Skip to content
OpenAdvisories
Medium · 5.7 CVE-2026-105617 EUVD-2026-112289GHSA-pmmg-m528-xf29

PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule

Published Oct 28, 2026 · Updated Nov 5, 2026 · Assigned by PostgreSQL

Description

PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule was added or a role changed. Users using such plans can still see the unmasked data until the end of the session. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

Affected products

VendorProductAffectedFixed
DALIBO PostgreSQL Anonymizer 1 – < 3.3.0 3.3.0

References