CVE-2026-105616

PostgreSQL restricts acces to the salt and shift via the `SHOW` command for users not member of `pg_read_all_settings`. But they are visible in `pg_db_role_setting` or `pg_roles` if they were set on the database, user or both. PostgreSQL Anonymizer's documentation recommends to use ALTER DATABASE / ALTER ROLE for the salt. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

• CWE-200

• https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/694

Published

Oct 28, 2026

Last Modified

Oct 29, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105610A vulnerability was found in chillzhuang SpringBlade up to 5…4.7
• CVE-2026-105611A vulnerability was determined in chillzhuang SpringBlade up…2.7
• CVE-2026-105612PostgreSQL Anonymizer contains a vulnerability that data-mod…3.5
• CVE-2026-105613PostgreSQL Anonymizer's range-based dummy functions dont con…4.7
• CVE-2026-105614PostgreSQL Anonymizer's `anon.image_blur()` function doesn't…4.7
• CVE-2026-105615PostgreSQL's optimized statistics on a table are visible as …3.5
• CVE-2026-105617PostgreSQL Anonymizer doesn't invalidate plans prepared afte…6.5
• CVE-2026-105618PostgreSQL Anonymizer's documentation recommends applying ru…5.7
• CVE-2026-105619PostgreSQL Anonymizer doesn't mask data accessed thru a secu…4.8
• CVE-2026-10562An unauthenticated URL redirection vulnerability has been id…5.9
• CVE-2026-105620PostgreSQL Anonymizer doesn't mask data returned by a sub-qu…6.5
• CVE-2026-105621A security flaw has been discovered in jishenghua jshERP up …5.4