CVE-2026-19633: PostgreSQL Anonymizer privilege escalation via operators and domain casts

CVE-2026-19633 · Severity: high · CVSS 8.8 · Published 2026-09-06

PostgreSQL Anonymizer is a security extension that masks sensitive data in a PostgreSQL database by restricting what unprivileged users can see. A vulnerability allows unprivileged database users to bypass these restrictions and gain superuser-level access by injecting malicious operators, domain casts, or view subqueries into masking rules. This allows an attacker to execute arbitrary code with elevated privileges, potentially compromising the entire database and all data within it.

Technologies: Dalibo PostgreSQL Anonymizer. Vendors: Dalibo.

Quick answers

Is CVE-2026-19633 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-19633 being exploited in the wild.
How severe is CVE-2026-19633?
High severity, with a CVSS score of 8.8, published 6 September 2026.
Which products and versions are affected?
Dalibo PostgreSQL Anonymizer before 3.1.4.
Is there a fix for CVE-2026-19633?
A patch was published on 2026-09-06: Fixed in PostgreSQL Anonymizer 3.1.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19633 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-19633?
Check whether you run Dalibo PostgreSQL Anonymizer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a privilege escalation in PostgreSQL Anonymizer's trusted-schema validation mechanism (restrict_to_trusted_schemas). The trusted-schema walker validates only T_FuncCall node types and fails to inspect other parse tree constructs like T_A_Expr (operators), T_TypeCast (domain casts), T_RangeVar, T_SubLink, and T_CoerceViaIO, allowing untrusted code to reach execution context with elevated privileges. An unprivileged table owner can craft masking rules containing operators, domain casts, or view subqueries that carry malicious expressions; these bypass validation and execute as the extension (running with superuser context), leading to arbitrary code execution and privilege escalation to SUPERUSER. The vulnerability affects PostgreSQL Anonymizer versions prior to 3.1.4, where both the walker validation defect and a second issue in to_seclabel() parameter interpolation were fixed. Attack requires table creation or modification privileges but no superuser access.

Affected products

  • Dalibo PostgreSQL Anonymizer before 3.1.4

Timeline

  • 2026-09-06: disclosed: CVE-2026-19633 published
  • 2026-09-06: patched: Fixed in PostgreSQL Anonymizer 3.1.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.