{"id":"CVE-2026-110181","kind":"vulnerability","aliases":["CVE-2026-110181"],"related":[],"title":"PostgreSQL Anonymizer: anonymization functions bypass checks, exposing masked data","description":"PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL analyses such functions at declaration time, while Anonymizer only attempts to check them at execution time. This problem can be exploited by any user with the TEMPORARY privilege. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.","summary":"PostgreSQL Anonymizer checks SQL-standard function bodies only at execution time, while PostgreSQL analyses them at declaration time. A user with the TEMPORARY privilege can exploit this to get around the anonymization checks.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","package","postgresql","postgresql-anonymizer"],"not_affected_if":["extension-not-installed","only-admin-roles-have-temporary"],"how_to_check":"- Run `SELECT extversion FROM pg_extension WHERE extname = 'anon';` in each database that has the extension installed\n- Check whether any role outside the admin group holds the TEMPORARY privilege on those databases","fix":"- Upgrade PostgreSQL Anonymizer to `3.3.0` or later","status":"open","published_at":"2026-10-28T18:17:05+00:00","first_seen_at":"2026-10-28T18:34:32+00:00","triaged_at":"2026-10-28T18:35:00+00:00","updated_at":"2026-10-28T18:35:00+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T18:35:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PostgreSQL Anonymizer to `3.3.0` or later","reach":"local","title":"PostgreSQL Anonymizer: anonymization functions bypass checks, exposing masked data","impact":"medium","summary":"PostgreSQL Anonymizer checks SQL-standard function bodies only at execution time, while PostgreSQL analyses them at declaration time. A user with the TEMPORARY privilege can exploit this to get around the anonymization checks.","category":"package","nicknames":[],"who_cares":["postgresql","postgresql-anonymizer","database"],"confidence":0.6,"needs_auth":"yes","worst_case":"Non-privileged database user bypasses anonymization and reads masked data","analyst_note":"Confirm the affected version range and whether the NVD entry's CVSS 6.5 vector matches the TEMPORARY-privilege precondition; check the upstream advisory for exact vulnerable versions.","how_to_check":"- Run `SELECT extversion FROM pg_extension WHERE extname = 'anon';` in each database that has the extension installed\n- Check whether any role outside the admin group holds the TEMPORARY privilege on those databases","needs_analyst":true,"not_affected_if":["extension-not-installed","only-admin-roles-have-temporary"],"who_is_affected":"Teams that run the PostgreSQL Anonymizer extension to mask data for non-privileged users. The exposure depends on whether roles other than administrators hold the TEMPORARY privilege on the database. Installations without the extension, or where only trusted roles can create temporary tables, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000633,"input_tokens":3357,"output_tokens":595,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110181':12A,15A '-2026':11A,14A '3.3.0':108C 'analys':36B,73C 'anonym':2A,3A,21B,23B,54B,57C,63C,80C,107C 'around':52B 'attempt':82C 'bodi':29B,71C 'bypass':5A 'check':6A,24B,55B,84C 'contain':58C 'cve':10A,13A 'data':9A 'databas':16B 'declar':39B,77C 'defin':65C 'execut':32B,87C 'exploit':48B,93C 'expos':7A 'fix':104C 'function':4A,28B,64C,70C,75C 'get':51B 'issu':102C 'later':110C 'mask':8A 'packag':17B 'postgresql':1A,18B,20B,22B,35B,56C,72C,106C 'postgresql-anonym':19B 'privileg':46B,100C 'problem':90C 'relat':61C 'sql':26B,68C 'sql-standard':25B,67C 'standard':27B,69C 'temporari':45B,99C 'time':33B,40B,78C,88C 'use':66C 'user':42B,96C 'version':111C 'vulner':60C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the PostgreSQL Anonymizer extension to mask data for non-privileged users. The exposure depends on whether roles other than administrators hold the TEMPORARY privilege on the database. Installations without the extension, or where only trusted roles can create temporary tables, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110181","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110181","severity":null,"published_at":"2026-10-28T18:17:05+00:00","modified_at":"2026-10-28T18:17:05+00:00","first_seen_at":"2026-10-28T18:34:32+00:00","fetched_at":"2026-10-28T18:34:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}