Vulnerability in PostgreSQL Anonymizer Affects Data Protection Features
CVE-2026-110181

6.5MEDIUM

Key Information:

Vendor

Dalibo

Status
Postgresql Anonymizer
Vendor
CVE Published:
28 October 2026

What is CVE-2026-110181?

PostgreSQL Anonymizer features a vulnerability stemming from the way it assesses anonymization functions defined with SQL-standard function bodies. Unlike PostgreSQL, which examines these functions at the declaration time, Anonymizer only checks them during execution. This discrepancy allows any user with TEMPORARY privileges to potentially exploit the flaw. Users are advised to upgrade to PostgreSQL Anonymizer version 3.3.0 or later to mitigate this issue.

Affected Version(s)

PostgreSQL Anonymizer 1 < 3.3.0

References

https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/718

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL Anonymizer project thanks user Ilya Staroverov for reporting this problem.
.