CVE-2026-105615
PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_stats
DALIBO PostgreSQL AnonymizerDatabasesCVSS
3.5LowExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 3.3.0PostgreSQL AnonymizerCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
PostgreSQL's optimized statistics on a table are visible as long as you have SELECT privilege on said table. A masked role can therefore read a limited subset of the data through the statistics view's histograms and mcvs. The vulnerability is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
Text from CVE List
Affected versions 1
- PostgreSQL Anonymizeraffected: 1 before 3.3.0CVE List