CVE-2026-110181Medium· 6.5▾ SunlitPostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL analyses such functions at declaration time, while Anonymizer only attempts to check them at executi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL analyses such functions at declaration time, while Anonymizer only attempts to check them at execution time. This problem can be exploited by any user with the TEMPORARY privilege. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.
postgresql_anonymizer >= 1 < 3.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Revoke TEMPORARY from PUBLIC and CREATE on all schemas from masked roles to prevent them from creating a function. Revoke EXECUTE from PUBLIC on function with SQL-standard bodies since anon fails to anonymize the data they return.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-110182Medium· 4.3PostgreSQL Anonymizer: anon.partial() and anon.partial_email() can reveal the whole data
CVE-2026-105614Medium· 4.7PostgreSQL Anonymizer: Unbounded image-decode memory allocation (DoS) in anon.image_blur()
CVE-2026-105612Low· 3.5PostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked roles
CVE-2026-105616Medium· 5.7PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_setting
CVE-2026-105620Medium· 6.5PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query
CVE-2026-105618Medium· 5.7PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent