Vulnerability · Published Oct 28, 2026 · Assigned by PostgreSQL

CVE-2026-110181PostgreSQL Anonymizer: Function declared with SQL-standard syntax leak anonymized data

Medium 6.5

In plain English

A medium-severity security flaw in PostgreSQL Anonymizer from DALIBO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 80.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL analyses such functions at declaration time, while Anonymizer only attempts to check them at execution time. This problem can be exploited by any user with the TEMPORARY privilege. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.

Affected products (as reported)

Vendor	Product	Versions
DALIBO	PostgreSQL Anonymizer	1 – before 3.3.0

Weakness: CWE-693 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/718