{"id":"CVE-2026-105616","kind":"vulnerability","aliases":["CVE-2026-105616"],"related":[],"title":"PostgreSQL Anonymizer: salt and shift readable by low-privilege database users","description":"PostgreSQL restricts acces to the salt and shift via the `SHOW` command for users not member of `pg_read_all_settings`. But they are visible in `pg_db_role_setting` or `pg_roles` if they were set on the database, user or both. PostgreSQL Anonymizer's documentation recommends to use ALTER DATABASE / ALTER ROLE for the salt. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.","summary":"PostgreSQL Anonymizer hides its salt and shift from users who lack pg_read_all_settings when read through SHOW. The same values remain visible in pg_db_role_setting and pg_roles when they were set with ALTER DATABASE or ALTER ROLE, so any role that can read those catalogs can recover them.","severity":"medium","cvss":5.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["managed-postgres","package","postgresql","postgresql-anonymizer","self-hosted"],"not_affected_if":["no-salt-or-shift-configured","upgraded-to-3.3.0"],"how_to_check":"- Check the installed version of the anon extension (`SELECT extversion FROM pg_extension WHERE extname = 'anon';`); versions before `3.3.0` are affected.\n- Look for salt or shift settings stored with ALTER DATABASE or ALTER ROLE by querying `pg_db_role_setting` and `pg_roles`.","fix":"- Upgrade PostgreSQL Anonymizer to `3.3.0` or later.\n- Stop storing the salt through ALTER DATABASE or ALTER ROLE if it can be avoided, or rotate the salt after upgrading.","status":"open","published_at":"2026-10-28T18:17:03+00:00","first_seen_at":"2026-10-28T18:34:32+00:00","triaged_at":"2026-10-28T18:35:11+00:00","updated_at":"2026-10-28T18:35:11+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T18:35:11Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PostgreSQL Anonymizer to `3.3.0` or later.\n- Stop storing the salt through ALTER DATABASE or ALTER ROLE if it can be avoided, or rotate the salt after upgrading.","reach":"network","title":"PostgreSQL Anonymizer: salt and shift readable by low-privilege database users","impact":"medium","summary":"PostgreSQL Anonymizer hides its salt and shift from users who lack pg_read_all_settings when read through SHOW. The same values remain visible in pg_db_role_setting and pg_roles when they were set with ALTER DATABASE or ALTER ROLE, so any role that can read those catalogs can recover them.","category":"package","nicknames":[],"who_cares":["postgresql","postgresql-anonymizer","self-hosted","managed-postgres"],"confidence":0.7,"needs_auth":"yes","worst_case":"Low-privilege database roles can read the anonymization salt and shift.","analyst_note":"","how_to_check":"- Check the installed version of the anon extension (`SELECT extversion FROM pg_extension WHERE extname = 'anon';`); versions before `3.3.0` are affected.\n- Look for salt or shift settings stored with ALTER DATABASE or ALTER ROLE by querying `pg_db_role_setting` and `pg_roles`.","needs_analyst":false,"not_affected_if":["upgraded-to-3.3.0","no-salt-or-shift-configured"],"who_is_affected":"Teams running PostgreSQL Anonymizer whose anonymization salt or shift was set with ALTER DATABASE or ALTER ROLE, as its documentation recommends. Any database role that can read pg_db_role_setting or pg_roles can see those values, so the exposure extends beyond administrators. Installations that do not use the extension, or that have upgraded to 3.3.0 or later, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00099,"input_tokens":3384,"output_tokens":1304,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105616':15A,18A '-2026':14A,17A '3.3.0':146C 'acc':84C 'alter':67B,70B,132C,134C 'anonym':2A,26B,31B,126C,145C 'catalog':79B 'command':93C 'cve':13A,16A 'databas':11A,68B,121C,133C 'db':56B,109C 'document':128C 'hide':32B 'host':29B 'lack':40B 'later':148C 'low':9A 'low-privileg':8A 'manag':20B 'managed-postgr':19B 'member':97C 'packag':22B 'pg':41B,55B,60B,99C,108C,113C 'postgr':21B 'postgresql':1A,23B,25B,30B,82C,125C,144C 'postgresql-anonym':24B 'privileg':10A 'problem':140C 'read':42B,46B,77B,100C 'readabl':6A 'recommend':129C 'recov':81B 'remain':52B 'resolv':142C 'restrict':83C 'role':57B,61B,71B,74B,110C,114C,135C 'salt':3A,34B,87C,138C 'self':28B 'self-host':27B 'set':44B,58B,65B,102C,111C,118C 'shift':5A,36B,89C 'show':48B,92C 'use':131C 'user':12A,38B,95C,122C 'valu':51B 'version':149C 'via':90C 'visibl':53B,106C","nicknames":[],"mitigations":[],"who_affected":"Teams running PostgreSQL Anonymizer whose anonymization salt or shift was set with ALTER DATABASE or ALTER ROLE, as its documentation recommends. Any database role that can read pg_db_role_setting or pg_roles can see those values, so the exposure extends beyond administrators. Installations that do not use the extension, or that have upgraded to 3.3.0 or later, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105616","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105616","severity":null,"published_at":"2026-10-28T18:17:03+00:00","modified_at":"2026-10-28T18:17:03+00:00","first_seen_at":"2026-10-28T18:34:32+00:00","fetched_at":"2026-10-28T18:34:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}