CVE-2026-110181: falha de média gravidade em DALIBO PostgreSQL Anonymizer
PostgreSQL Anonymizer: Function declared with SQL-standard syntax leak anonymized data
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.3%
PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL analyses such functions at declaration time, while Anonymizer only attempts to check them at execution time. This problem can be exploited by any user with the TEMPORARY privilege. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
DALIBO · PostgreSQL AnonymizerCVEs relacionadas — DALIBO PostgreSQL Anonymizer
No mesmo produto, das mais perigosas para as menos.
CVE-2026-19633HIGHPostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueriesEPSS 0.7%CVE-2024-2339HIGHImproper Input Validation in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking ruleEPSS 0.6%CVE-2026-2360HIGHImproper search_path protection in PostgreSQL Anonymizer 2.5 allows any user to gain superuser privileges in PostgreSQL 14EPSS 0.5%CVE-2024-2338HIGHSQL Injection in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking ruleEPSS 0.5%CVE-2025-5690MEDIUMCursor allows PostgreSQL Anonymizer masked user to gain unauthorized access to authentic dataEPSS 0.4%CVE-2026-83534MEDIUMPostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_parallel()EPSS 0.3%