CVE-2026-83534: falha de média gravidade em DALIBO PostgreSQL Anonymizer
PostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_parallel()
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.4epss 0.3%
PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner of a table to run arbitrary code with superuser privilege. The issue is fixed in PostgreSQL Anonymizer 3.2.0 and later versions
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
DALIBO · PostgreSQL AnonymizerCVEs relacionadas — DALIBO PostgreSQL Anonymizer
No mesmo produto, das mais perigosas para as menos.
CVE-2026-19633HIGHPostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueriesEPSS 0.7%CVE-2024-2339HIGHImproper Input Validation in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking ruleEPSS 0.6%CVE-2026-2360HIGHImproper search_path protection in PostgreSQL Anonymizer 2.5 allows any user to gain superuser privileges in PostgreSQL 14EPSS 0.5%CVE-2024-2338HIGHSQL Injection in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking ruleEPSS 0.5%CVE-2025-5690MEDIUMCursor allows PostgreSQL Anonymizer masked user to gain unauthorized access to authentic dataEPSS 0.4%CVE-2026-2361HIGHImproper search_path protection in PostgreSQL Anonymizer 2.5 allows any user with create privilege to gain superuser privilegesEPSS 0.3%