CVE-2026-105612: PostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked roles

Q: Who can exploit this issue?

An attacker needs privileges as a masked role and must be able to submit a query containing a data-modifying CTE. User interaction is required according to the supplied severity vector.

Q: Are deployments using the fixed release affected?

No. The issue is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

Q: What is the impact of successful exploitation?

A masked role can bypass its read-only restriction and modify data. The supplied severity assessment indicates integrity impact only, with no confidentiality or availability impact.

Published Oct 28, 2026

Updated

PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only restriction of masked roles. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions

Affected Software

1 affected component

PostgreSQL PostgreSQL Anonymizer<3.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL Anonymizer to a version that resolves this vulnerability.
Fixed in 3.3.0

Event History

Oct 28, 2026

CVE Published

via MITRE·05:31 PM

Data Sourced

via MITRE·05:31 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs privileges as a masked role and must be able to submit a query containing a data-modifying CTE. User interaction is required according to the supplied severity vector.

Are deployments using the fixed release affected?

No. The issue is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

What is the impact of successful exploitation?

A masked role can bypass its read-only restriction and modify data. The supplied severity assessment indicates integrity impact only, with no confidentiality or availability impact.

CVE-2026-105612: PostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked roles

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are deployments using the fixed release affected?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are deployments using the fixed release affected?

What is the impact of successful exploitation?