CVE-2026-83534: PostgreSQL Anonymizer RCE Vulnerability

CVE-2026-83534 Overview

CVE-2026-83534 affects PostgreSQL Anonymizer, an extension used to mask or replace personally identifiable information in PostgreSQL databases. The vulnerability resides in the anon.anonymize_database_parallel() function. A table owner can leverage this function to execute arbitrary code with superuser privilege. The issue falls under [CWE-250], execution with unnecessary privileges. The maintainer, Dalibo, addressed the flaw in PostgreSQL Anonymizer version 3.2.0. Any earlier release that exposes anonymize_database_parallel() to non-superuser table owners is affected.

Critical Impact

A low-privileged table owner can escalate to PostgreSQL superuser and gain full control of the database cluster, including all data and server-side code execution.

Affected Products

• PostgreSQL Anonymizer versions prior to 3.2.0
• PostgreSQL instances with the anon extension installed and callable by table owners
• Dalibo-maintained postgresql_anonymizer distributions

Discovery Timeline

• 2026-09-06 - CVE-2026-83534 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-83534

Vulnerability Analysis

PostgreSQL Anonymizer provides masking functions that operate across tables to redact sensitive data. The anon.anonymize_database_parallel() function processes tables in parallel using worker sessions that run with elevated privileges. The function does not adequately sandbox user-controlled inputs derived from table metadata or masking rules attached to columns owned by the caller.

Because the parallel workers execute with superuser context, any SQL or expression injected through owner-controlled objects executes at the highest privilege level. This turns a routine anonymization run into an arbitrary code execution primitive scoped to the PostgreSQL server process.

The attack requires that the adversary already hold OWNER rights on at least one table processed by the function, and that an administrator invoke or schedule anonymize_database_parallel().

Root Cause

The root cause is execution with unnecessary privileges [CWE-250]. The anonymize_database_parallel() routine runs with SECURITY DEFINER or equivalent superuser context but interprets attacker-controlled masking definitions without validating that they cannot invoke arbitrary functions. A table owner can define a masking rule that references a malicious function or expression, which the superuser worker then evaluates.

Attack Vector

Exploitation is network-reachable through a normal PostgreSQL connection but requires high privileges (table ownership) and administrator interaction to trigger the anonymization job. An attacker with CREATE and OWNER rights defines a masking rule on a column that points to a malicious PL/pgSQL or SQL expression. When an administrator later runs anonymize_database_parallel(), the workers evaluate the malicious expression as superuser, granting the attacker full database control. See the GitLab Issue #666 for maintainer discussion.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-83534

Indicators of Compromise

• New PostgreSQL roles created shortly after anon.anonymize_database_parallel() executions
• Unexpected CREATE FUNCTION, CREATE EXTENSION, or COPY PROGRAM statements from non-admin sessions preceding an anonymization job
• Masking rules referencing functions in schemas owned by non-administrative users
• Superuser-context queries originating from parallel worker backends tied to the anon extension

Detection Strategies

• Audit pg_seclabel and anon.pg_masks for masking rules that call user-defined functions outside the anon schema
• Enable log_statement = 'ddl' and log_min_duration_statement to capture rule definitions and worker activity
• Review PostgreSQL audit logs (pgAudit) for SECURITY DEFINER function invocations triggered by parallel workers

Monitoring Recommendations

• Alert on modifications to SECURITY LABEL FOR anon on any table by non-superuser roles
• Monitor for privilege changes on the anon extension objects and unexpected GRANT statements
• Track invocations of anonymize_database_parallel() and correlate with the identities of table owners whose data was processed

How to Mitigate CVE-2026-83534

Immediate Actions Required

• Upgrade PostgreSQL Anonymizer to version 3.2.0 or later on all database clusters
• Inventory existing masking rules and remove any that reference functions owned by non-administrative roles
• Restrict CREATE privileges on schemas containing anonymized tables until the upgrade is complete
• Postpone scheduled anonymize_database_parallel() jobs until patched

Patch Information

Dalibo released PostgreSQL Anonymizer 3.2.0 with the fix. Administrators should update the extension binary, then run ALTER EXTENSION anon UPDATE TO '3.2.0'; in each database where the extension is installed. Refer to the GitLab Issue #666 for the maintainer's remediation notes.

Workarounds

• Use anon.anonymize_database() (non-parallel) after reviewing all masking rules for safe expressions
• Revoke EXECUTE on anon.anonymize_database_parallel() from non-superusers and avoid running it while untrusted table owners exist
• Restrict masking rule authorship to superusers by limiting SECURITY LABEL privileges via role separation

# Configuration example: update the extension and revoke risky privileges
psql -U postgres -d your_database -c "ALTER EXTENSION anon UPDATE TO '3.2.0';"
psql -U postgres -d your_database -c "REVOKE EXECUTE ON FUNCTION anon.anonymize_database_parallel() FROM PUBLIC;"