Executive brief
PostgreSQL Anonymizer is an extension used to mask or hide sensitive data within databases. A vulnerability in this tool allows a database user to escalate their permissions to 'superuser' status by creating a specially crafted table. If an administrator later runs certain anonymization functions on that table, the attacker's hidden code will execute with full administrative control over the database.
Technical details
A SQL injection vulnerability (CWE-89) exists in the PostgreSQL Anonymizer extension due to improper neutralization of special elements in column identifiers. An attacker with CREATE TABLE privileges can craft a table where a column name contains malicious SQL code. When a superuser subsequently invokes the k-anonymity function, the extension fails to properly sanitize the identifier, leading to the execution of the attacker's code with superuser privileges. This risk is more prevalent in PostgreSQL 14 and earlier where public schema creation is allowed by default; in version 15 and later, the attacker must be explicitly granted table creation rights. The issue is resolved in version 3.1.0.
Affected products
- Dalibo PostgreSQL Anonymizer < 3.1.0
Timeline
- 2026-05-27: disclosed
- 2026-05-27: advisory: NVD publication date