CVE-2026-83534: PostgreSQL Anonymizer privilege escalation in anon.anonymize_database_parallel()

CVE-2026-83534 · Severity: medium · CVSS 6.4 · Published 2026-09-06

PostgreSQL Anonymizer is an extension that masks sensitive data in databases. A vulnerability in the anon.anonymize_database_parallel() function allows any low-privilege database user to escalate their privileges to superuser (full database administrator). An attacker can exploit this by creating a table with a malicious rewrite rule that executes with superuser privileges when the anonymization function runs, gaining complete control over the database and potentially the underlying server.

Technologies: Dalibo PostgreSQL Anonymizer. Vendors: Dalibo.

Quick answers

Is CVE-2026-83534 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-83534 being exploited in the wild.
How severe is CVE-2026-83534?
Medium severity, with a CVSS score of 6.4, published 6 September 2026.
Which products and versions are affected?
Dalibo PostgreSQL Anonymizer 3.0.1 through 3.1.3.
Is there a fix for CVE-2026-83534?
A patch was published on 2026: Fixed in version 3.2.0 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83534 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-83534?
Check whether you run Dalibo PostgreSQL Anonymizer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a privilege escalation flaw in the anon.anonymize_database_parallel() function, which is callable by any user (PUBLIC grant by default). The function launches background workers that connect as the bootstrap superuser and execute static masking operations via UPDATE statements. Because these UPDATEs run with superuser authority, any ON UPDATE rewrite rule or trigger attached to the masked table by an attacker is expanded and executed with superuser privileges. An authenticated user with CREATE privileges on a schema can attach a malicious rule to their own table, set a masking label on one of its columns, and then invoke anon.anonymize_database_parallel() to trigger superuser-level execution of their rule. The non-parallel functions (anon.anonymize_table() and anon.anonymize_database()) are SECURITY INVOKER and do not exhibit this issue. The vulnerability was introduced in version 3.0.1 and remains present through at least 3.1.3; it is fixed in version 3.2.0 and later.

Affected products

  • Dalibo PostgreSQL Anonymizer 3.0.1 through 3.1.3

Timeline

  • 2026-09-06: disclosed
  • 2026: patched: Fixed in version 3.2.0 and later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.