Executive brief
PostgreSQL Anonymizer is an extension that masks sensitive data in databases. A vulnerability in the anon.anonymize_database_parallel() function allows any low-privilege database user to escalate their privileges to superuser (full database administrator). An attacker can exploit this by creating a table with a malicious rewrite rule that executes with superuser privileges when the anonymization function runs, gaining complete control over the database and potentially the underlying server.
Technical details
The vulnerability is a privilege escalation flaw in the anon.anonymize_database_parallel() function, which is callable by any user (PUBLIC grant by default). The function launches background workers that connect as the bootstrap superuser and execute static masking operations via UPDATE statements. Because these UPDATEs run with superuser authority, any ON UPDATE rewrite rule or trigger attached to the masked table by an attacker is expanded and executed with superuser privileges. An authenticated user with CREATE privileges on a schema can attach a malicious rule to their own table, set a masking label on one of its columns, and then invoke anon.anonymize_database_parallel() to trigger superuser-level execution of their rule. The non-parallel functions (anon.anonymize_table() and anon.anonymize_database()) are SECURITY INVOKER and do not exhibit this issue. The vulnerability was introduced in version 3.0.1 and remains present through at least 3.1.3; it is fixed in version 3.2.0 and later.
Affected products
- Dalibo PostgreSQL Anonymizer 3.0.1 through 3.1.3
Timeline
- 2026-09-06: disclosed
- 2026: patched: Fixed in version 3.2.0 and later