CVE-2026-105617
Last modified
CVE-2026-105617 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule was added or a role changed. Users using such plans can still see the unmasked data until the end of the session. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule was added or a role changed. Users using such plans can still see the unmasked data until the end of the session. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| DALIBO | PostgreSQL Anonymizer | >= 1, < 3.3.0 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-105617?
How severe is CVE-2026-105617?
How do I fix CVE-2026-105617?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-105611A vulnerability was determined in chillzhuang SpringBlade up…2.7
- CVE-2026-105612PostgreSQL Anonymizer contains a vulnerability that data-mod…3.5
- CVE-2026-105613PostgreSQL Anonymizer's range-based dummy functions dont con…4.7
- CVE-2026-105614PostgreSQL Anonymizer's `anon.image_blur()` function doesn't…4.7
- CVE-2026-105615PostgreSQL's optimized statistics on a table are visible as …3.5
- CVE-2026-105616PostgreSQL restricts acces to the salt and shift via the `SH…5.7
- CVE-2026-105618PostgreSQL Anonymizer's documentation recommends applying ru…5.7
- CVE-2026-105619PostgreSQL Anonymizer doesn't mask data accessed thru a secu…4.8
- CVE-2026-10562An unauthenticated URL redirection vulnerability has been id…5.9
- CVE-2026-105620PostgreSQL Anonymizer doesn't mask data returned by a sub-qu…6.5
- CVE-2026-105621A security flaw has been discovered in jishenghua jshERP up …5.4
- CVE-2026-105626HashiCorp Consul and Consul Enterprise are vulnerable to a d…7.5
Are you affected by CVE-2026-105617?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST