---
id: "CVE-2026-110181"
kind: "vulnerability"
aliases: ["CVE-2026-110181"]
title: "PostgreSQL Anonymizer: anonymization functions bypass checks, exposing masked data"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["database", "package", "postgresql", "postgresql-anonymizer"]
not_affected_if: ["extension-not-installed", "only-admin-roles-have-temporary"]
published_at: "2026-10-28T18:17:05+00:00"
first_seen_at: "2026-10-28T18:34:32+00:00"
updated_at: "2026-10-28T18:35:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110181", "first_seen_at": "2026-10-28T18:34:32+00:00"}]
---

# PostgreSQL Anonymizer: anonymization functions bypass checks, exposing masked data

PostgreSQL Anonymizer checks SQL-standard function bodies only at execution time, while PostgreSQL analyses them at declaration time. A user with the TEMPORARY privilege can exploit this to get around the anonymization checks.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `SELECT extversion FROM pg_extension WHERE extname = 'anon';` in each database that has the extension installed
- Check whether any role outside the admin group holds the TEMPORARY privilege on those databases

## Fix

- Upgrade PostgreSQL Anonymizer to `3.3.0` or later

## Timeline

- 2026-10-28T18:34:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110181

## From the sources

PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL analyses such functions at declaration time, while Anonymizer only attempts to check them at execution time. This problem can be exploited by any user with the TEMPORARY privilege. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_