Log in Start free

Vulnerability · Published Jun 11, 2026 · Assigned by PostgreSQL

CVE-2026-11945PostgreSQL Anonymizer: SQL injection in the rules import functions

Medium 6.4

In plain English

A medium-severity SQL injection in PostgreSQL Anonymizer from DALIBO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.2%top 83.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a JSON document and placing malicious code inside a particular key-value pair. If a superuser calls the import_database_rules() or import_roles_rules() functions, the malicious code is executed with superuser privileges. The problem is resolved in PostgreSQL Anonymizer 3.1.1 and further versions

Affected products (as reported)

VendorProductVersions
DALIBO PostgreSQL Anonymizer 1 – before 3.1.1

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

References