Live › vulnerability › CVE-2026-110183
Go to dashboardPostgreSQL Anonymizer's static masking leaves statistics about the original data visible in pg_stats until ANALYZE runs on the table, either manually or through autovacuum. An attacker with read access to pg_stats can infer properties of the unmasked values.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Teams that use PostgreSQL Anonymizer static masking to produce masked copies of databases, where the masked tables are readable by roles that can also query pg_stats. Systems that do not use the anon extension for static masking can skip it.
No product ranges from the sources yet.
SELECT extversion FROM pg_extension WHERE extname = 'anon'; in each database and compare against the fixed version.SELECT * FROM anon.pg_static_masking or the anon.anonymize_table workflow, per the project docs.3.3.0 or later.ANALYZE on statically masked tables after upgrading so pg_stats reflects masked data.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence. Statistics pertaining to the original data remain visible in pg_stats until an ANALYZE operation is performed on the table, either manually or by autovacuum. This issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-110183")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.