CVE-2026-83534: PostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_parallel()
PostgreSQL Anonymizer contains a vulnerability in the anon.anonymizedatabaseparallel() function that allows the owner of a table to run arbitrary code with superuser privilege. The issue is fixed in PostgreSQL Anonymizer 3.2.0 and later versions
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQL Anonymizerto a version that resolves this vulnerability.Fixed in 3.2.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must own a table in a PostgreSQL instance using PostgreSQL Anonymizer and be able to invoke anon.anonymize_database_parallel(). Exploitation also requires user interaction, as reflected in the supplied vector.
What is the impact if exploitation succeeds?
A table owner can execute arbitrary code with superuser privileges, resulting in full compromise of confidentiality, integrity, and availability within the affected PostgreSQL environment.
Which versions are fixed?
PostgreSQL Anonymizer 3.2.0 and later versions contain the fix.