CVE-2026-19634: PostgreSQL Anonymizer: SQL injection in import_database_rules() and import_roles_rules() via crafted object names / JSON
PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.importdatabaserules() or anon.importrolesrules(), the malicious code is executed with superuser privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQL Anonymizerto a version that resolves this vulnerability.Fixed in 3.1.4
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker needs the ability to create or supply a malicious JSON document with specially crafted object names. A superuser must then call anon.import_database_rules() or anon.import_roles_rules() on that document; successful exploitation executes code with superuser privileges.
Who is realistically exposed?
Deployments are exposed when untrusted or insufficiently validated JSON can reach either affected import function and a superuser performs the import. The issue is not described as exploitable solely through network access or without superuser interaction.
Which versions contain the fix?
The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later.