CVE-2026-19633
Received Received - Intake

PostgreSQL Anonymizer Privilege Escalation via Malicious Expressions

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: PostgreSQL

Description
PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the malicious code can run with elevated privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later versions

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-06
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2026-19633
EUVD
EUVD-2026-72141

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
postgresql_anonymizer 3.1.4 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

PostgreSQL Anonymizer has a flaw where unprivileged masked users can execute arbitrary code by exploiting operators, domain casts, or view subqueries containing untrusted expressions. When these objects are processed by the extension's masking mechanisms, the malicious code runs with elevated privileges. The issue is resolved in versions 3.1.4 and later.

Detection Guidance

To detect this vulnerability, check the installed version of PostgreSQL Anonymizer. If it is below 3.1.4, the system is vulnerable. Use commands like 'SELECT extversion FROM pg_extension WHERE extname = "anon";' to verify the version.

Impact Analysis

An attacker with limited access could escalate privileges to execute arbitrary commands on the database server. This could lead to data theft, unauthorized modifications, or complete system compromise depending on the database's role and permissions.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data, undermining data protection measures. Organizations using affected versions may face regulatory penalties or audit failures due to insufficient safeguards against privilege escalation.

Mitigation Strategies

Upgrade PostgreSQL Anonymizer to version 3.1.4 or later to address the vulnerability. Review and restrict access for masked users to prevent abuse of operators, domain casts, or view subqueries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19633. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart