CVE-2026-13455: PostgreSQL Anonymizer Salt Extraction via Hash Function Abuse

Technical summary

CVE-2026-13455 affects the PostgreSQL Anonymizer extension by Dalibo and stems from insufficient protection of the hashing mechanism (CWE-328: Weak Cryptography). The vulnerability allows unprivileged masked users to call the anon.hash() function repeatedly without rate limiting or access controls, accumulating (seed, hash_output) pairs. An attacker can then perform an offline brute-force attack against the collected pairs to deduce the salt, which is the cryptographic secret used to strengthen hash outputs. This breaks the confidentiality guarantee of masked data in anonymized schemas. The fix enforces stricter access controls and protects the salt derivation in PostgreSQL Anonymizer 3.1.2 and later.

Business impact

Organizations using PostgreSQL Anonymizer for data masking in test or development environments face a risk to data confidentiality. If an unprivileged database user can access masked columns and the hashing function, they can eventually recover the salt and reverse-engineer plaintext from masked values—defeating the purpose of anonymization. This is particularly concerning in regulated industries (healthcare, finance, PII-heavy sectors) where masked test data is essential for compliance. The exposure is contained to users with database access, but the threat is real for insider threats or compromised application accounts with read privileges.

Affected systems

PostgreSQL Anonymizer versions prior to 3.1.2 are affected. The vulnerability applies to any PostgreSQL installation where the Anonymizer extension is deployed and has unprivileged users or applications with SELECT access to masked columns. The issue manifests when the anon.hash() function is available to non-administrative users—a common configuration in development and testing environments.

Exploitability

Exploitability is straightforward for an attacker with database login credentials and SELECT access to masked columns. No special tools or advanced techniques are required—just repeated queries to anon.hash() with different inputs. The attack is offline and asynchronous, so it leaves minimal trace. The CVSS score of 4.3 (MEDIUM) reflects the low attack complexity and the requirement for prior authentication; the impact is limited to confidentiality of masked data, not system availability or integrity. This is not yet a KEV entry and does not appear to be exploited in the wild, but the attack is low-effort for anyone with legitimate database access.

Remediation

Upgrade PostgreSQL Anonymizer to version 3.1.2 or later. Before upgrading, audit your PostgreSQL instances to identify which users and roles have access to masked columns and the anon.hash() function. Restrict function calls to administrative users only if your workflow permits. As an interim measure, consider revoking EXECUTE privileges on anon.hash() for non-administrative roles and re-granting them only when necessary. Test the upgrade in a non-production environment first, as it may affect existing anonymization policies.

Patch guidance

Contact Dalibo or consult the PostgreSQL Anonymizer project documentation for version 3.1.2 release notes and upgrade procedures. Verify compatibility with your PostgreSQL version (typically PostgreSQL 11 or later for current Anonymizer releases). Plan the upgrade as a maintenance task, since extension upgrades may require a brief restart of affected services or at minimum a schema refresh. Update your deployment automation and package repositories to pull the patched version.

Detection guidance

Monitor PostgreSQL logs for high-frequency calls to anon.hash() from non-administrative roles, particularly when multiple distinct seed values are being tested. Query the pg_stat_statements view (if enabled) to identify unusual patterns of hashing function invocations. Implement database activity monitoring (DAM) or audit logging on the Anonymizer extension if available. Alert on repeated hash function calls from a single user within a short time window. Check that only authorized roles have EXECUTE privileges on the anon.hash() function by querying the information_schema.role_routine_grants table.

Why prioritize this

Although the CVSS score is MEDIUM (4.3), organizations heavily dependent on anonymized test data should prioritize this patch before insider threats or compromised accounts can be leveraged. The attack is trivial once access is gained, and the business impact in regulated environments can be severe. Patch this within 30–60 days, sooner if your test/dev environments handle sensitive real-world PII.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible vulnerability that requires authentication (PR:L), no user interaction, and causes low-impact confidentiality loss. Attack complexity is low and scope is unchanged. The score does not fully capture the business risk in compliance-sensitive sectors, where undermining data masking controls is a serious concern, but it correctly identifies that this is not a critical remote-code-execution issue. The absence from the KEV catalog suggests it is not yet weaponized or broadly exploited.

Frequently asked questions