PostgreSQL Anonymizer Inheritance Table Access Vulnerability
CVE-2026-105618

5.7MEDIUM

Key Information:

Vendor

Dalibo

Status
Postgresql Anonymizer
Vendor
CVE Published:
28 October 2026

What is CVE-2026-105618?

The PostgreSQL Anonymizer has a vulnerability that arises from inadequate handling of direct access to partitioned and inherited tables. While the documentation advises applying access control rules, direct access remains possible through the parent table structure, potentially exposing sensitive data. This problem has been addressed in PostgreSQL Anonymizer version 3.3.0 and above.

Affected Version(s)

PostgreSQL Anonymizer 1 < 3.3.0

References

https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/696

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL Anonymizer project thanks user Ilya Staroverov for reporting this problem.
.