{"id":"CVE-2026-97469","aliases":["EUVD-2026-87134","GHSA-g8c9-3556-8wq9"],"status":"published","title":"PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink","description":"PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hash_output) pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed inside the sub-select. The problem is resolved in PostgreSQL Anonymizer 3.2.3 and later versions","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00118,"percentile":0.01756,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-328"],"published":"2026-09-25T15:40:45Z","modified":"2026-10-28T02:31:03Z","products":[{"vendor":"dalibo","product":"postgresql anonymizer"}],"references":[{"url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/685","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97469","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g8c9-3556-8wq9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97469.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-97469","title":"PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink","description":"PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hash_output) pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed inside the sub-select. The problem is resolved in PostgreSQL Anonymizer 3.2.3 and later versions","status":"published","published":"2026-09-25T15:40:45.207Z","modified":"2026-09-25T16:06:42.1Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-328"],"updated_at":"2026-11-02T13:44:07.200604Z"}],"euvd":[{"id":"EUVD-2026-87134","description":"PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hash_output) pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed inside the sub-select. The problem is resolved in PostgreSQL Anonymizer 3.2.3 and later versions","status":"published","published":"2026-09-25T15:40:45Z","modified":"2026-09-25T16:06:42Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:55.413842Z"}],"ghsa":[{"id":"GHSA-g8c9-3556-8wq9","title":"PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to...","description":"PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hash_output) pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed inside the sub-select. The problem is resolved in PostgreSQL Anonymizer 3.2.3 and later versions","status":"published","published":"2026-09-25T18:31:24Z","modified":"2026-09-25T18:31:29Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-328"],"updated_at":"2026-11-02T15:12:27.190195Z"}],"nvd":[{"id":"CVE-2026-97469","description":"PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hash_output) pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed inside the sub-select. The problem is resolved in PostgreSQL Anonymizer 3.2.3 and later versions","status":"published","published":"2026-09-25T16:17:30.713Z","modified":"2026-09-29T21:27:41.13Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-328"],"updated_at":"2026-11-02T14:12:51.721923Z"}],"osv":[{"id":"CVE-2026-97469","title":"PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink","description":"PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hash_output) pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed inside the sub-select. The problem is resolved in PostgreSQL Anonymizer 3.2.3 and later versions","status":"published","published":"2026-09-25T15:40:45.207Z","modified":"2026-10-28T02:31:03.678901989Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-328"],"updated_at":"2026-11-02T15:45:21.262447Z"}]}}