CVE-2026-2361

Publication date 11 February 2026

Last updated 12 February 2026

Ubuntu priority

Cvss 3 Severity Score

Description

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a temporary view based on a function containing malicious code. When the anon.get_tablesample_ratio function is then called, the malicious code is executed with superuser privileges. This privilege elevation can be exploited by users having the CREATE privilege in PostgreSQL 15 and later. The risk is higher with PostgreSQL 14 or with instances upgraded from PostgreSQL 14 or a prior version because the creation permission on the public schema is granted by default. The problem is resolved in PostgreSQL Anonymizer 3.0.1 and further versions

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
postgresql-18	25.10 questing	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
postgresql-17	25.10 questing	Not affected
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
postgresql-16	25.10 questing	Not in release
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Not in release
postgresql-14	25.10 questing	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not affected
postgresql-12	25.10 questing	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
	20.04 LTS focal	Not affected
postgresql-10	25.10 questing	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
	18.04 LTS bionic	Not affected
postgresql-9.5	25.10 questing	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
	16.04 LTS xenial	Not affected
postgresql-9.3	25.10 questing	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
	14.04 LTS trusty	Vulnerable, fix deferred

Notes

leosilva

PostgreSQL 9.3 is end of life upstream, and no updates are are available. Marking as deferred in -esm-main releases.

mdeslaur

This is a CVE in PostgreSQL Anonymizer, not PostgreSQL itself.

Severity score breakdown

Parameter	Value
Base score	8.0 · High
Attack vector	Network
Attack complexity	High
Privileges required	High
User interaction	None
Scope	Changed
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H