CVE-2026-14681: Improper Enforcement of Message Integrity During Transmission in a Communication Channel in PostgreSQL
CVE-2026-14681 is a vulnerability in PostgreSQL's GSSAPI support where message integrity enforcement during transmission is improper. This allows a user to negotiate GSSAPI authentication contrary to the pg_hba.conf configuration via an initial direct TLS connection. If TLS settings are more permissive than GSSAPI settings, the connection may proceed with weaker protection. The issue affects PostgreSQL major versions 17 and 18, specifically versions before 17.11 and 18.6. Versions before 17 are not affected.
AI Analysis
Technical Summary
This vulnerability involves improper enforcement of message integrity in PostgreSQL's GSSAPI authentication mechanism. An attacker can bypass pg_hba.conf rules that require GSSAPI by initiating a direct TLS connection, causing the connection to use TLS encryption alone if its settings are more permissive. This results in a connection that may have weaker protection than intended. The affected versions are PostgreSQL 17 prior to 17.11 and PostgreSQL 18 prior to 18.6.
Potential Impact
The impact is a potential downgrade in the security of the authentication and communication channel, allowing connections to proceed with TLS encryption alone despite pg_hba.conf rules requiring GSSAPI. This could lead to reduced message integrity and confidentiality protections during transmission. The CVSS score is 4.2 (medium severity), indicating limited impact with low confidentiality and integrity loss and no availability impact.
Mitigation Recommendations
No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the official PostgreSQL vendor advisory for current remediation guidance. Until a fix is confirmed, administrators should review their pg_hba.conf and TLS settings to ensure consistent enforcement of authentication requirements and consider restricting direct TLS connections if possible.
CVE-2026-14681: Improper Enforcement of Message Integrity During Transmission in a Communication Channel in PostgreSQL
Description
CVE-2026-14681 is a vulnerability in PostgreSQL's GSSAPI support where message integrity enforcement during transmission is improper. This allows a user to negotiate GSSAPI authentication contrary to the pg_hba.conf configuration via an initial direct TLS connection. If TLS settings are more permissive than GSSAPI settings, the connection may proceed with weaker protection. The issue affects PostgreSQL major versions 17 and 18, specifically versions before 17.11 and 18.6. Versions before 17 are not affected.
CVSS v3.1
Score 4.2medium
Affected software
PostgreSQL
pkg:deb/postgresql/postgresqlRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves improper enforcement of message integrity in PostgreSQL's GSSAPI authentication mechanism. An attacker can bypass pg_hba.conf rules that require GSSAPI by initiating a direct TLS connection, causing the connection to use TLS encryption alone if its settings are more permissive. This results in a connection that may have weaker protection than intended. The affected versions are PostgreSQL 17 prior to 17.11 and PostgreSQL 18 prior to 18.6.
Potential Impact
The impact is a potential downgrade in the security of the authentication and communication channel, allowing connections to proceed with TLS encryption alone despite pg_hba.conf rules requiring GSSAPI. This could lead to reduced message integrity and confidentiality protections during transmission. The CVSS score is 4.2 (medium severity), indicating limited impact with low confidentiality and integrity loss and no availability impact.
Mitigation Recommendations
No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the official PostgreSQL vendor advisory for current remediation guidance. Until a fix is confirmed, administrators should review their pg_hba.conf and TLS settings to ensure consistent enforcement of authentication requirements and consider restricting direct TLS connections if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- PostgreSQL
- Date Reserved
- 2026-07-03T20:28:19.093Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a7dc617bf8831d5393e53b0
Added to database: 08/13/2026, 13:26:47 UTC
Last enriched: 09/13/2026, 13:04:31 UTC
Last updated: 09/28/2026, 01:47:41 UTC
Views: 47
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.