Read the docs
TI-2026-82097 Aliases CVE-2026-105616GHSA-ccch-g55g-pm23

Secret salt and shift in PostgreSQL Anonymizer readable by any role

Priority LOW 25CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

DALIBO PostgreSQL Anonymizer from 1 before 3.3.0 exposes the secret salt and shift used by anon. PostgreSQL hides these values from SHOW for roles outside pg_read_all_settings, but they remain visible in pg_db_role_setting or pg_roles when set on a database or user, which exposes sensitive information (CWE-200). Any role that can read these catalogs can obtain the values.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

PostgreSQL restricts acces to the salt and shift via the `SHOW` command for users not member of `pg_read_all_settings`. But they are visible in `pg_db_role_setting` or `pg_roles` if they were set on the database, user or both. PostgreSQL Anonymizer's documentation recommends to use ALTER DATABASE / ALTER ROLE for the salt. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00194 9th percentileScored 2026-11-07
Fix Fixed PostgreSQL Anonymizer (DALIBO): 3.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DALIBOPostgreSQL Anonymizer1 to before 3.3.03.3.0Patch availableCNA
  • PostgreSQL Anonymizer VendorDALIBO Affected 1 to before 3.3.0 Fixed in 3.3.0 Patch available CNA

Remediation

Upgrade DALIBO PostgreSQL Anonymizer to version 3.3.0 or later, which resolves the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA PostgreSQL Anonymizer (DALIBO) Fixed in 3.3.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    DALIBO PostgreSQL Anonymizer 3.3.0

    12 records Highest priority Priority LOW 12 LOW

    Other records, highest priority first

    • TI-2026-82102 Protection mechanism failure in PostgreSQL Anonymizer leaks anonymized dataPriority LOW 28
    • TI-2026-82101 PostgreSQL Anonymizer: masked role reads real data via sub-query rulePriority LOW 28
    • TI-2026-82099 PostgreSQL Anonymizer skips masking for queries through parent tablesPriority LOW 25
    Show all 12 records →

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-105616
  2. 2026-10-28 Alias added: GHSA-ccch-g55g-pm23
  3. 2026-10-30 Priority changed: MEDIUM → LOW
  4. 2026-11-05 CISA SSVC decision points changed

References

Other 1

  • TI-2025-05130 Cursor allows PostgreSQL Anonymizer masked user to gain unauthorized access to authentic data CVSS 3.1MEDIUM 6.5
  • TI-2026-15944 PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries CVSS 3.1HIGH 8.8
  • TI-2024-02174 Improper Input Validation in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule CVSS 3.1HIGH 8.8
  • TI-2026-08447 PostgreSQL Anonymizer: malicious column name allows SQL injection via anon.k_anonymity() function CVSS 3.1HIGH 8.8
  • TI-2026-01997 Uncontrolled search path in DALIBO PostgreSQL Anonymizer CVSS 3.1HIGH 8.0
  • TI-2026-01996 Uncontrolled search path in DALIBO PostgreSQL Anonymizer CVSS 3.1HIGH 8.0
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences