Live › vulnerability › CVE-2026-105617
Go to dashboardPostgreSQL Anonymizer does not invalidate query plans prepared after a masking rule was added or a role was changed. A user with such a prepared plan can keep seeing unmasked data until the session ends.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Deployments that use PostgreSQL Anonymizer to mask data for roles, especially where applications use prepared statements or connection pooling and sessions stay open for a long time. Databases that do not use the anon extension for masking are not affected.
No product ranges from the sources yet.
SELECT extversion FROM pg_extension WHERE extname = 'anon';3.3.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule was added or a role changed. Users using such plans can still see the unmasked data until the end of the session. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-105617")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.