{"id":"CVE-2026-105620","kind":"vulnerability","aliases":["CVE-2026-105620"],"related":[],"title":"PostgreSQL Anonymizer: sub-query results in masking rules are returned unmasked","description":"PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.","summary":"PostgreSQL Anonymizer does not mask data returned by a sub-query inside a masking rule, so values meant to be hidden can reach the querying user. Fixed in version 3.3.0.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["data-masking","package","postgresql","self-hosted"],"not_affected_if":["no-anonymizer-extension","no-subquery-rules"],"how_to_check":"- Check the installed extension version with `SELECT extversion FROM pg_extension WHERE extname = 'anon';`\n- Review masking rules that use sub-queries (`SELECT * FROM anon.rules` or your rule definitions) and test them as a masked role","fix":"- Upgrade PostgreSQL Anonymizer to `3.3.0` or later\n- Re-test any masking rules that rely on sub-queries after the upgrade","status":"open","published_at":"2026-10-28T18:17:04+00:00","first_seen_at":"2026-10-28T18:34:32+00:00","triaged_at":"2026-10-28T18:34:59+00:00","updated_at":"2026-10-28T18:34:59+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-28T18:34:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PostgreSQL Anonymizer to `3.3.0` or later\n- Re-test any masking rules that rely on sub-queries after the upgrade","reach":"unknown","title":"PostgreSQL Anonymizer: sub-query results in masking rules are returned unmasked","impact":"medium","summary":"PostgreSQL Anonymizer does not mask data returned by a sub-query inside a masking rule, so values meant to be hidden can reach the querying user. Fixed in version 3.3.0.","category":"package","nicknames":[],"who_cares":["postgresql","data-masking","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Masked data returned unmasked to a database role","analyst_note":"Check the NVD entry and the project advisory for the exact affected version range and which role or query triggers the leak.","how_to_check":"- Check the installed extension version with `SELECT extversion FROM pg_extension WHERE extname = 'anon';`\n- Review masking rules that use sub-queries (`SELECT * FROM anon.rules` or your rule definitions) and test them as a masked role","needs_analyst":true,"not_affected_if":["no-anonymizer-extension","no-subquery-rules"],"who_is_affected":"Teams running the PostgreSQL Anonymizer extension to mask data for non-privileged roles, especially where masking rules include sub-queries. Installations that do not use the extension for masking, or that do not define rules with sub-queries, are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000612,"input_tokens":3278,"output_tokens":569,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105620':15A,18A '-2026':14A,17A '3.3.0':57B,80C 'anonym':2A,28B,59C,79C 'cve':13A,16A 'data':20B,32B,63C 'data-mask':19B 'doesn':60C 'fix':54B 'hidden':48B 'host':26B 'insid':39B 'later':82C 'mask':8A,21B,31B,41B,62C 'meant':45B 'packag':22B 'postgresql':1A,23B,27B,58C,78C 'problem':74C 'queri':5A,38B,52B,69C 'reach':50B 'resolv':76C 'result':6A 'return':11A,33B,64C 'rule':9A,42B,72C 'self':25B 'self-host':24B 'sub':4A,37B,68C 'sub-queri':3A,36B,67C 'unmask':12A 'user':53B 'valu':44B 'version':56B,83C","nicknames":[],"mitigations":[],"who_affected":"Teams running the PostgreSQL Anonymizer extension to mask data for non-privileged roles, especially where masking rules include sub-queries. Installations that do not use the extension for masking, or that do not define rules with sub-queries, are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105620","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105620","severity":null,"published_at":"2026-10-28T18:17:04+00:00","modified_at":"2026-10-28T18:17:04+00:00","first_seen_at":"2026-10-28T18:34:32+00:00","fetched_at":"2026-10-28T18:34:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}