CVE-2026-9617: PostgreSQL Anonymizer privilege escalation via SQL injection in k-anonymity

CVE-2026-9617 · Severity: medium · CVSS 6.8 · Published 2026-05-27

PostgreSQL Anonymizer is an extension used to mask or hide sensitive data within databases. A vulnerability in this tool allows a database user to escalate their permissions to 'superuser' status by creating a specially crafted table. If an administrator later runs certain anonymization functions on that table, the attacker's hidden code will execute with full administrative control over the database.

Technologies: Dalibo PostgreSQL Anonymizer. Vendors: Dalibo.

Quick answers

Is CVE-2026-9617 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9617 being exploited in the wild.
How severe is CVE-2026-9617?
Medium severity, with a CVSS score of 6.8, published 27 May 2026.
Which products and versions are affected?
Dalibo PostgreSQL Anonymizer < 3.1.0.
Is there a fix for CVE-2026-9617?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9617 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-9617?
Check whether you run Dalibo PostgreSQL Anonymizer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability (CWE-89) exists in the PostgreSQL Anonymizer extension due to improper neutralization of special elements in column identifiers. An attacker with CREATE TABLE privileges can craft a table where a column name contains malicious SQL code. When a superuser subsequently invokes the k-anonymity function, the extension fails to properly sanitize the identifier, leading to the execution of the attacker's code with superuser privileges. This risk is more prevalent in PostgreSQL 14 and earlier where public schema creation is allowed by default; in version 15 and later, the attacker must be explicitly granted table creation rights. The issue is resolved in version 3.1.0.

Affected products

  • Dalibo PostgreSQL Anonymizer < 3.1.0

Timeline

  • 2026-05-27: disclosed
  • 2026-05-27: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.