CVE-2026-105617: PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule
PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule was added or a role changed. Users using such plans can still see the unmasked data until the end of the session. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQL Anonymizerto a version that resolves this vulnerability.Fixed in 3.3.0
Event History
Frequently Asked Questions
Who can still view unmasked data?
Users with prepared or cached query plans created before a masking rule was added or before their role changed can continue to see unmasked data. The exposure lasts until their database session ends.
What does an attacker need to exploit this issue?
The user must be able to use an existing prepared or cached plan that was created before the relevant masking rule or role change. No privilege requirement is specified, but the supplied severity vector indicates network reachability, low attack complexity, and required user interaction.
What can be done if upgrading is not immediately possible?
End affected user sessions so that prepared and cached plans are discarded, then require new sessions after masking-rule or role changes. This removes the stated exposure window, which otherwise lasts until session termination.
How can administrators determine whether they may be affected?
Review whether PostgreSQL Anonymizer is older than 3.3.0 and whether masking rules were added or user roles changed while sessions with prepared or cached plans remained active. Those existing sessions may have returned unmasked data until they ended.