CVE-2026-19634 Overview
CVE-2026-19634 is a SQL injection vulnerability [CWE-89] in PostgreSQL Anonymizer, an extension from Dalibo used to mask or replace personally identifiable information in PostgreSQL databases. The flaw resides in two import functions, anon.import_database_rules() and anon.import_roles_rules(), which fail to properly sanitize object names read from JSON input. An attacker who can supply a malicious JSON document can embed crafted object names that execute arbitrary SQL when a superuser later imports the file. The vendor fixed the issue in PostgreSQL Anonymizer 3.1.4.
Critical Impact
Successful exploitation results in arbitrary SQL execution with PostgreSQL superuser privileges, exposing all databases on the instance to full read, write, and administrative compromise.
Affected Products
- PostgreSQL Anonymizer versions prior to 3.1.4
- PostgreSQL instances loading the anon extension
- Deployments that ingest external JSON rule files via the import functions
Discovery Timeline
- 2026-09-06 - CVE-2026-19634 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-19634
Vulnerability Analysis
The vulnerability affects two administrative helpers exposed by the PostgreSQL Anonymizer extension. Both anon.import_database_rules() and anon.import_roles_rules() parse a JSON document describing masking rules keyed by database object names such as schemas, tables, columns, and roles. The functions concatenate these names into dynamic SQL statements without escaping identifiers. An attacker who controls the JSON content can inject additional SQL fragments through object-name fields. Because the import routines are intended to be run by a database superuser, injected statements execute with the highest PostgreSQL privileges, bypassing role-based access control entirely.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command [CWE-89] within the identifier-handling logic of the two import functions. Object names taken from the JSON payload are trusted as safe identifiers and interpolated into dynamic SQL instead of being passed through quote_ident() or a parameterized identifier construction. This violates the standard PostgreSQL practice of separating identifiers from executable statements.
Attack Vector
Exploitation requires two participants. First, a lower-privileged user or an external actor who can write to the rule file location prepares a JSON document containing object names that carry SQL payloads. Second, a superuser must invoke anon.import_database_rules() or anon.import_roles_rules() on that file. The user interaction and high-privilege execution context explain why the CVSS vector reports high attack complexity, high privileges required, and user interaction. Once triggered, the payload runs with superuser rights and can create roles, exfiltrate data, or disable auditing.
No public proof-of-concept has been published. See the GitLab Issue #665 for the maintainer's technical discussion.
Detection Methods for CVE-2026-19634
Indicators of Compromise
- Unexpected CREATE ROLE, ALTER ROLE, or GRANT statements appearing in PostgreSQL logs shortly after an anon.import_database_rules() or anon.import_roles_rules() call.
- JSON rule files containing object-name fields with embedded quotes, semicolons, or SQL keywords such as COPY, DO, or CREATE.
- New superuser accounts, extensions, or event triggers created outside change-management windows.
Detection Strategies
- Enable log_statement = 'all' on hosts running the anon extension and alert on invocations of the two import functions.
- Compare rule files against a known-good baseline stored in version control before any import operation.
- Correlate PostgreSQL audit logs with file-integrity events on the directory that stores JSON rule files.
Monitoring Recommendations
- Ingest PostgreSQL server logs and pgaudit output into a centralized logging platform and retain them for retrospective analysis.
- Alert on any privilege changes, extension installations, or event trigger modifications that follow an import call.
- Track the installed version of the anon extension across the fleet using SELECT extversion FROM pg_extension WHERE extname = 'anon'.
How to Mitigate CVE-2026-19634
Immediate Actions Required
- Upgrade PostgreSQL Anonymizer to version 3.1.4 or later on every instance where the extension is installed.
- Restrict write access to directories containing JSON rule files so that only trusted administrators can create or modify them.
- Review recent invocations of anon.import_database_rules() and anon.import_roles_rules() and audit for unauthorized schema, role, or privilege changes.
Patch Information
The maintainers of PostgreSQL Anonymizer fixed the issue in release 3.1.4. Details of the resolution are tracked in GitLab Issue #665. After upgrading, restart the PostgreSQL service and run ALTER EXTENSION anon UPDATE to load the patched functions.
Workarounds
- Avoid running anon.import_database_rules() and anon.import_roles_rules() on JSON files sourced from untrusted or shared locations until the patch is applied.
- Manually inspect JSON rule files for suspicious identifiers before import, rejecting any object names containing quotes, semicolons, or whitespace.
- Temporarily revoke EXECUTE on the two import functions from all roles except a small set of vetted administrators.
# Configuration example: verify the installed version and update the extension
psql -U postgres -c "SELECT extname, extversion FROM pg_extension WHERE extname = 'anon';"
psql -U postgres -c "ALTER EXTENSION anon UPDATE TO '3.1.4';"
psql -U postgres -c "REVOKE EXECUTE ON FUNCTION anon.import_database_rules(text) FROM PUBLIC;"
psql -U postgres -c "REVOKE EXECUTE ON FUNCTION anon.import_roles_rules(text) FROM PUBLIC;"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
