CVE-2026-110181
PostgreSQL Anonymizer: Function declared with SQL-standard syntax leak anonymized data
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL analyses such functions at declaration time, while Anonymizer only attempts to check them at execution time. This problem can be exploited by any user with the TEMPORARY privilege. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.
| CWE | CWE-693 |
| Vendor | dalibo |
| Product | postgresql anonymizer |
| Published | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for dalibo postgresql anonymizer
Be the first to know when new medium vulnerabilities affecting dalibo postgresql anonymizer are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
DALIBO / PostgreSQL Anonymizer
1 < 3.3.0
References
Credits
The PostgreSQL Anonymizer project thanks user Ilya Staroverov for reporting this problem.