CVE-2026-97469: PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink
PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hashoutput) pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed inside the sub-select. The problem is resolved in PostgreSQL Anonymizer 3.2.3 and later versions
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQL Anonymizerto a version that resolves this vulnerability.Fixed in 3.2.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using PostgreSQL Anonymizer with masked roles are exposed if those roles can issue SQL queries. The issue specifically affects unprivileged masked users that can invoke a RESTRICTED function through a sub-select.
What does an attacker need to exploit it?
An attacker needs access as a masked role and the ability to repeatedly execute queries containing a sub-select. They can use this to call anon.hash() repeatedly and collect seed and hash-output pairs for offline brute-force attempts against the salt.
Which versions address the vulnerability?
The issue is resolved in PostgreSQL Anonymizer 3.2.3 and later versions.