CVE-2026-9617: PostgreSQL Anonymizer Privilege Escalation

CVE-2026-9617 Overview

CVE-2026-9617 is a SQL injection vulnerability in PostgreSQL Anonymizer that allows a low-privileged database user to escalate to superuser. An attacker creates a table and embeds malicious SQL inside a column identifier. When a superuser later invokes the k-anonymity function, the injected code executes with superuser privileges. The flaw is tracked under CWE-89 (SQL Injection). PostgreSQL Anonymizer 3.1.0 resolves the issue.

Critical Impact

An authenticated user with CREATE TABLE permission can achieve full superuser privileges on the PostgreSQL instance, leading to complete database compromise.

Affected Products

• PostgreSQL Anonymizer versions prior to 3.1.0
• PostgreSQL 14 deployments (default public schema permissions increase exposure)
• PostgreSQL 15+ instances upgraded from PostgreSQL 14 or earlier

Discovery Timeline

• 2026-05-27 - CVE-2026-9617 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-9617

Vulnerability Analysis

PostgreSQL Anonymizer provides data masking functions, including k-anonymity analysis, that operate on user-defined tables. The vulnerability arises because the extension interpolates column identifiers into dynamically constructed SQL without sufficient sanitization. An attacker creates a table whose column name contains crafted SQL syntax. When a superuser subsequently runs the k-anonymity function against that table, the malicious identifier is concatenated into the executed query and runs with the caller's elevated privileges.

Exploitation requires high-privilege actions on both sides: the attacker must hold CREATE TABLE rights, and a superuser must voluntarily call the affected function on the attacker-controlled object. User interaction is therefore required, which limits opportunistic exploitation but does not prevent targeted attacks in shared or multi-tenant database environments.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. PostgreSQL Anonymizer fails to safely quote or validate column identifiers before incorporating them into dynamic SQL. Identifiers in PostgreSQL should be passed through quote_ident() or supplied via parameterized DDL construction. Without these safeguards, an attacker-controlled column name becomes an SQL injection sink that executes in the security context of the calling role.

Attack Vector

The attack is network-reachable through any PostgreSQL client connection. PostgreSQL 14 is more exposed because the public schema grants CREATE to all users by default. From PostgreSQL 15 onward, the default permission on public is revoked, so exploitation requires an administrator to have explicitly granted CREATE TABLE to the attacker. Refer to the GitLab Issue Discussion for the technical breakdown.

// Conceptual flow (no public PoC published)
// 1. Attacker (low-privileged role) creates a table:
//      CREATE TABLE evil ( "<malicious identifier containing SQL>" int );
// 2. Superuser later invokes the k-anonymity routine on evil.
// 3. The unsanitized identifier is interpolated into dynamic SQL
//    and executed with superuser privileges.

Detection Methods for CVE-2026-9617

Indicators of Compromise

• Tables created by non-administrative roles containing unusual, quoted column identifiers with embedded SQL keywords such as SELECT, CREATE ROLE, or COPY.
• Audit log entries showing k-anonymity or related PostgreSQL Anonymizer function calls executed by superusers against tables owned by low-privileged users.
• Unexpected role grants, new superuser accounts, or extension installations following an Anonymizer function invocation.

Detection Strategies

• Enable pgaudit or log_statement = 'ddl' and review CREATE TABLE statements for column identifiers containing parentheses, quotes, or SQL keywords.
• Query information_schema.columns for column names that do not match a strict identifier allowlist.
• Alert on calls to PostgreSQL Anonymizer functions executed by superuser roles against tables owned by non-administrators.

Monitoring Recommendations

• Forward PostgreSQL audit logs to a centralized SIEM and create rules for anomalous DDL by low-privileged users.
• Track changes to pg_authid and pg_roles to detect privilege escalation outcomes.
• Monitor extension activity in pg_stat_statements for unexpected dynamic SQL originating from anon schema functions.

How to Mitigate CVE-2026-9617

Immediate Actions Required

• Upgrade PostgreSQL Anonymizer to version 3.1.0 or later on all affected database instances.
• Revoke CREATE on the public schema from PUBLIC on PostgreSQL 14 and on upgraded clusters.
• Audit existing roles and remove CREATE TABLE privileges from users that do not require them.
• Review recent invocations of k-anonymity and related Anonymizer functions for signs of exploitation.

Patch Information

The vendor resolved the issue in PostgreSQL Anonymizer 3.1.0. The fix sanitizes column identifiers before they are used in dynamically generated SQL. Details are tracked in the GitLab Issue Discussion.

Workarounds

• Restrict use of PostgreSQL Anonymizer k-anonymity functions to tables owned by trusted administrators until patching completes.
• On PostgreSQL 14, execute REVOKE CREATE ON SCHEMA public FROM PUBLIC; to remove the default table creation right.
• Segregate anonymization workloads into dedicated databases where untrusted users have no DDL privileges.

# Configuration example: harden a PostgreSQL 14 instance against this class of abuse
psql -U postgres -c "REVOKE CREATE ON SCHEMA public FROM PUBLIC;"
psql -U postgres -c "ALTER EXTENSION anon UPDATE TO '3.1.0';"
psql -U postgres -c "SELECT extname, extversion FROM pg_extension WHERE extname = 'anon';"