# CVE-2026-19634: PostgreSQL Anonymizer SQL injection in import functions

Source: https://junglewise.ai/threats/cve-2026-19634-postgresql-anonymizer-sql-injection-in-import-functions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-19634 · Severity: medium · CVSS 6.4 · Published 2026-09-06

PostgreSQL Anonymizer is an extension that helps mask sensitive data in PostgreSQL databases. The extension contains a SQL injection vulnerability in two import functions (anon.import_database_rules and anon.import_roles_rules) that allows a regular user to escalate privileges to superuser by crafting a malicious JSON file. When a superuser imports rules from the attacker-controlled file, arbitrary SQL code executes with superuser privileges, potentially granting the attacker unrestricted database access.

Technologies: [Dalibo PostgreSQL Anonymizer](https://junglewise.ai/threats/technologies/postgresql-anonymizer). Vendors: [Dalibo](https://junglewise.ai/threats/vendors/dalibo).

## Quick answers

**Is CVE-2026-19634 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19634 being exploited in the wild.

**How severe is CVE-2026-19634?** Medium severity, with a CVSS score of 6.4, published 6 September 2026.

**Which products and versions are affected?** Dalibo PostgreSQL Anonymizer before 3.1.4.

**Is there a fix for CVE-2026-19634?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-19634 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-19634?** Check whether you run Dalibo PostgreSQL Anonymizer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

PostgreSQL Anonymizer versions prior to 3.1.4 contain a SQL injection vulnerability in the to_seclabel() function, which fails to properly escape object names when interpolating them into SQL statements. An attacker can craft a JSON document with specially crafted object names containing SQL comments (--) to comment out security tokens added in version 3.1.1, breaking the previous fix. When a superuser calls anon.import_database_rules() or anon.import_roles_rules() on the malicious JSON, the injected SQL executes with superuser privileges, allowing privilege escalation. The vulnerability requires social engineering or access to influence the rules file that a superuser imports, but no direct superuser privileges. The fix is available in PostgreSQL Anonymizer 3.1.4 and later.

## Affected products

- Dalibo PostgreSQL Anonymizer before 3.1.4

## Timeline

- 2026-09-06: disclosed

## References

- [https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/665](https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/665)

## Related threats

- [PostgreSQL Anonymizer statistics leak in static masking](https://junglewise.ai/threats/cve-2026-110183-postgresql-anonymizer-contains-a-vulnerability-related-to-static)
- [PostgreSQL Anonymizer information disclosure in partial() functions](https://junglewise.ai/threats/cve-2026-110182-postgresql-anonymizer-contains-a-vulnerability-related-to-the)
- [PostgreSQL Anonymizer SQL-standard function body bypass](https://junglewise.ai/threats/cve-2026-110181-postgresql-anonymizer-contains-a-vulnerability-related-to)
- [PostgreSQL Anonymizer data masking bypass in sub-query rules](https://junglewise.ai/threats/cve-2026-105620-postgresql-anonymizer-doesn-t-mask-data-returned-by-a-sub-query)
- [PostgreSQL Anonymizer data masking bypass in security_invoker views](https://junglewise.ai/threats/cve-2026-105619-postgresql-anonymizer-doesn-t-mask-data-accessed-thru-a-security)