CVE-2026-13455

MEDIUM

PostgreSQL Anonymizer: Unrestricted function can leak the secret salt

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-13455. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-13455, a vulnerability in PostgreSQL Anonymizer allowing unprivileged masked users to collect (seed, hash_output) pairs via the anon.hash() function for offline brute-force attacks. The code lacks actual exploit implementation and only includes placeholder logic.

Description

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hash_output) pairs to perform an offline brute-force attack and deduce the salt. The problem is resolved in PostgreSQL Anonymizer 3.1.2 and later versions

Exploits (1)

github STUB 1 stars
by HermesNA-1 · pythonpoc
https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-13455_postgresql_anonymizer_contains.py

This repository contains an auto-generated stub module for CVE-2026-13455, a vulnerability in PostgreSQL Anonymizer allowing unprivileged masked users to collect (seed, hash_output) pairs via the anon.hash() function for offline brute-force attacks. The code lacks actual exploit implementation and only includes placeholder logic.

Classification
Stub 98%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Theoretical
Target: PostgreSQL Anonymizer
Auth required
Prerequisites: Unprivileged masked user access to PostgreSQL Anonymizer · Ability to call anon.hash() function repeatedly
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 4.3
EPSS 0.0012
EPSS Percentile 2.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-328
Status published
Products (2)
DALIBO/PostgreSQL Anonymizer 1 - 3.1.2
dalibo/postgresql_anonymizer < 3.1.2
Published Jun 30, 2026
Tracked Since Jun 30, 2026