CVE-2026-11945 MEDIUM

CVE-2026-11945: PostgreSQL Anonymizer: SQL injection in the rules import functions

Vendor Dalibo
Product PostgreSQL Anonymizer
Weakness CWE-89 · SQLi
Published June 11, 2026
Last update June 12, 2026

CVSS base score

6.4/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a JSON document and placing malicious code inside a particular key-value pair. If a superuser calls the import_database_rules() or import_roles_rules() functions, the malicious code is executed with superuser privileges. The problem is resolved in PostgreSQL Anonymizer 3.1.1 and further versions

Key dates

02Disclosure timeline

June 11, 2026 CVE published
June 12, 2026 Record updated