CVE-2026-11945

Description

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a JSON document and placing malicious code inside a particular key-value pair. If a superuser calls the import_database_rules() or import_roles_rules() functions, the malicious code is executed with superuser privileges. The problem is resolved in PostgreSQL Anonymizer 3.1.1 and further versions

PUBLISHED Reserved 2026-06-10 | Published 2026-06-11 | Updated 2026-06-12 | Assigner PostgreSQL

Problem types

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Credits

The PostgreSQL Anonymizer project thanks user Mehmet Ince for reporting this problem.

References

gitlab.com/dalibo/postgresql_anonymizer/-/issues/643

cve.org (CVE-2026-11945)

nvd.nist.gov (CVE-2026-11945)

Download JSON