[ CVE-2026-105616 · Published 28 Oct 2026 ]
Vulnerability in DALIBO PostgreSQL Anonymizer
[ Description ]Official description
PostgreSQL restricts acces to the salt and shift via the `SHOW` command for users not member of `pg_read_all_settings`. But they are visible in `pg_db_role_setting` or `pg_roles` if they were set on the database, user or both. PostgreSQL Anonymizer's documentation recommends to use ALTER DATABASE / ALTER ROLE for the salt. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1413
Multiple vulnerabilities in PostgreSQL Anonymizer Translated from French
Multiple vulnerabilities have been discovered in PostgreSQL Anonymizer. Some of them allow an attacker to cause remote denial of service, a breach of data confidentiality and a security policy bypass.