---
id: CVE-2026-19634
title: >-
  PostgreSQL Anonymizer contains a SQL injection vulnerability in two import
  functions
summary: >-
  PostgreSQL Anonymizer contains a SQL injection vulnerability in two import
  functions. A user can create a malicious JSON document containing specially
  crafted object names. If a superuser subsequently calls
  anon.import_database_rules() o…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-89
vendor: DALIBO
product: PostgreSQL Anonymizer
affected:
  - postgresql_anonymizer >= 1 < 3.1.4
published: '2026-09-06'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T05:17:20.103'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-19634'
references:
  - url: 'https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/665'
    label: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19634.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-19634'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-19634'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-08T10:28:06.558688Z'
epss: 0.00185
epssPercentile: 0.08325
ingestedAt: '2026-09-07T05:05:30.806Z'
---

## Overview

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.import_database_rules() or anon.import_roles_rules(), the malicious code is executed with superuser privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · updated 2026-09-07 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19634.json)