Live › vulnerability › CVE-2026-105619
Go to dashboardPostgreSQL Anonymizer does not apply its masking rules when data is read through a view created with security_invoker. A user querying such a view can see unmasked values that the masking policy was meant to hide.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Teams that use PostgreSQL Anonymizer to mask personal data and also expose that data through views created with security_invoker. Databases that do not use the extension, or that query masked tables directly without such views, are not described as affected by the sources.
No product ranges from the sources yet.
SELECT extversion FROM pg_extension WHERE extname = 'anon'; to get the installed PostgreSQL Anonymizer versionSELECT reloptions FROM pg_class WHERE relname = '<your_view_name>'; on views you expose to users, looking for security_invoker=true3.3.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-105619")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.