PostgreSQL JDBC Driver CVE-2026-107314

Exploitation requires BOTH a specific client misconfiguration and a network position. The pgjdbc connection property 'requireAuth' must be set to a value that excludes every one of the six known methods (e.g., requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none) or to a value containing no method at all (e.g., requireAuth=, a single comma); in that state the driver fails open and accepts any method including cleartext password. Limiting factors that sharply reduce real-world exposure: the property has NO default, so deployments that never set requireAuth are not affected; positive lists (e.g., requireAuth=scram-sha-256) and partial exclusions (e.g., requireAuth=!password,!md5) are enforced correctly and are safe; and the attacker must already hold an active man-in-the-middle position between the application and the PostgreSQL server to request and capture the cleartext password. Only driver versions 42.7.11 through 42.7.13 are affected; 42.7.14 refuses the connection (SQLState 08004).

This is a medium-severity, confidentiality-only fail-open flaw (CWE-636) whose real-world risk is meaningfully lower than the raw CVSS 5.9 might suggest. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N correctly reflects the key constraints: although the attack is network-based and needs no attacker authentication (PR:N), it carries high attack complexity (AC:H) because it requires an active man-in-the-middle position between the application and its PostgreSQL server AND a specific client misconfiguration. Impact is limited to confidentiality (C:H / I:N / A:N) - the leaked item is the database password, which is serious but not integrity or availability loss directly. No EPSS probability, KEV listing, or POC was supplied in the intelligence, so the exploitation signal is: no public exploit identified at time of analysis, and no evidence of active exploitation. The dominant risk-limiting factor is the narrow precondition: the flaw only triggers when requireAuth is set to a value that excludes all six known methods (a full negative list) or to an empty value such as a single comma - and the property has no default, so the large majority of deployments that never set requireAuth are not affected at all. Net: a real but conditional and non-widespread issue, better treated as a configuration-hardening fix than an emergency.

An attacker who can intercept traffic between a Java application and its PostgreSQL server (e.g., on a shared network segment or via ARP/DNS spoofing) targets an app configured with requireAuth set to exclude all six auth methods or to an empty value. Because the driver fails open and accepts whatever the server requests, the attacker impersonates the server and asks for cleartext password authentication, and the driver sends the database password in the clear. No public exploit code was identified in the provided intelligence.