Data Masking Flaw in PostgreSQL Anonymizer Software
CVE-2026-105620

6.5MEDIUM

Key Information:

Vendor

Dalibo

Status
Postgresql Anonymizer
Vendor
CVE Published:
28 October 2026

What is CVE-2026-105620?

The PostgreSQL Anonymizer software contains a vulnerability that fails to mask sensitive data returned by sub-queries within its rules. This oversight can potentially expose confidential information, compromising data privacy for users. The issue affects versions 3.2.0 and earlier, and it has been addressed in version 3.3.0 and beyond. Users are advised to update to the latest version to safeguard against unintended data exposure.

Affected Version(s)

PostgreSQL Anonymizer 1 < 3.3.0

References

https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/698

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL Anonymizer project thanks user Ilya Staroverov for reporting this problem.
.