Medium severity · published Sep 6, 2026
CVE-2026-19634
PostgreSQL Anonymizer: SQL injection in import_database_rules() and import_roles_rules() via crafted object names / JSON
6.4
CVSS
0.3%
EPSS
No
On KEV
Description
PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.import_database_rules() or anon.import_roles_rules(), the malicious code is executed with superuser privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
PostgreSQL Anonymizer · DALIBO
1 before 3.1.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19634
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19634
gitlab.com
https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/665
More from PostgreSQL Anonymizer
8.8
CVE-2026-19633
PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries
8.8
CVE-2026-9617
PostgreSQL Anonymizer: malicious column name allows SQL injection via anon.k_anonymity() function
8.8
CVE-2024-2339
Improper Input Validation in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule
8.0
CVE-2026-2361
Improper search_path protection in PostgreSQL Anonymizer 2.5 allows any user with create privilege to gain superuser privileges
8.0
CVE-2026-2360
Improper search_path protection in PostgreSQL Anonymizer 2.5 allows any user to gain superuser privileges in PostgreSQL 14