CVE-2026-11945
Description
SQL injection in PostgreSQL Anonymizer's import functions allows arbitrary SQL execution when a superuser imports attacker-controlled JSON, fixed in 3.1.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
SQL injection in PostgreSQL Anonymizer's import functions allows arbitrary SQL execution when a superuser imports attacker-controlled JSON, fixed in 3.1.1.
Vulnerability
SQL injection vulnerability exists in the anon.import_roles_rules(jsonb, text) and anon.import_database_rules(jsonb, text) functions of PostgreSQL Anonymizer (prior to version 3.1.1). The functions construct SECURITY LABEL statements by interpolating untrusted label values into a dollar-quoted SQL literal with a stable delimiter ($label_test$) [1]. An attacker can craft a JSON document containing a label that closes the dollar quote and appends arbitrary SQL commands [1].
Exploitation
The attacker must supply a malicious JSON document to one of the affected import functions. The functions are SECURITY INVOKER, meaning they execute with the privileges of the caller [1]. Therefore, direct privilege escalation from a low-privileged user is not automatic; however, if a superuser, extension owner, or automated migration job calls the function with attacker-controlled JSON, the injected SQL runs with superuser privileges [1]. The attacker does not need authentication beyond being able to store the JSON and have it imported.
Impact
Successful exploitation allows arbitrary SQL execution with the privileges of the user invoking the import function. Because these functions are typically called by superusers during database setup or rule import, an attacker can achieve full superuser control over the PostgreSQL instance, leading to data disclosure, data modification, or further compromise [1].
Mitigation
The vulnerability is fixed in PostgreSQL Anonymizer version 3.1.1 [1]. If upgrade is not possible, avoid calling import_roles_rules() or import_database_rules() with untrusted JSON input, and ensure only trusted superusers have access to these functions. The issue is not listed on the CISA Known Exploited Vulnerabilities catalog as per available references.
AI Insight generated on Jun 11, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: <3.1.1
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"Missing sanitization of label strings in SECURITY LABEL statement construction allows SQL injection via dollar-quote delimiter injection."
Attack vector
An attacker crafts a JSON document containing a malicious key-value pair where the value includes a closing dollar-quote delimiter followed by arbitrary SQL statements [ref_id=1]. If a superuser (or any privileged session) calls `anon.import_roles_rules()` or `anon.import_database_rules()` with this JSON, the injected SQL executes with the caller's privileges [ref_id=1]. The functions are SECURITY INVOKER, so a low-privilege caller cannot directly escalate to superuser, but the attack succeeds when a superuser, extension owner, migration job, or admin automation processes the attacker-controlled JSON [ref_id=1].
Affected code
The vulnerability resides in the functions `anon.import_roles_rules(jsonb, text)` and `anon.import_database_rules(jsonb, text)` [ref_id=1]. These functions build `SECURITY LABEL` statements by interpolating untrusted label strings into a dollar-quoted SQL literal using a stable delimiter `$label_test$` [ref_id=1]. The label value is inserted raw into the format string, allowing an attacker to close the dollar quote and inject arbitrary SQL [ref_id=1].
What the fix does
The advisory does not include a patch diff, but states the problem is resolved in PostgreSQL Anonymizer version 3.1.1 and later [ref_id=1]. The fix would need to properly escape or parameterize the label value before interpolating it into the `SECURITY LABEL` statement, preventing the injected dollar-quote delimiter from closing the SQL literal [ref_id=1]. No further remediation details are provided in the available reference.
Preconditions
- inputThe attacker must supply a JSON document that will be passed to anon.import_roles_rules() or anon.import_database_rules()
- authThe function must be invoked by a superuser, extension owner, migration job, or other privileged session
- inputThe attacker's JSON value must contain a closing dollar-quote delimiter ($label_test$) followed by arbitrary SQL
Reproduction
Create a role and call `anon.import_roles_rules()` with a crafted JSON object where the value closes the dollar-quote and appends arbitrary SQL:
``` CREATE ROLE mdi_runtime_role; SELECT anon.import_roles_rules( jsonb_build_object( 'mdi_runtime_role', 'MASKED $label_test$; CREATE TABLE public.mdi_runtime_sqli_marker(proof int); INSERT INTO public.mdi_runtime_sqli_marker VALUES (1337); --' ), 'anon' ); SELECT proof FROM public.mdi_runtime_sqli_marker; ```
This returns 1337, confirming SQL injection [ref_id=1].
Generated on Jun 11, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.