CVE-2026-105619: PostgreSQL Anonymizer: Masking rules of the tables are not applied through security_invoker views
PostgreSQL Anonymizer doesn't mask data accessed thru a securityinvoker view. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQL Anonymizerto a version that resolves this vulnerability.Fixed in 3.3.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using PostgreSQL Anonymizer versions earlier than 3.3.0 may be exposed when data is accessed through security_invoker views.
What access and conditions does an attacker need?
The CVSS vector indicates network access, low privileges, and user interaction are required. Exploitation also has high attack complexity and relies on access through a security_invoker view.
What is the impact if the issue is exploited?
Masking rules may not be applied to data accessed through a security_invoker view, resulting in high confidentiality impact. No integrity or availability impact is indicated.
What is the remediation?
Upgrade PostgreSQL Anonymizer to version 3.3.0 or later, where the issue is resolved.