Unauthorized Access in PostgreSQL Anonymizer by Dalibo
CVE-2026-105616

5.7MEDIUM

Key Information:

Vendor

Dalibo

Status
Postgresql Anonymizer
Vendor
CVE Published:
28 October 2026

What is CVE-2026-105616?

The PostgreSQL Anonymizer allows unauthorized users to view sensitive configuration details related to the salt and shift settings through the SHOW command. While access is restricted for users not part of pg_read_all_settings, these details can still be exposed in the pg_db_role_setting or pg_roles tables if previously set. To mitigate this risk, users are advised to utilize the ALTER DATABASE and ALTER ROLE commands to manage the salt configurations. The issue has been addressed in PostgreSQL Anonymizer version 3.3.0 and later.

Affected Version(s)

PostgreSQL Anonymizer 1 < 3.3.0

References

https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/694

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL Anonymizer project thanks user Ilya Staroverov for reporting this problem.
.