CVE-2026-105616

PostgreSQL restricts acces to the salt and shift via the SHOW command for users not member of pg read all settings. But they are visible in pg db role setting or pg roles if they were set on the database, user or both. PostgreSQL Anonymizer's documentation recommends to use ALTER DATABASE / ALTER ROLE for the salt. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.