CVE-2026-11945: PostgreSQL Anonymizer: SQL injection in the rules import functions
PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a JSON document and placing malicious code inside a particular key-value pair. If a superuser calls the importdatabaserules() or importrolesrules() functions, the malicious code is executed with superuser privileges. The problem is resolved in PostgreSQL Anonymizer 3.1.1 and further versions
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQL Anonymizerto a version that resolves this vulnerability.Fixed in 3.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11945?
The severity of CVE-2026-11945 is rated as medium with a score of 6.4.
How do I fix CVE-2026-11945?
To fix CVE-2026-11945, ensure that the import_database_rules() and import_roles_rules() functions are not called by untrusted users and sanitize all JSON inputs.
What types of attacks does CVE-2026-11945 enable?
CVE-2026-11945 enables SQL injection attacks that can lead to the elevation of user privileges to superuser status.
Which software is affected by CVE-2026-11945?
CVE-2026-11945 affects the PostgreSQL Anonymizer software.
What are the potential consequences of CVE-2026-11945?
The potential consequences of CVE-2026-11945 include unauthorized access and control over the PostgreSQL database through superuser privileges.