What’s Vulnerable › Vulnerabilities
CVE-2026-11945: PostgreSQL Anonymizer: SQL injection in the rules import functions
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-06-11 · updated 2026-10-26
- Weakness: CWE-89
Description
PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a JSON document and placing malicious code inside a particular key-value pair. If a superuser calls the import_database_rules() or import_roles_rules() functions, the malicious code is executed with superuser privileges. The problem is resolved in PostgreSQL Anonymizer 3.1.1 and further versions
Affected products
- DALIBO Postgresql Anonymizer: before 3.1.1 — fixed in 3.1.1
How to fix
Upgrade to a fixed version: DALIBO Postgresql Anonymizer 3.1.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-11945 or the next vulnerability affects your stack