Skip to content
CVE PROGRAM SOURCE RECORD6.4 Medium

CVE-2026-11945

PostgreSQL Anonymizer: SQL injection in the rules import functions

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
PostgreSQL

Description

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a JSON document and placing malicious code inside a particular key-value pair. If a superuser calls the import_database_rules() or import_roles_rules() functions, the malicious code is executed with superuser privileges. The problem is resolved in PostgreSQL Anonymizer 3.1.1 and further versions

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

DALIBO PostgreSQL Anonymizer

Default version status: unaffected

  • 1 to < 3.1.1affected

References