CVE-2026-19634

MEDIUMCVSS 6.4

Description

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.import_database_rules() or anon.import_roles_rules(), the malicious code is executed with superuser privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later

Timeline

Published:September 6th, 2026 4:16 PM

Last modified:September 6th, 2026 4:16 PM

CVSS Scoring

CVSS v3: 6.4 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-89

References & Reports

Advisories, patches, and third-party reports

https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/665

Source: NIST NVD · Data may lag official sources by up to one minute