Live › vulnerability › CVE-2026-105620
Go to dashboardPostgreSQL Anonymizer does not mask data returned by a sub-query inside a masking rule, so values meant to be hidden can reach the querying user. Fixed in version 3.3.0.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Teams running the PostgreSQL Anonymizer extension to mask data for non-privileged roles, especially where masking rules include sub-queries. Installations that do not use the extension for masking, or that do not define rules with sub-queries, are unlikely to be exposed.
No product ranges from the sources yet.
SELECT extversion FROM pg_extension WHERE extname = 'anon';SELECT * FROM anon.rules or your rule definitions) and test them as a masked role3.3.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-105620")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.