PostgreSQL EUVD-2026-57838

Exploitation requires that the target PostgreSQL account has been configured with a non-default scram_iterations value - accounts using the server-wide default iteration count cannot be distinguished from nonexistent users and are not vulnerable. The attacker needs unauthenticated network access to the PostgreSQL port (default 5432) and the ability to initiate a SCRAM handshake, which is the standard pre-authentication step. No credentials, session, or special privileges are required. The limiting factor is the non-default scram_iterations prerequisite: installations that have never customized per-account iteration counts are not exploitable through this path, even if unpatched.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N reflects network-accessible, unauthenticated exploitation with low confidentiality impact, yielding a moderate score of 5.3 - accurately calibrated for an information-disclosure-only finding. The real-world risk is meaningfully lower than even this score implies for most deployments, because exploitation requires that target accounts have a non-default scram_iterations configuration, which is not standard in typical PostgreSQL setups; the majority of production instances using default iteration counts are not vulnerable to user enumeration via this channel. EPSS data was not provided, and the vulnerability is not listed in CISA KEV, consistent with the absence of known active exploitation. No public exploit or proof-of-concept code has been identified at time of analysis. The practical impact is limited to username reconnaissance - no authentication bypass, no data access, and no integrity or availability impact - meaning even a mid-sized municipal IT team in bytom operating a default PostgreSQL deployment is unlikely to face meaningful exposure unless they have explicitly tuned scram_iterations per-account. The finding is a genuine hardening concern but is not a priority remediation item absent contextual factors such as high-value user account names being sensitive information.

An attacker with network access to the PostgreSQL listener sends SCRAM authentication initiation messages for a list of candidate usernames without completing the handshake. By recording the scram_iterations value returned in each server first-message, the attacker identifies accounts with non-default iteration counts as confirmed existing users, building a valid username list for subsequent credential-stuffing or targeted attacks. No exploit code is publicly known, and the technique requires only a standard SCRAM-aware PostgreSQL client library.