CVE-2026-97469

A flaw was found in PostgreSQL Anonymizer. An authenticated, unprivileged masked user can bypass access restrictions to execute restricted functions by embedding function calls within a subquery. By repeatedly invoking functions such as anon.hash, an attacker can collect output to deduce the...

CVE-2026-97469

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

CVE-2026-97469 PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

CVE-2026-97469

PostgreSQL Anonymizer contains a vulnerability allowing authenticated, unprivileged masked users to bypass access restrictions by embedding function calls within a subquery . This allows the execution of RESTRICTED functions, such as anon.hash() . An attacker can repeatedly invoke these functions...

EUVD-2026-87134

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

CVE-2026-97469 PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

CVE-2026-97469: Use of Weak Hash

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

CVE-2026-83534

A flaw was found in PostgreSQL Anonymizer. This vulnerability, located in the anon.anonymizedatabaseparallel function, allows an authenticated table owner to execute arbitrary code with superuser privileges. This could lead to a complete compromise of the database system. Mitigation If the...

CVE-2026-19634

A flaw was found in PostgreSQL Anonymizer. A SQL injection vulnerability exists in the importdatabaserules and importrolesrules functions. A malicious user can craft a JSON document with specially designed object names. If a superuser then imports this document, the malicious code within it can b...

CVE-2026-19633

A flaw was found in PostgreSQL Anonymizer. This vulnerability allows unprivileged masked users to execute arbitrary code. By manipulating operators, domain casts, or view subqueries that contain untrusted expressions, an attacker can cause malicious code to run with elevated privileges within the...

CVE-2026-19634

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.importdatabaserules or anon.importrolesrules, the malicious code is executed with...

CVE-2026-83534

PostgreSQL Anonymizer contains a vulnerability in the anon.anonymizedatabaseparallel function that allows the owner of a table to run arbitrary code with superuser privilege. The issue is fixed in PostgreSQL Anonymizer 3.2.0 and later versions...

CVE-2026-19633

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the...

CVE-2026-83534

PostgreSQL Anonymizer contains a privilege escalation vulnerability in the anon.anonymize_database_parallel() function, allowing the owner of a table to execute arbitrary code with superuser privileges. The CVSS 3.1 score is 6.4 (MEDIUM) , with a network attack vector, high complexity, high privi...

EUVD-2026-72143

PostgreSQL Anonymizer contains a vulnerability in the anon.anonymizedatabaseparallel function that allows the owner of a table to run arbitrary code with superuser privilege. The issue is fixed in PostgreSQL Anonymizer 3.2.0 and later versions...

CVE-2026-83534 PostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_parallel()

PostgreSQL Anonymizer contains a vulnerability in the anon.anonymizedatabaseparallel function that allows the owner of a table to run arbitrary code with superuser privilege. The issue is fixed in PostgreSQL Anonymizer 3.2.0 and later versions...

CVE-2026-83534 PostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_parallel()

PostgreSQL Anonymizer contains a vulnerability in the anon.anonymizedatabaseparallel function that allows the owner of a table to run arbitrary code with superuser privilege. The issue is fixed in PostgreSQL Anonymizer 3.2.0 and later versions...

CVE-2026-83534 PostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_parallel()

PostgreSQL Anonymizer contains a vulnerability in the anon.anonymizedatabaseparallel function that allows the owner of a table to run arbitrary code with superuser privilege. The issue is fixed in PostgreSQL Anonymizer 3.2.0 and later versions...

CVE-2026-19634 PostgreSQL Anonymizer: SQL injection in import_database_rules() and import_roles_rules() via crafted object names / JSON

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.importdatabaserules or anon.importrolesrules, the malicious code is executed with...

EUVD-2026-72142

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.importdatabaserules or anon.importrolesrules, the malicious code is executed with...