CVE-2026-19633
PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the malicious code can run with elevated privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later versions
| CWE | CWE-89 |
| Vendor | dalibo |
| Product | postgresql anonymizer |
| Published | Sep 6, 2026 |
| Last Updated | Sep 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for dalibo postgresql anonymizer
Be the first to know when new high vulnerabilities affecting dalibo postgresql anonymizer are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
DALIBO / PostgreSQL Anonymizer
1 < 3.1.4
References
Credits
The PostgreSQL Anonymizer project thanks user Sarath Kumar for reporting this problem.