Description

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the malicious code can run with elevated privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later versions

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-06T16:16:49.583Z",
  "pubdate": "2026-09-06T16:16:49.583Z",
  "executiveSummary": "A critical security vulnerability has been identified in PostgreSQL Anonymizer, an extension designed for data masking within PostgreSQL databases.\nThe vulnerability allows an unprivileged user, restricted by masking policies, to escape these constraints and execute arbitrary code with elevated database privileges.\nThis flaw stems from the improper handling of untrusted expressions embedded within specific database objects, such as operators, domain casts, or view subqueries, during the extension's masking evaluation process.\nThe impact is significant, as it permits unauthorized command execution, potentially leading to a full compromise of the database environment.\nExploitation requires the attacker to have an existing unprivileged account with access to the masked database environment.\nThis issue affects PostgreSQL Anonymizer versions prior to 3.1.4, which introduces the necessary patches to sanitize these evaluations.\nOrganizations relying on this extension for sensitive data protection are advised to upgrade immediately to mitigate the risk of unauthorized privilege escalation and system compromise.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure evaluation of untrusted expressions when the PostgreSQL Anonymizer extension processes masked data. When the extension's masking engine triggers, it evaluates various database objects, including operators, domain casts, and view subqueries, to determine how data should be presented to the user.\nIf these objects contain malicious, user-defined expressions, the extension may inadvertently execute them under the security context of the extension itself, which typically runs with higher administrative privileges than the unprivileged masked user.\nThe exploitation flow begins with the attacker identifying a point of injection where they can influence the definition or underlying logic of an object evaluated by the masking engine. For example, by creating or modifying a domain cast, an operator, or a view that utilizes malicious SQL, the attacker leverages the extension's internal evaluation mechanism as an execution vector.\nWhen a masked user queries data protected by the affected masking policy, the PostgreSQL Anonymizer engine resolves the requested data by executing the compromised objects. Because these objects are evaluated as part of the masking process, the arbitrary code embedded within them inherits the effective privileges of the extension's execution context.\nThis allows the attacker to bypass access control restrictions and perform operations that the original unprivileged account is not authorized to execute. The scope of the payload behavior is limited only by the privileges granted to the database user running the masking extension, which is often sufficient to read, modify, or delete sensitive data, or potentially execute system-level commands if the database configuration permits.\nThis vulnerability is present in versions of PostgreSQL Anonymizer prior to 3.1.4. The exploitation requires the ability to define or influence database objects that the extension's masking engine interacts with, placing the primary threat vector on internal or local database users. No network-level exposure is strictly necessary, as the attack is performed via standard database interface methods, making the privilege requirements the primary barrier for the attacker."
}