{"id":"CVE-2026-105615","kind":"vulnerability","aliases":["CVE-2026-105615"],"related":[],"title":"PostgreSQL Anonymizer: masked roles can read statistics histograms and MCVs","description":"PostgreSQL's optimized statistics on a table are visible as long as you have SELECT privilege on said table. A masked role can therefore read a limited subset of the data through the statistics view's histograms and mcvs. The vulnerability is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.","summary":"PostgreSQL Anonymizer's optimized statistics on a table stay visible to any role with SELECT on that table, even when the role is supposed to see only masked data. A masked role can read a limited subset of the underlying data through the histograms and mcvs columns of the statistics view.","severity":"low","cvss":3.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["data-masking","package","postgresql","postgresql-anonymizer"],"not_affected_if":["anon-extension-not-used","no-masked-roles"],"how_to_check":"- Check the installed extension version with `SELECT extversion FROM pg_extension WHERE extname = 'anon';`\n- Review which roles are masked with anon and whether they hold SELECT on tables that have optimized statistics","fix":"- Upgrade PostgreSQL Anonymizer to `3.3.0` or later","status":"open","published_at":"2026-10-28T18:17:03+00:00","first_seen_at":"2026-10-28T18:34:32+00:00","triaged_at":"2026-10-28T18:35:15+00:00","updated_at":"2026-10-28T18:35:15+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T18:35:15Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PostgreSQL Anonymizer to `3.3.0` or later","reach":"local","title":"PostgreSQL Anonymizer: masked roles can read statistics histograms and MCVs","impact":"low","summary":"PostgreSQL Anonymizer's optimized statistics on a table stay visible to any role with SELECT on that table, even when the role is supposed to see only masked data. A masked role can read a limited subset of the underlying data through the histograms and mcvs columns of the statistics view.","category":"package","nicknames":[],"who_cares":["postgresql","postgresql-anonymizer","data-masking"],"confidence":0.6,"needs_auth":"yes","worst_case":"A masked role reads a limited subset of underlying table data","analyst_note":"","how_to_check":"- Check the installed extension version with `SELECT extversion FROM pg_extension WHERE extname = 'anon';`\n- Review which roles are masked with anon and whether they hold SELECT on tables that have optimized statistics","needs_analyst":false,"not_affected_if":["anon-extension-not-used","no-masked-roles"],"who_is_affected":"Teams that use PostgreSQL Anonymizer to mask data for restricted roles are exposed, because the statistics leak through a role that has SELECT on the masked table. Teams that do not use the anon extension for masking, or that have no masked roles relying on it, are unlikely to be affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000596,"input_tokens":3319,"output_tokens":529,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-105615':13A,16A '-2026':12A,15A '3.3.0':122C 'anonym':2A,24B,26B,121C 'column':71B 'cve':11A,14A 'data':18B,53B,65B,106C 'data-mask':17B 'even':43B 'histogram':8A,68B,112C 'later':124C 'limit':60B,102C 'long':86C 'mask':3A,19B,52B,55B,96C 'mcvs':10A,70B,114C 'optim':28B,78C 'packag':20B 'postgresql':1A,21B,23B,25B,76C,120C 'postgresql-anonym':22B 'privileg':91C 'read':6A,58B,100C 'resolv':118C 'role':4A,37B,46B,56B,97C 'said':93C 'see':50B 'select':39B,90C 'statist':7A,29B,74B,79C,109C 'stay':33B 'subset':61B,103C 'suppos':48B 'tabl':32B,42B,82C,94C 'therefor':99C 'under':64B 'version':125C 'view':75B,110C 'visibl':34B,84C 'vulner':116C","nicknames":[],"mitigations":[],"who_affected":"Teams that use PostgreSQL Anonymizer to mask data for restricted roles are exposed, because the statistics leak through a role that has SELECT on the masked table. Teams that do not use the anon extension for masking, or that have no masked roles relying on it, are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105615","severity":null,"published_at":"2026-10-28T18:17:03+00:00","modified_at":"2026-10-28T18:17:03+00:00","first_seen_at":"2026-10-28T18:34:32+00:00","fetched_at":"2026-10-28T18:34:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}