Description

PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner of a table to run arbitrary code with superuser privilege. The issue is fixed in PostgreSQL Anonymizer 3.2.0 and later versions

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-06T16:16:50.753Z",
  "pubdate": "2026-09-06T16:16:50.753Z",
  "executiveSummary": "A critical security vulnerability has been identified in the PostgreSQL Anonymizer extension, specifically within the anon.anonymize_database_parallel() function.\nThis vulnerability is categorized as an improper privilege management issue, allowing an authenticated database user with table ownership privileges to escalate their authority to superuser levels.\nThe flaw impacts PostgreSQL Anonymizer versions prior to 3.2.0. By exploiting this vulnerability, an attacker can execute arbitrary code within the database environment, bypassing standard security controls and potentially compromising the integrity, confidentiality, and availability of the entire database cluster.\nThe risk is considered severe as it permits lateral movement from restricted database roles to administrative superuser privileges, granting the attacker full control over the database system.\nExploitation requires the attacker to have at least table ownership permissions, which is a common scenario in multi-tenant or shared database environments.",
  "technicalDetails": "The vulnerability resides in the execution logic of the anon.anonymize_database_parallel() function provided by the PostgreSQL Anonymizer extension. The root cause pertains to an insecure execution context where the extension performs operations on behalf of the user without sufficient input sanitization or execution isolation.\nIn PostgreSQL, functions designated to perform administrative tasks often require superuser privileges to modify system catalogs or perform cross-schema anonymization operations. The anon.anonymize_database_parallel() function fails to adequately restrict the scope of its execution, allowing an attacker who possesses table ownership to influence the logic executed by the function.\nThe attack flow proceeds as follows: First, the attacker identifies a table they own that is targeted by the parallel anonymization routine. Second, the attacker crafts a malicious payload that exploits the function's lack of process isolation. Because the function executes with superuser context to facilitate the anonymization of sensitive data, it inadvertently grants the caller the ability to inject commands that run with the elevated privileges of the database superuser.\nSpecifically, when anon.anonymize_database_parallel() initiates parallel workers or background processes to speed up data masking, the execution environment does not properly validate the context or the commands issued during the task orchestration. An attacker can manipulate the state of the database or the definition of the target tables in such a way that the anonymization engine executes arbitrary SQL or administrative commands under the superuser identity.\nThis vulnerability is particularly dangerous because it bypasses the security boundary between standard database users and the superuser. Since the PostgreSQL extension runs within the database server process space, successful exploitation leads to full code execution. This allows for total system compromise, including unauthorized data exfiltration, the installation of malicious extensions, or the modification of internal system data. The vulnerability remains present in all versions prior to 3.2.0, where the extension developers implemented stricter execution guards and context validation to ensure that parallelized anonymization tasks are executed within a constrained and verified security environment."
}