CVE-2026-19634 PUBLISHED

PostgreSQL Anonymizer: SQL injection in import_database_rules() and import_roles_rules() via crafted object names / JSON

Assigner: PostgreSQL
Reserved: 12.08.2026 Published: 06.09.2026 Updated: 06.09.2026

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.import_database_rules() or anon.import_roles_rules(), the malicious code is executed with superuser privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS Score: 6.4

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	High
User Interaction	Required	Availability Impact	High

CVSS 3.1

Product Status

Vendor	DALIBO
Product	PostgreSQL Anonymizer
Versions	Default: unaffected affected from 1 to 3.1.4 (excl.)

Workarounds

Remove the rules import functions named anon.import_roles_rules() and anon.import_database_rules(). They are user-facing functions with no internal dependencies.

Credits

The PostgreSQL Anonymizer project thanks user Sarath Kumar for reporting this problem.

References

https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/665

Problem Types

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE