Data Masking Issue in PostgreSQL Anonymizer by Dalibo
CVE-2026-105617

5.7MEDIUM

Key Information:

Vendor

Dalibo

Status
Postgresql Anonymizer
Vendor
CVE Published:
28 October 2026

What is CVE-2026-105617?

The PostgreSQL Anonymizer suffers from a flaw where plans prepared after a rule modification or role change are not invalidated. As a result, users can inadvertently access unmasked data throughout their session, posing a potential data security risk. This issue is effectively resolved in PostgreSQL Anonymizer version 3.3.0 and later, ensuring that data masking rules are appropriately enforced.

Affected Version(s)

PostgreSQL Anonymizer 1 < 3.3.0

References

https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/695

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL Anonymizer project thanks user Ilya Staroverov for reporting this problem.
.