CVE-2026-105616
PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_setting
DALIBO PostgreSQL AnonymizerDatabasesCVSS
5.7MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 3.3.0PostgreSQL AnonymizerCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
PostgreSQL restricts acces to the salt and shift via the SHOW command for users not member of pg_read_all_settings. But they are visible in pg_db_role_setting or pg_roles if they were set on the database, user or both. PostgreSQL Anonymizer's documentation recommends to use ALTER DATABASE / ALTER ROLE for the salt. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
Text from CVE List
Affected versions 1
- PostgreSQL Anonymizeraffected: 1 before 3.3.0CVE List