Superuser Privilege Escalation Vulnerability in PostgreSQL Anonymizer

CVE-2026-9617

What is CVE-2026-9617?

The PostgreSQL Anonymizer contains a vulnerability that could allow an unprivileged user to escalate their privileges. By creating a table and injecting malicious code into a column identifier, an attacker may execute the k-anonymity function with superuser rights, thereby compromising the database integrity. This risk is particularly notable in instances running PostgreSQL 14 or those upgraded from earlier versions. In PostgreSQL 15 and later, the public schema's creation permission is revoked by default, which limits the potential attack vector, requiring explicit permissions for execution. This vulnerability has been addressed in PostgreSQL Anonymizer version 3.1.0 and later.

References