CVE-2026-105618: PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent
PostgreSQL Anonymizer's documentation recommends applying rules on partitions and inheritance tables. Direct access to the paritions / inheritance tables is masked but not thru the parent table. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQL Anonymizerto a version that resolves this vulnerability.Fixed in 3.3.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using PostgreSQL Anonymizer with masking rules on partitioned or inheritance child tables are exposed if users can query those tables through their parent. Direct queries to the partitions or inheritance tables are masked.
What access does an attacker need to exploit it?
The attacker needs an existing low-privileged account and must be able to submit a query through the parent table. User interaction is also required according to the supplied severity vector.
Is a fixed version available?
Yes. The issue is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.