CVE-2026-19633: PostgreSQL Anonymizer RCE Vulnerability

CVE-2026-19633 Overview

CVE-2026-19633 affects PostgreSQL Anonymizer, an extension that masks personal data in PostgreSQL databases. The vulnerability allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When the extension evaluates these objects during masking operations, the attacker-controlled code runs with elevated privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later versions. The flaw is classified under [CWE-89] and requires only low-privileged authenticated access over the network.

Critical Impact

Authenticated low-privileged database users can escalate to elevated privileges and execute arbitrary code inside the PostgreSQL server context.

Affected Products

• PostgreSQL Anonymizer versions prior to 3.1.4
• PostgreSQL instances with the anon extension enabled
• Environments using dynamic masking or static masking features of PostgreSQL Anonymizer

Discovery Timeline

• 2026-09-06 - CVE-2026-19633 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-19633

Vulnerability Analysis

PostgreSQL Anonymizer applies masking rules when privileged roles read data through masked views or dynamic masking sessions. The extension evaluates SQL expressions, operators, and casts defined by database users when constructing masked query plans. An attacker with the ability to create database objects can plant malicious expressions inside operators, domain casts, or view subqueries. When a superuser or masking administrator triggers evaluation of these objects, the injected SQL runs under the caller's authority.

The issue combines characteristics of SQL injection [CWE-89] with insecure privilege delegation. Because the masking engine trusts objects created by low-privileged masked users, it becomes a vehicle for lateral privilege escalation inside the database engine.

Root Cause

The root cause lies in how the extension resolves and executes user-defined objects during masking. The masking mechanism does not adequately restrict which expressions may run in a privileged context. Custom operators, domain constraints, and subqueries embedded in views are all evaluated without sufficient authority checks, letting attacker-supplied code piggyback on privileged sessions.

Attack Vector

An authenticated user with low privileges on the target database creates a malicious operator, domain, or view containing an untrusted expression. When a privileged role, such as an administrator running masking exports or reading a masked view, evaluates that object, the malicious expression executes with the privileged role's rights. The result is arbitrary SQL execution, data exfiltration, or full database compromise.

See the GitLab Issue Discussion for maintainer notes on the vulnerable code paths.

Detection Methods for CVE-2026-19633

Indicators of Compromise

• Unexpected creation of custom operators, domains, or views by non-administrative database roles
• Function or expression definitions containing SECURITY DEFINER semantics or references to system catalogs from low-privileged users
• PostgreSQL logs showing masking queries executing objects owned by masked roles
• New role grants or password changes correlated with masking export activity

Detection Strategies

• Audit pg_operator, pg_type (domains), and pg_views for objects owned by roles enrolled in the MASKED group
• Enable log_statement = 'ddl' and alert on DDL from non-administrative accounts that affects masking-related schemas
• Correlate masking export or anon.anonymize_database() invocations with prior DDL by low-privileged users

Monitoring Recommendations

• Forward PostgreSQL audit logs to a centralized SIEM and flag object creations preceding masking runs
• Monitor process execution and outbound network activity from the PostgreSQL server for signs of post-exploitation
• Track version metadata of the anon extension across managed database inventories to identify hosts still below 3.1.4

How to Mitigate CVE-2026-19633

Immediate Actions Required

• Upgrade PostgreSQL Anonymizer to version 3.1.4 or later on every affected database instance
• Inventory all custom operators, domains, and views created by masked roles and review them for untrusted expressions
• Restrict CREATE privileges on schemas accessible to masked users until the upgrade is complete

Patch Information

The maintainers fixed the issue in PostgreSQL Anonymizer 3.1.4. Apply the update by installing the patched extension package and running ALTER EXTENSION anon UPDATE; in each database that loads the extension. Confirm the installed version with SELECT anon.version(); after the upgrade.

Workarounds

• Revoke CREATE on public and application schemas from roles that participate in masking until patched
• Drop or rewrite user-defined operators, domain casts, and view subqueries that reference masked data
• Avoid running masking exports or querying masked views under superuser roles; use a dedicated, minimally privileged masking operator role

# Update the extension after installing the patched package
psql -d your_database -c "ALTER EXTENSION anon UPDATE;"
psql -d your_database -c "SELECT anon.version();"

# Restrict object creation by masked roles as a temporary hardening step
psql -d your_database -c "REVOKE CREATE ON SCHEMA public FROM PUBLIC;"