A flaw in the PostgreSQL Anonymizer extension permits the injection of malicious SQL code through a specially crafted column identifier. When the user‑visible function anon.k_anonymity() is invoked, that code is executed with the privileges of the database superuser. As a consequence, a threat actor can elevate their rights to superuser level, gaining full control over the database cluster.

The vulnerability affects deployments of DALIBO’s PostgreSQL Anonymizer that are earlier than version 3.1.0. The risk is heightened when the database is running PostgreSQL 14, or an instance that has been upgraded from PostgreSQL 14 and still allows users to create tables in the public schema. PostgreSQL 15 and later mitigate the issue by revoking the default CREATE privilege on the public schema, but the vulnerability remains exploitable if a user has been explicitly granted that permission. Version 3.1.0 and later contain the fix and are not vulnerable.

The CVSS score of 6.8 indicates a moderate severity, and the EPSS score is not available, suggesting no concrete data on exploitation frequency. The vulnerability is not listed in the CISA KEV catalog. An attacker would need the ability to create a table with a malicious column name, and the ability to call anon.k_anonymity()—the description suggests that this requires superuser privileges or a user subsequently granted those privileges through exploitation. The expected outcome is that arbitrary SQL is executed as superuser, fully compromising the database.