Skip to main content

PostgreSQL EUVDEUVD-2026-57845

| CVE-2026-14681 MEDIUM
Improper Enforcement of Message Integrity During Transmission (CWE-924)
2026-08-13 f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 GHSA-gfpv-wrhp-wwh6
Information Disclosure PostgreSQL Microsoft Red Hat
4.2
CVSS 3.1 · Vendor: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
Share

Severity by source

Vendor (f86ef6dc-4d3a-42ad-8f28-e6d5547a5007) PRIMARY
4.2 MEDIUM
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
vuln.today AI
4.2 MEDIUM

Network vector confirmed; AC:H reflects mandatory TLS/GSS config mismatch; PR:L required for valid credentials; C:L/I:L reflect authentication downgrade with no availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
4.2 MEDIUM
qualitative

Primary rating from Vendor (f86ef6dc-4d3a-42ad-8f28-e6d5547a5007).

CVSS VectorVendor: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
Patch available
Aug 13, 2026 - 14:02 EUVD
Analysis Generated
Aug 13, 2026 - 13:46 vuln.today
CVE Published
Aug 13, 2026 - 13:17 cve.org
MEDIUM 4.2

DescriptionCVE.org

Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.5 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.

AnalysisAI

PostgreSQL's GSSAPI authentication enforcement can be bypassed in versions 17.x and 18.x, allowing an authenticated database user to establish a connection protected only by TLS despite pg_hba.conf explicitly requiring GSSAPI. The bypass is achieved by initiating a direct TLS connection rather than a GSSAPI handshake, causing the server to accept the weaker protection profile when TLS settings are more permissive than GSS settings. No public exploit code and no CISA KEV listing have been identified at time of analysis; the EPSS score was not provided in source data.

Technical ContextAI

CWE-924 (Improper Enforcement of Message Integrity During Transmission in a Communication Channel) describes the root cause: the server fails to enforce the negotiated security level when an alternative channel is established first. PostgreSQL's GSSAPI support implements Kerberos-based mutual authentication and message integrity via the Generic Security Services API, typically used in Microsoft Active Directory and MIT Kerberos enterprise environments - consistent with the 'Microsoft' tag in source intelligence. The pg_hba.conf file is the server-side access control configuration that specifies required authentication methods per client host and database. The flaw lies in the handshake ordering: when a client opens a direct TLS connection before GSSAPI negotiation, the server's integrity enforcement logic fails to reject the downgraded path, accepting TLS-only semantics even though pg_hba.conf demands GSSAPI. Affected CPE covers PostgreSQL major versions 17 and 18 only; versions prior to PostgreSQL 17 are confirmed unaffected per the advisory.

RemediationAI

Upgrade to PostgreSQL 18.5 or PostgreSQL 17.11, which are the vendor-released patched versions explicitly named in the advisory. The official advisory is available at https://www.postgresql.org/support/security/CVE-2026-14681/. As a compensating control where immediate upgrade is not feasible, administrators can align TLS settings to be no more permissive than GSSAPI settings in pg_hba.conf, removing the configuration mismatch that enables the downgrade path; note that this may restrict connectivity for clients that currently rely on TLS-only connections. Alternatively, restricting network access to the PostgreSQL port (default 5432) to only trusted hosts that are confirmed to initiate proper GSSAPI handshakes reduces exposure. Neither workaround fully resolves the underlying enforcement flaw and both carry operational trade-offs in heterogeneous client environments.

More in PostgreSQL

View all
CVE-2025-1094 HIGH POC
8.1 Feb 13

PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
CVE-2024-55964 CRITICAL POC
9.8 Mar 26

An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
CVE-2013-1899 MEDIUM POC
6.5 Apr 04

Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
CVE-2026-20253 CRITICAL POC
9.8 Jun 10

Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
CVE-2026-9586 CRITICAL POC
9.3 Jul 17

Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
CVE-2017-7546 CRITICAL
9.8 Aug 16

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
CVE-2015-1352 MEDIUM POC
5.0 Mar 30

The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
CVE-2024-10553 CRITICAL POC
9.8 Mar 20

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
CVE-2019-9193 HIGH POC
7.2 Apr 01

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
CVE-2026-40887 CRITICAL POC
9.1 Apr 14

Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the

CVE-2022-24760 CRITICAL POC
10.0 Mar 12

Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
CVE-2025-56157 CRITICAL POC
9.8 Dec 18

Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al

Same weakness CWE-924 – Improper Enforcement of Message Integrity During Transmission

View all
CVE-2018-7295 HIGH POC
8.1
CVE-2026-39827 MEDIUM POC
6.5
CVE-2021-21390 MEDIUM POC
5.9
CVE-2023-43297 MEDIUM POC
5.4
CVE-2024-39229 MEDIUM POC
5.3
CVE-2026-13584 HIGH
7.1
CVE-2024-44730 CRITICAL
9.1
CVE-2020-5869 CRITICAL
9.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

EUVD-2026-57845 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy