EUVD-2026-36266
GHSA-g5vm-7gwv-45rj
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Authenticated user (PR:L) plants payload over the network (AV:N); a superuser must later run the importer (UI:R, AC:H), and execution crosses the role boundary into the superuser security context (S:C) with total impact.
Primary rating from Vendor (PostgreSQL).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionNVD
PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a JSON document and placing malicious code inside a particular key-value pair. If a superuser calls the import_database_rules() or import_roles_rules() functions, the malicious code is executed with superuser privileges. The problem is resolved in PostgreSQL Anonymizer 3.1.1 and further versions
AnalysisAI
Privilege escalation in PostgreSQL Anonymizer versions prior to 3.1.1 allows a low-privileged database user to achieve superuser execution by embedding malicious code in a crafted JSON key-value pair that is later processed by the import_database_rules() or import_roles_rules() functions when invoked by a superuser. The attack is a stored payload that requires a superuser to trigger import of attacker-controlled rules, and no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must (1) hold an authenticated PostgreSQL role with the ability to write the JSON rules document later consumed by the anon extension (e.g., insert into the rules table, modify the file on disk, or supply the file path) and (2) wait for or induce a superuser to invoke anon.import_database_rules() or anon.import_roles_rules() against that JSON. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals here pull in opposite directions and must be weighed carefully: the CVSS 3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/C:H/I:H/A:H) reflects total compromise of the database, but EPSS is only 0.04% (12th percentile) and CISA SSVC marks Exploitation as none and Automatable as no. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged but authenticated database user who can influence the masking/role rules JSON (for example by writing to a shared rules table or file consumed during restore) embeds malicious SQL inside the targeted key-value pair. Later, a DBA running maintenance executes SELECT anon.import_database_rules(...) or anon.import_roles_rules(...) as a superuser, at which point the embedded SQL runs with superuser privileges and the attacker creates a new superuser role or exfiltrates protected data. … |
| Remediation | Vendor-released patch: PostgreSQL Anonymizer 3.1.1 - upgrade the extension to 3.1.1 or later on every PostgreSQL instance where the extension is installed, per the upstream issue at https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/643 and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-11945. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit current PostgreSQL Anonymizer version and restrict non-superuser database access to rule management functions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
SQL injection in n8n's legacy Postgres v1 and TimescaleDB workflow nodes allows an authenticated workflow editor to inje
Unauthenticated SQL injection in NCEAS Metacat 2.0.0 through pre-3.0.0 allows remote attackers to read, modify, and exec
Share
External POC / Exploit Code
Leaving vuln.today