Live › vulnerability › CVE-2026-105615
Go to dashboardPostgreSQL Anonymizer's optimized statistics on a table stay visible to any role with SELECT on that table, even when the role is supposed to see only masked data. A masked role can read a limited subset of the underlying data through the histograms and mcvs columns of the statistics view.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Teams that use PostgreSQL Anonymizer to mask data for restricted roles are exposed, because the statistics leak through a role that has SELECT on the masked table. Teams that do not use the anon extension for masking, or that have no masked roles relying on it, are unlikely to be affected.
No product ranges from the sources yet.
SELECT extversion FROM pg_extension WHERE extname = 'anon';3.3.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
PostgreSQL's optimized statistics on a table are visible as long as you have SELECT privilege on said table. A masked role can therefore read a limited subset of the data through the statistics view's histograms and mcvs. The vulnerability is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-105615")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.