CVE-2026-19633

PostgreSQL Anonymizer, a masking extension for PostgreSQL databases, contains a flaw (CWE-89, SQL injection) in which unprivileged masked users can execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. The flaw is triggered when these objects are evaluated inside the extension's masking mechanisms, where the embedded expressions run with elevated privileges rather than the masked user's own permissions. A masked user who can influence or supply such an expression therefore gains code execution with elevated privileges on the database server, potentially reading or altering masked (sensitive) data and running commands beyond their intended rights. Any PostgreSQL deployment with the Anonymizer extension installed at versions before 3.1.4 is affected, particularly those using dynamic masking of unprivileged users. No public proof-of-concept or in-the-wild exploitation is currently known, and CISA has not added the issue to its KEV catalog.

What to do: Upgrade PostgreSQL Anonymizer to version 3.1.4 or later on every PostgreSQL instance where the extension is installed. Until patched, review masking policies for operators, domain casts, and view subqueries that embed untrusted expressions, and restrict masked roles from influencing or defining such objects. No in-the-wild exploitation is known, so patching proactively before a public exploit appears is the priority.