{"id":"CVE-2026-105618","kind":"vulnerability","aliases":["CVE-2026-105618"],"related":[],"title":"PostgreSQL Anonymizer: partition and inheritance tables leak unmasked data via parent","description":"PostgreSQL Anonymizer's documentation recommends applying rules on partitions and inheritance tables. Direct access to the paritions / inheritance tables is masked but not thru the parent table. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.","summary":"PostgreSQL Anonymizer's documentation recommends applying masking rules to partitions and inheritance tables. Querying the parent table does not apply the masking, so data reached through it is exposed unmasked.","severity":"medium","cvss":5.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","package","postgresql","postgresql-anonymizer"],"not_affected_if":["no-partitions-or-inheritance","not-using-anonymizer"],"how_to_check":"- Check the installed version of the PostgreSQL Anonymizer extension (`SELECT extversion FROM pg_extension WHERE extname = 'anonymizer';`)\n- Look for masking rules applied to partitioned or inherited child tables in the `anon` configuration\n- unknown whether the sources list other checks","fix":"- Upgrade PostgreSQL Anonymizer to `3.3.0` or later\n- Until upgraded, query masked data through the child tables only where rules exist, and review access to the parent table","status":"open","published_at":"2026-10-28T18:17:03+00:00","first_seen_at":"2026-10-28T18:34:32+00:00","triaged_at":"2026-10-28T18:35:04+00:00","updated_at":"2026-10-28T18:35:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T18:35:04Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PostgreSQL Anonymizer to `3.3.0` or later\n- Until upgraded, query masked data through the child tables only where rules exist, and review access to the parent table","reach":"network","title":"PostgreSQL Anonymizer: partition and inheritance tables leak unmasked data via parent","impact":"medium","summary":"PostgreSQL Anonymizer's documentation recommends applying masking rules to partitions and inheritance tables. Querying the parent table does not apply the masking, so data reached through it is exposed unmasked.","category":"package","nicknames":[],"who_cares":["postgresql","postgresql-anonymizer","database"],"confidence":0.6,"needs_auth":"yes","worst_case":"Unmasked personal data is readable through the parent table","analyst_note":"Confirm the affected version range and the exact masking behavior via the NVD entry and the project's advisory.","how_to_check":"- Check the installed version of the PostgreSQL Anonymizer extension (`SELECT extversion FROM pg_extension WHERE extname = 'anonymizer';`)\n- Look for masking rules applied to partitioned or inherited child tables in the `anon` configuration\n- unknown whether the sources list other checks","needs_analyst":true,"not_affected_if":["no-partitions-or-inheritance","not-using-anonymizer"],"who_is_affected":"Teams using PostgreSQL Anonymizer to mask data in databases that use partitioned tables or table inheritance, where the masking rules are applied to the child tables. Exposure depends on users reading the data through the parent table. Teams not using the extension, or not using partitions or inheritance, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000639,"input_tokens":3312,"output_tokens":615,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105618':14A,17A '-2026':13A,16A '3.3.0':88C 'access':67C 'anonym':2A,23B,25B,55C,87C 'appli':29B,43B,59C 'cve':12A,15A 'data':9A,47B 'databas':18B 'direct':66C 'document':27B,57C 'expos':52B 'inherit':5A,35B,64C,71C 'later':90C 'leak':7A 'mask':30B,45B,74C 'packag':19B 'parent':11A,39B,79C 'parit':70C 'partit':3A,33B,62C 'postgresql':1A,20B,22B,24B,54C,86C 'postgresql-anonym':21B 'problem':82C 'queri':37B 'reach':48B 'recommend':28B,58C 'resolv':84C 'rule':31B,60C 'tabl':6A,36B,40B,65C,72C,80C 'thru':77C 'unmask':8A,53B 'version':91C 'via':10A","nicknames":[],"mitigations":[],"who_affected":"Teams using PostgreSQL Anonymizer to mask data in databases that use partitioned tables or table inheritance, where the masking rules are applied to the child tables. Exposure depends on users reading the data through the parent table. Teams not using the extension, or not using partitions or inheritance, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105618","severity":null,"published_at":"2026-10-28T18:17:03+00:00","modified_at":"2026-10-28T18:17:03+00:00","first_seen_at":"2026-10-28T18:34:32+00:00","fetched_at":"2026-10-28T18:34:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}