CVE-2026-2361: Postgresql Seclabels Security Definer

A function declared with SECURITY DEFINER queries the `pg_seclabels` view. Querying this catalog view within a privileged context allows an attacker with CREATE privileges to execute malicious code via a crafted view with superuser privileges.

Provally CuratedPublic repositoryHighHigh confidenceVerifiedApache-2.0Generic
greprules fetch cve-2026-2361-postgresql-seclabels-security-definer --engine opengrep

Description

A function declared with SECURITY DEFINER queries the `pg_seclabels` view. Querying this catalog view within a privileged context allows an attacker with CREATE privileges to execute malicious code via a crafted view with superuser privileges.