CVE-2026-110183 in PostgreSQL Anonymizer
Summary
by MITRE • 10/28/2026
PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence. Statistics pertaining to the original data remain visible in pg_stats until an ANALYZE operation is performed on the table, either manually or by autovacuum. This issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within PostgreSQL Anonymizer stems from a discrepancy between data masking operations and database statistics management mechanisms. Specifically, when static masking is applied to columns containing sensitive information, the underlying table rows are updated with masked values as intended. However, the pg_stats system catalog, which stores metadata such as column histograms, distinct value counts, and null fractions used by the query planner for optimization, does not automatically reflect these changes immediately upon execution of the anonymization function. This lag in synchronization means that statistical information derived from the original unmasked data persists within the database's internal structures until a manual ANALYZE command is executed or triggered via autovacuum processes.
From an operational perspective, this delay creates a window of opportunity for potential information leakage through side-channel attacks or indirect inference methods. Although the actual row-level data presented to standard queries may appear masked depending on how the anonymizer integrates with PostgreSQL's security model, the statistical metadata remains accessible to users who possess sufficient privileges to query pg_stats. An attacker with read access to these statistics could potentially reconstruct patterns of the original dataset by analyzing value distributions, frequency histograms, and cardinality estimates. This undermines the primary objective of data anonymization, which is to prevent re-identification or inference of sensitive attributes even when direct row-level access might be restricted or monitored.
This issue aligns with CWE-209: Generation of Error Message Containing Sensitive Information, as it involves the exposure of internal state that reveals details about protected data. Furthermore, it relates to CWE-613: Insufficient Session Expiration if one considers the persistence of sensitive metadata beyond the intended scope of masking operations. In terms of MITRE ATT&CK framework techniques, this vulnerability facilitates Data Obfuscation evasion and potentially contributes to Discovery activities where an adversary gathers information about data structures and distributions without directly accessing raw rows. The persistence of original statistics effectively allows for statistical inference attacks that can compromise privacy guarantees provided by the anonymization tool.
To mitigate this risk, it is imperative to ensure that PostgreSQL Anonymizer is updated to version 3.3.0 or later, where the synchronization between masking operations and statistics updates has been corrected. For environments running older versions, administrators should implement a procedural safeguard by manually triggering an ANALYZE operation on affected tables immediately after performing static masking tasks. This ensures that pg_stats accurately reflects the masked state of the data, thereby eliminating the window during which original statistical patterns remain visible. Additionally, organizations should review their database access controls to restrict visibility into pg_stats for users who do not require such metadata for performance tuning purposes, adding a layer of defense-in-depth against potential inference attacks derived from statistical anomalies.