PostgreSQL Anonymizer CVE-2026-97469

Requires an existing low-privileged 'masked' role in a PostgreSQL instance running the PostgreSQL Anonymizer extension with dynamic masking configured (PR:L). The attacker must be able to reach the database over the network and execute SQL, invoking anon.hash() by placing the RESTRICTED function call inside a sub-select to bypass the intended call restriction. Exploitation is limited to deducing the masking salt through offline brute-force over collected (seed, hash_output) pairs - it does not by itself expose plaintext or elevate privileges, and it is fully mitigated in PostgreSQL Anonymizer 3.2.3 and later.

This is a genuine but low-severity issue whose signals are internally consistent rather than conflicting. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3, MEDIUM) correctly reflects a network-reachable but authenticated (PR:L) weakness with only low confidentiality impact and no integrity/availability effect - matching a description in which a low-privileged masked role recovers a masking salt, not arbitrary data. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced (only a GitLab issue tracker link), so this is 'no public exploit identified at time of analysis.' The realistic-world priority is LOW-to-MEDIUM: exploitation yields the salt used by anon.hash(), which weakens the pseudonymization guarantee (enabling offline de-anonymization of hashed values) but does not directly expose plaintext or grant new privileges. No signals conflict; the main caveat is that impact is a downstream cryptographic weakening (CWE-328) rather than a direct data dump, which some may under-rate.

An analyst or application account that has been given a masked (pseudonymized) role in a PostgreSQL database repeatedly invokes anon.hash() - smuggling the RESTRICTED function into a sub-select to bypass the call restriction - and records many (seed, hash_output) pairs. Offline, the attacker brute-forces the fixed salt from these pairs, then uses the recovered salt to reverse or correlate hashed values and de-anonymize supposedly masked data. No public exploit code is identified; the attack requires an existing low-privileged masked account.