CVE-2026-13455: DALIBO PostgreSQL Anonymizer weak hashing in anon.hash function

CVE-2026-13455 · Severity: medium · CVSS 4.3 · Published 2026-06-30

PostgreSQL Anonymizer is a tool used to hide sensitive data in databases so it can be safely used for testing or reporting. A security flaw allows users who are supposed to see only masked (hidden) data to bypass these protections by repeatedly calling a specific hashing function. By doing this, an attacker can figure out the secret 'salt' used to scramble the data, allowing them to reverse the anonymization and reveal the original sensitive information.

Technologies: Dalibo PostgreSQL Anonymizer. Vendors: Dalibo.

Quick answers

Is CVE-2026-13455 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-13455 being exploited in the wild.
How severe is CVE-2026-13455?
Medium severity, with a CVSS score of 4.3, published 30 June 2026.
Which products and versions are affected?
Dalibo PostgreSQL Anonymizer < 3.1.2.
Is there a fix for CVE-2026-13455?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13455 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-13455?
Check whether you run Dalibo PostgreSQL Anonymizer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The anon.hash() function in PostgreSQL Anonymizer is missing the 'RESTRICTED' security label, which is required by the extension's masking engine to block access for masked roles. Because the function is defined as SECURITY DEFINER, it can access the superuser-only 'anon.salt' value. An authenticated attacker with a masked role can use anon.hash() as a hashing oracle to collect (input, hash) pairs. This allows for offline brute-force or dictionary attacks to recover the secret salt, subsequently enabling the deanonymization of pseudonymized columns and other hashed data. The issue is resolved in version 3.1.2 by correctly applying the RESTRICTED label to the function.

Affected products

  • DALIBO PostgreSQL Anonymizer < 3.1.2

Timeline

  • 2026-06-30: disclosed
  • 2026-06-30: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.