Live › vulnerability › CVE-2026-110181
Go to dashboardPostgreSQL Anonymizer checks SQL-standard function bodies only at execution time, while PostgreSQL analyses them at declaration time. A user with the TEMPORARY privilege can exploit this to get around the anonymization checks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Teams that run the PostgreSQL Anonymizer extension to mask data for non-privileged users. The exposure depends on whether roles other than administrators hold the TEMPORARY privilege on the database. Installations without the extension, or where only trusted roles can create temporary tables, can skip it.
No product ranges from the sources yet.
SELECT extversion FROM pg_extension WHERE extname = 'anon'; in each database that has the extension installed3.3.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL analyses such functions at declaration time, while Anonymizer only attempts to check them at execution time. This problem can be exploited by any user with the TEMPORARY privilege. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-110181")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.