What is the CVSS score of EUVD-2026-32504?

EUVD-2026-32504 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-32504?

Yes, a patch is available for EUVD-2026-32504. Update the affected software to the latest version immediately.

PostgreSQL Anonymizer EUVD-2026-32504

| CVE-2026-9617 MEDIUM

SQL Injection (CWE-89)

2026-05-27 f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

GHSA-2qfw-46cx-cgv6

PostgreSQL SQLi

6.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:18 vuln.today

Patch available

May 27, 2026 - 19:46 EUVD

DescriptionCVE.org

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a table and placing malicious code inside a column identifier. If a superuser calls the k-anonymity function, the malicious code is executed with superuser privileges. The risk is higher with PostgreSQL 14 or with instances upgraded from PostgreSQL 14 or a prior version. With PostgreSQL 15 and later, the creation permission on the public schema is revoked by default and this exploit can only be achieved by a user who was explicitly granted the CREATE TABLE privilege. The problem is resolved in PostgreSQL Anonymizer 3.1.0 and further versions

AnalysisAI

Privilege escalation in PostgreSQL Anonymizer (all versions prior to 3.1.0) allows an authenticated database user to gain superuser privileges by embedding malicious SQL code within a column identifier of a user-created table. When a superuser invokes the k-anonymity function against such a table, the injected code executes with superuser-level privileges, yielding full confidentiality, integrity, and availability impact across the database. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though SSVC rates technical impact as total due to the complete privilege escalation outcome.

Technical ContextAI

PostgreSQL Anonymizer is a PostgreSQL extension developed by Dalibo that provides data masking and anonymization capabilities, including k-anonymity enforcement. The root cause is CWE-89 (SQL Injection) arising from insufficient sanitization of column identifiers - specifically, the k-anonymity function appears to dynamically construct SQL queries incorporating user-supplied column names without proper quoting or escaping, allowing SQL metacharacters embedded in identifier names to be interpreted as executable code. The attack surface differs materially by PostgreSQL version: on PostgreSQL 14 and earlier, the public schema grants CREATE TABLE to all users by default, making exploitation accessible to any authenticated user. PostgreSQL 15 revoked this default, narrowing the attack surface to users explicitly granted CREATE TABLE privileges. The EUVD-2026-32504 record confirms affected versions as PostgreSQL Anonymizer 1.x through all releases prior to 3.1.0.

RemediationAI

Upgrade to PostgreSQL Anonymizer 3.1.0 or later, which is the vendor-confirmed fix for this vulnerability as stated in the CVE description and corroborated by the vendor patch availability signal. Reference the upstream issue at https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/640 for release details. As a compensating control prior to patching on PostgreSQL 14 instances, explicitly revoke CREATE TABLE rights on the public schema for non-superuser roles using 'REVOKE CREATE ON SCHEMA public FROM PUBLIC;' - note this may break applications that dynamically create tables in the public schema and should be tested before deployment. Additionally, restrict invocation of k-anonymity functions to trusted administrative roles only, preventing untrusted users from positioning malicious tables in paths that superusers process. On PostgreSQL 15+, audit whether any non-essential users have been explicitly granted CREATE TABLE privileges and revoke where unnecessary.