{"id":"CVE-2026-110182","kind":"vulnerability","aliases":["CVE-2026-110182"],"related":[],"title":"PostgreSQL Anonymizer: partial() masking can reveal whole short values","description":"PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partial_email() functions. These function can reveal the while data if the data is small enough. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.","summary":"The anon.partial() and anon.partial_email() functions in PostgreSQL Anonymizer can expose the full original value when that value is short. An attacker who can read the masked output recovers data the masking was meant to hide.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","postgresql","postgresql-anonymizer","self-hosted"],"not_affected_if":["long-values-only","not-using-partial-functions"],"how_to_check":"- Check the installed extension version with `SELECT extversion FROM pg_extension WHERE extname = 'anon';` and compare it to `3.3.0`\n- Search application code and queries for calls to `anon.partial(` and `anon.partial_email(` on short fields","fix":"- Upgrade PostgreSQL Anonymizer to `3.3.0` or later\n- Until upgraded, avoid anon.partial() and anon.partial_email() on short values and use a different masking function","status":"open","published_at":"2026-10-28T18:17:05+00:00","first_seen_at":"2026-10-28T18:34:32+00:00","triaged_at":"2026-10-28T18:35:14+00:00","updated_at":"2026-10-28T18:35:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T18:35:14Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PostgreSQL Anonymizer to `3.3.0` or later\n- Until upgraded, avoid anon.partial() and anon.partial_email() on short values and use a different masking function","reach":"unknown","title":"PostgreSQL Anonymizer: partial() masking can reveal whole short values","impact":"medium","summary":"The anon.partial() and anon.partial_email() functions in PostgreSQL Anonymizer can expose the full original value when that value is short. An attacker who can read the masked output recovers data the masking was meant to hide.","category":"package","nicknames":[],"who_cares":["postgresql","postgresql-anonymizer","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"masked short values can be reverse-read to reveal originals","analyst_note":"Sources do not say which minimum value length is affected or what access an attacker needs; check the upstream PostgreSQL Anonymizer advisory or changelog for the 3.3.0 fix details.","how_to_check":"- Check the installed extension version with `SELECT extversion FROM pg_extension WHERE extname = 'anon';` and compare it to `3.3.0`\n- Search application code and queries for calls to `anon.partial(` and `anon.partial_email(` on short fields","needs_analyst":true,"not_affected_if":["not-using-partial-functions","long-values-only"],"who_is_affected":"Teams that use PostgreSQL Anonymizer to mask data with anon.partial() or anon.partial_email() on short fields such as names, codes or small identifiers. Systems that do not use these two functions, or that only mask long free-text values, are unlikely to be exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000642,"input_tokens":3313,"output_tokens":622,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110182':12A,15A '-2026':11A,14A '3.3.0':93C 'anon.partial':25B,27B,68C,70C 'anonym':2A,20B,32B,61C,92C 'attack':45B 'contain':62C 'cve':10A,13A 'data':53B,79C,82C 'email':28B,71C 'enough':85C 'expos':34B 'fix':89C 'full':36B 'function':29B,72C,74C 'hide':59B 'host':23B 'issu':87C 'later':95C 'mask':4A,50B,55B 'meant':57B 'origin':37B 'output':51B 'packag':16B 'partial':3A 'postgresql':1A,17B,19B,31B,60C,91C 'postgresql-anonym':18B 'read':48B 'recov':52B 'relat':65C 'reveal':6A,76C 'self':22B 'self-host':21B 'short':8A,43B 'small':84C 'valu':9A,38B,41B 'version':96C 'vulner':64C 'whole':7A","nicknames":[],"mitigations":[],"who_affected":"Teams that use PostgreSQL Anonymizer to mask data with anon.partial() or anon.partial_email() on short fields such as names, codes or small identifiers. Systems that do not use these two functions, or that only mask long free-text values, are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110182","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110182","severity":null,"published_at":"2026-10-28T18:17:05+00:00","modified_at":"2026-10-28T18:17:05+00:00","first_seen_at":"2026-10-28T18:34:32+00:00","fetched_at":"2026-10-28T18:34:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}