CVE-2026-105616 PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_setting
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-105616?
CVE-2026-105616 is a medium-severity vulnerability in DALIBO PostgreSQL Anonymizer, published on 28 Oct 2026.
Official description
PostgreSQL restricts acces to the salt and shift via the `SHOW` command for users not member of `pg_read_all_settings`. But they are visible in `pg_db_role_setting` or `pg_roles` if they were set on the database, user or both. PostgreSQL Anonymizer's documentation recommends to use ALTER DATABASE / ALTER ROLE for the salt. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
Weakness: CWE-200
Which versions are affected by CVE-2026-105616?
How do I fix CVE-2026-105616?
No fix has been published for CVE-2026-105616 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-105616 being exploited?
There is no known exploitation of CVE-2026-105616 in the wild and no public exploit code.
Sources
Also known as GHSA-ccch-g55g-pm23.