CVE-2026-19633: falha de alta gravidade em DALIBO PostgreSQL Anonymizer
PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.7%
PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the malicious code can run with elevated privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later versions
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
DALIBO · PostgreSQL AnonymizerCVEs relacionadas — DALIBO PostgreSQL Anonymizer
No mesmo produto, das mais perigosas para as menos.
CVE-2024-2339HIGHImproper Input Validation in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking ruleEPSS 0.6%CVE-2026-2360HIGHImproper search_path protection in PostgreSQL Anonymizer 2.5 allows any user to gain superuser privileges in PostgreSQL 14EPSS 0.5%CVE-2024-2338HIGHSQL Injection in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking ruleEPSS 0.5%CVE-2025-5690MEDIUMCursor allows PostgreSQL Anonymizer masked user to gain unauthorized access to authentic dataEPSS 0.4%CVE-2026-83534MEDIUMPostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_parallel()EPSS 0.3%CVE-2026-2361HIGHImproper search_path protection in PostgreSQL Anonymizer 2.5 allows any user with create privilege to gain superuser privilegesEPSS 0.3%