CVE-2026-105616: PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_setting
PostgreSQL restricts acces to the salt and shift via the SHOW command for users not member of pgreadallsettings. But they are visible in pgdbrolesetting or pgroles if they were set on the database, user or both. PostgreSQL Anonymizer's documentation recommends to use ALTER DATABASE / ALTER ROLE for the salt. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQL Anonymizerto a version that resolves this vulnerability.Fixed in 3.3.0
Event History
Frequently Asked Questions
Which deployments are exposed to this disclosure?
Deployments that configured PostgreSQL Anonymizer's salt or shift at the database level, role level, or both using ALTER DATABASE or ALTER ROLE are exposed. Those settings can be visible through pg_db_role_setting or pg_roles.
What access does an attacker need to obtain the secret values?
The issue affects any role able to read the relevant pg_roles or pg_db_role_setting entries. The normal SHOW-command restriction for users outside pg_read_all_settings does not prevent disclosure through those catalog views.
How can I determine whether my deployment is affected?
Check whether the Anonymizer salt or shift was set through ALTER DATABASE, ALTER ROLE, or both, and whether roles can view the associated values in pg_db_role_setting or pg_roles. PostgreSQL Anonymizer versions before 3.3.0 are affected.
What is the remediation?
Upgrade PostgreSQL Anonymizer to version 3.3.0 or later, where the problem is resolved.