What’s Vulnerable › Vulnerabilities
CVE-2026-19633: PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-06 · updated 2026-09-09
- Weakness: CWE-89
Description
PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the malicious code can run with elevated privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later versions
Affected products
- DALIBO PostgreSQL Anonymizer: from 1 before 3.1.4 — fixed in 3.1.4
How to fix
Upgrade to a fixed version: DALIBO PostgreSQL Anonymizer 3.1.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-19633 or the next vulnerability affects your stack