Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-105620 EUVD-2026-112292GHSA-mvh5-mj42-8xc9

PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query

Published Oct 28, 2026 · Updated Nov 5, 2026 · Assigned by PostgreSQL

Vendor: DALIBO Product: PostgreSQL Anonymizer

Description

PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

Affected products

VendorProductAffectedFixed
DALIBO PostgreSQL Anonymizer 1 – < 3.3.0 3.3.0

References