CVE-2026-97469

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

CVE-2026-97469 PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

CVE-2026-97469

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

EUVD-2026-87134

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

CVE-2026-19633

A flaw was found in PostgreSQL Anonymizer. This vulnerability allows unprivileged masked users to execute arbitrary code. By manipulating operators, domain casts, or view subqueries that contain untrusted expressions, an attacker can cause malicious code to run with elevated privileges within the...

CVE-2026-19633

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the...

PT-2026-86535

Name of the Vulnerable Software and Affected Versions PostgreSQL Anonymizer versions prior to 3.1.4 Description Unprivileged masked users can execute arbitrary code by abusing operators, domain casts, or view subqueries that contain untrusted expressions. This occurs when these objects are...

EUVD-2026-40349

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. The problem is resolved in PostgreSQL Anonymizer 3.1.2 and later version...

CVE-2026-13455 PostgreSQL Anonymizer: Unrestricted function can leak the secret salt

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. The problem is resolved in PostgreSQL Anonymizer 3.1.2 and later version...

CVE-2024-2338

PostgreSQL Anonymizer v1.2 contains a SQL injection vulnerability that allows a user who owns a table to elevate to superuser when dynamic masking is enabled. PostgreSQL Anonymizer enables users to set security labels on tables to mask specified columns. There is a flaw that allows complex...