VulnSocial

CVE-2026-19633Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the malicious code can run with elevated privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later versions

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 3d ago at 1 mentions (2026-09-06); latest day: 1
  • 4 total mentions across 4 days

Deep dive

Activity timeline4 mentions / 4d
00111Mentions · 2026-09-06: 1Mentions · 2026-09-07: 1Mentions · 2026-09-08: 1Mentions · 2026-09-09: 1Patch / Workaround · 2026-09-07: 1Patch / Workaround · 2026-09-09: 1Technical Details · 2026-09-06: 1Technical Details · 2026-09-07: 1Technical Details · 2026-09-09: 109-0609-0709-0809-09
Signal classification2 categories
Disclosure
250.0%
Patch
250.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-061
Disclosure1
2026-09-071
Patch1
2026-09-081
Disclosure1
2026-09-091
Patch1
Full discourse4 posts
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH SEVERITY: CVE-2026-19633 (CVSS 8.8) PostgreSQL Anonymizer vulnerability allows unprivileged users to execute arbitrary code via operators/domain casts. Affects masking mechanisms. ✅ Fixed in v3.1.4+ ⚠️ Patch immediately #CVE #Vulnerability #PatchNow https://t.co/8EWN9eX9ja

    Post summary

    The tweet announces a high‑severity PostgreSQL Anonymizer vulnerability (CVE‑2026‑19633) that has been fixed in v3.1.4+ and urges immediate patching.

    0000030
    129 followersView on X
  • CERT-PY@CERTpy
    Disclosure

    ⚠️ Vulnerabilidad en Productos PostgreSQL ❗ CVE-2026-19633 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-la-extension-postgresql-anonymizer/ https://t.co/eFbQDTEEpY

    Post summary

    The post announces CVE‑2026‑19633 affecting a PostgreSQL extension and directs readers to external sources for details.

    00000240
    6.7K followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨High - PostgreSQL Anonymizer Privilege Escalation to Code Execution (CVE-2026-19633) PostgreSQL Anonymizer’s masking evaluation can execute untrusted expressions embedded in operators, domain casts, or view subqueries created by masked/unprivileged users. When these objects are evaluated by the extension’s masking mechanisms, they run with elevated privileges, enabling arbitrary code execution. Installations not using the anonymizer masking features are not impacted. 👉Affected: PostgreSQL Anonymizer < 3.1.4 | Upgrade to 3.1.4

    Post summary

    A privilege escalation that allows untrusted code execution in PostgreSQL Anonymizer v < 3.1.4 was disclosed; users are advised to upgrade to version 3.1.4 to fix the issue.

    0000070
    303 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-19633 PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries … https://www.cve.org/CVERecord?id=CVE-2026-19633

    Post summary

    The text announces a CVE in PostgreSQL Anonymizer that permits arbitrary code execution by unprivileged masked users through operators, domain casts, or view subqueries, but offers no PoC, exploit, or patch details.

    00000741
    58.1K followersView on X

Explore more

Back to dashboard