---
id: "CVE-2026-105618"
kind: "vulnerability"
aliases: ["CVE-2026-105618"]
title: "PostgreSQL Anonymizer: partition and inheritance tables leak unmasked data via parent"
severity: "medium"
cvss: 5.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["database", "package", "postgresql", "postgresql-anonymizer"]
not_affected_if: ["no-partitions-or-inheritance", "not-using-anonymizer"]
published_at: "2026-10-28T18:17:03+00:00"
first_seen_at: "2026-10-28T18:34:32+00:00"
updated_at: "2026-10-28T18:35:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105618", "first_seen_at": "2026-10-28T18:34:32+00:00"}]
---

# PostgreSQL Anonymizer: partition and inheritance tables leak unmasked data via parent

PostgreSQL Anonymizer's documentation recommends applying masking rules to partitions and inheritance tables. Querying the parent table does not apply the masking, so data reached through it is exposed unmasked.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the PostgreSQL Anonymizer extension (`SELECT extversion FROM pg_extension WHERE extname = 'anonymizer';`)
- Look for masking rules applied to partitioned or inherited child tables in the `anon` configuration
- unknown whether the sources list other checks

## Fix

- Upgrade PostgreSQL Anonymizer to `3.3.0` or later
- Until upgraded, query masked data through the child tables only where rules exist, and review access to the parent table

## Timeline

- 2026-10-28T18:34:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105618

## From the sources

PostgreSQL Anonymizer's documentation recommends applying rules on partitions and inheritance tables. Direct access to the paritions / inheritance tables is masked but not thru the parent table. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_