Executive brief
PostgreSQL Anonymizer is a security extension that masks sensitive data in a PostgreSQL database by restricting what unprivileged users can see. A vulnerability allows unprivileged database users to bypass these restrictions and gain superuser-level access by injecting malicious operators, domain casts, or view subqueries into masking rules. This allows an attacker to execute arbitrary code with elevated privileges, potentially compromising the entire database and all data within it.
Technical details
The vulnerability is a privilege escalation in PostgreSQL Anonymizer's trusted-schema validation mechanism (restrict_to_trusted_schemas). The trusted-schema walker validates only T_FuncCall node types and fails to inspect other parse tree constructs like T_A_Expr (operators), T_TypeCast (domain casts), T_RangeVar, T_SubLink, and T_CoerceViaIO, allowing untrusted code to reach execution context with elevated privileges. An unprivileged table owner can craft masking rules containing operators, domain casts, or view subqueries that carry malicious expressions; these bypass validation and execute as the extension (running with superuser context), leading to arbitrary code execution and privilege escalation to SUPERUSER. The vulnerability affects PostgreSQL Anonymizer versions prior to 3.1.4, where both the walker validation defect and a second issue in to_seclabel() parameter interpolation were fixed. Attack requires table creation or modification privileges but no superuser access.
Affected products
- Dalibo PostgreSQL Anonymizer before 3.1.4
Timeline
- 2026-09-06: disclosed: CVE-2026-19633 published
- 2026-09-06: patched: Fixed in PostgreSQL Anonymizer 3.1.4