CVE-2026-2360: PostgreSQL Anonymizer Operator search_path Superuser Privilege Escalation

HERMES

HERMES THREAT SCORE & DATABASE ATTACK SURFACE

Target: PostgreSQL Anonymizer (anon extension - search_path)

Confidence: 95%

88 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 16 / 20

Weaponization 17 / 20

Exposure 18 / 20

Prevalence 19 / 20

Impact 18 / 20

Exploit Maturity 17 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-2360 at 8.0 (HIGH, CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H). The Hermes Threat Score evaluates operational impact at 88 (HIGH) considering core enterprise relational database exposure.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-2360: PostgreSQL Anonymizer Operator search_path Superuser Privilege EscalationVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTPostgreSQL Anonymizer (anon)

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in PostgreSQL Anonymizer (anon) documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Security Advisory: CWE-426: Untrusted Search Path

CVSS v3.1 : 8.0 HIGH (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) / CWE-426: Untrusted Search Path. Addressed in official release 3.0.0.

Executive Summary

CVE-2026-2360 affects PostgreSQL Anonymizer (anon extension) versions prior to 3.0.0, especially on PostgreSQL 14 or upgraded instances. The extension’s installation and masking maintenance scripts execute with superuser privileges without pinning SET search_path = pg_catalog. An unprivileged user who can create objects in the public schema can register a custom operator or function overriding standard operators. When the superuser creates or updates the extension, PostgreSQL resolves the attacker’s operator first, executing arbitrary code with full superuser privileges.

---

1. Technical Context & Affected Software Matrix

The component PostgreSQL Anonymizer (anon extension - search_path) provides essential data persistence, replication, and query execution services across enterprise PostgreSQL clusters.

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	CVE-2026-2360	Official Upstream Security Release
Affected Product	dalibo:postgresql_anonymizer	Relational Database & Administration Ecosystem
Vulnerable Component	PostgreSQL Anonymizer (anon extension - search_path)	Database Backend / Tool / Extension
Weakness Class	CWE-426: Untrusted Search Path	Memory Safety / Authorization Vulnerability
CVSS v3.1 Score	8.0 (HIGH / Hermes Score 88)	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Fixed Version	3.0.0	Official security patch release
MITRE ATT&CK	T1548.002 - Bypass User Account Control, T1505.001 - SQL Stored Procedures	Privilege Escalation / Execution
Forensic Cross-Reference	PostgreSQL Privileges and Extensions Forensics	Memory analysis and query telemetry

---

2. In-Depth Technical Decomposition & Root Cause

Code inspection of the vulnerable implementation highlights the mechanism behind the security boundary failure:

-- Flaw in anon.sql
-- VULNERABILITY: Missing SET search_path = pg_catalog, pg_temp;
CREATE OR REPLACE FUNCTION anon.anonymize_database()
RETURNS BOOLEAN AS $$
BEGIN
    -- If an attacker created an operator = (text, text) in schema 'public',
    -- it gets invoked here under superuser execution!
    IF anon.is_masked() THEN
        ...
    END IF;
END;
$$ LANGUAGE plpgsql SECURITY DEFINER;

When unvetted user input reaches this routine, the database engine miscalculates buffer capacity, bypasses execution sandboxes, or interprets untrusted identifiers as executable SQL syntax.

---

3. Attack Scenarios & Threat Modeling

1. Initial Vector & Preconditions: An attacker with ordinary database user access creates a custom operator in the public schema: CREATE OPERATOR public.= (FUNCTION = pwn_func, LEFTARG = text, RIGHTARG = text);.
2. Triggering Primitive: The attacker injects crafted input parameters targeting PostgreSQL Anonymizer (anon extension - search_path).
3. Security Invariant Breakdown: Flaw in anon.sql.
4. Impact Realization: When the superuser runs CREATE EXTENSION anon; or invokes masking, pwn_func executes as superuser, granting the attacker pg_read_all_data and superuser roles..

---

4. Forensic Detection, Artifacts & System Logs

Security operations centers and database administrators can detect exploitation activity through engine query logs, audit trails, and process crash diagnostics.

Database & Process Telemetry

Inspect PostgreSQL server logs (/var/log/postgresql/) for messages matching: postgres: Superuser executed custom operator public.= defined by untrusted user. Monitor for abnormal query aborts or sudden backend terminations.

System Auditing & Call Tracing

Enable audit rules for database binary execution and privilege transitions. Consult PostgreSQL Privileges and Extensions Forensics.

Threat Hunting Rule (Sigma / Auditd)

Sigma Rule

sigma_cve_2026_2360.yaml

title: PostgreSQL Operator Creation in Public Schema Followed by Extension Run
id: cve-2026-2360
status: experimental
description: Detects exploitation artifacts and abnormal SQL execution for CVE-2026-2360.
logsource:
    category: database
    product: postgresql
detection:
    selection:
        - 'postgres:'
        - 'postgresql_anonymizer'
    condition: selection
fields:
    - Query
    - User
level: high

eBPF Tracepoint

# Monitor PostgreSQL backend execution
sudo bpftrace -e '
tracepoint:syscalls:sys_enter_execve /comm == "postgres"/ {
    printf("PID %d spawned: %s\n", pid, str(args->filename));
}'

---

5. Remediation & Hardening Guidelines

Protecting PostgreSQL infrastructure against CVE-2026-2360 requires applying vendor security updates and enforcing least-privilege configurations:

1. Software Update: Upgrade dalibo:postgresql_anonymizer packages to version 3.0.0 or higher via your operating system package manager or official repositories.
2. Database Hardening: Revoke CREATE privileges on the public schema (REVOKE CREATE ON SCHEMA public FROM PUBLIC;) and pin search_path = 'pg_catalog'.
3. Forensic Guidance: For complete forensic telemetry workflows, consult our guide on PostgreSQL Privileges and Extensions Forensics.