CVE-2026-13455: PostgreSQL Anonymizer: Unrestricted function can leak the secret salt
PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hashoutput) pairs to perform an offline brute-force attack and deduce the salt. The problem is resolved in PostgreSQL Anonymizer 3.1.2 and later versions
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQL Anonymizerto a version that resolves this vulnerability.Fixed in 3.1.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13455?
The severity of CVE-2026-13455 is medium with a CVSS score of 4.3.
How do I fix CVE-2026-13455?
To fix CVE-2026-13455, upgrade to PostgreSQL Anonymizer version 3.1.2 or later.
What impact does CVE-2026-13455 have on PostgreSQL users?
CVE-2026-13455 allows unprivileged users to potentially leak the secret salt, compromising data masking.
Is CVE-2026-13455 exploitative in nature?
Yes, CVE-2026-13455 can be exploited to perform an offline brute-force attack on the hashed data.
What software is affected by CVE-2026-13455?
CVE-2026-13455 affects the PostgreSQL Anonymizer software.