Live › vulnerability › CVE-2026-105612
Go to dashboardPostgreSQL Anonymizer lets data-modifying CTEs get past the read-only restriction placed on masked roles. An attacker with a masked role can write to data it was meant to only read.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Teams running the PostgreSQL Anonymizer extension that use masked roles to give read-only access to anonymized data. Databases without the extension, or without masked roles, are not affected. The sources do not say which versions before 3.3.0 are affected.
No product ranges from the sources yet.
SELECT extversion FROM pg_extension WHERE extname = 'anonymizer';3.3.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only restriction of masked roles. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions
This page as .md · .json · in your agent: get_signal("CVE-2026-105612")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.