Skip to content
CVE PROGRAM SOURCE RECORD5.7 Medium

CVE-2026-105617

PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
PostgreSQL

Description

PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule was added or a role changed. Users using such plans can still see the unmasked data until the end of the session. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

DALIBO PostgreSQL Anonymizer

Default version status: unaffected

  • 1 to < 3.3.0affected

References