVE-2026-2361. The attack must be initiated from a local position. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in DALIBO PostgreSQL Anonymizer up to 3.0.0. It has been classified as critical. This affects the function anon.get_tablesample_ratio. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. CWE is classifying the issue as CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a temporary view based on a function containing malicious code. When the anon.get_tablesample_ratio function is then called, the malicious code is executed with superuser privileges. This privilege elevation can be exploited by users having the CREATE privilege in PostgreSQL 15 and later. The risk is higher with PostgreSQL 14 or with instances upgraded from PostgreSQL 14 or a prior version because the creation permission on the public schema is granted by default. The problem is resolved in PostgreSQL Anonymizer 3.0.1 and further versions

It is possible to read the advisory at gitlab.com. This vulnerability is uniquely identified as CVE-2026-2361 since 02/11/2026. The exploitability is told to be difficult. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1574 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 298761 (Linux Distros Unpatched Vulnerability : CVE-2026-2361), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.0.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (298761). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Database Software

Vendor

• DALIBO

Name

• PostgreSQL Anonymizer

Version

• 3.0

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion