Threat Intelligence Database

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hash_output) pairs to perform an offline brute-force attack and deduce the salt. The problem is resolved in PostgreSQL Anonymizer 3.1.2 and later versions

PostgreSQL Anonymizer versions prior to 3.1.1 contain an SQL injection vulnerability that allows privilege escalation to superuser. The vulnerability occurs when a superuser calls import_database_rules() or import_roles_rules() with a crafted JSON document containing malicious code in a key-value pair. This code executes with superuser privileges. The issue is fixed in version 3.1.1 and later.

CVE-2026-9617 is a SQL injection vulnerability in the DALIBO PostgreSQL Anonymizer that allows a user to escalate privileges to superuser by injecting malicious code into a column identifier when creating a table. Execution of this code occurs if a superuser calls the k-anonymity function. The risk is higher on PostgreSQL 14 or instances upgraded from that version, while PostgreSQL 15 and later reduce risk by revoking public schema creation permissions by default. The vulnerability is fixed in PostgreSQL Anonymizer version 3.1.0 and later.