CVE-2026-14681: Improper Enforcement of Message Integrity During Transmission in a Communication Channel in PostgreSQL
Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.5 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.
AI Analysis
Technical Summary
This vulnerability in PostgreSQL's GSSAPI support allows a user to bypass the intended authentication enforcement defined in pg_hba.conf by negotiating GSSAPI contrary to the rules via an initial direct TLS connection. If the TLS settings are more permissive than the GSSAPI settings, the connection may proceed with TLS encryption alone, which provides lesser protection than GSSAPI. The issue affects PostgreSQL major versions 17 and 18, specifically versions >=17 and <17.11 and >=18 and <18.5. Versions before 17 are not affected.
Potential Impact
The impact is a reduction in the expected security level of authentication and message integrity during connection establishment. An attacker or user may be able to connect using TLS encryption alone even when pg_hba.conf requires GSSAPI, potentially exposing the connection to weaker protection than intended. The CVSS score of 4.2 reflects limited confidentiality and integrity impact with no availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should carefully review their pg_hba.conf and TLS configuration to ensure that authentication and encryption policies are enforced as intended. Monitoring PostgreSQL vendor advisories for updates on this vulnerability is recommended.
CVE-2026-14681: Improper Enforcement of Message Integrity During Transmission in a Communication Channel in PostgreSQL
Description
Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.5 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.
CVSS v3.1
Score 4.2medium
Affected software
pkg:deb/postgresql/postgresqlRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in PostgreSQL's GSSAPI support allows a user to bypass the intended authentication enforcement defined in pg_hba.conf by negotiating GSSAPI contrary to the rules via an initial direct TLS connection. If the TLS settings are more permissive than the GSSAPI settings, the connection may proceed with TLS encryption alone, which provides lesser protection than GSSAPI. The issue affects PostgreSQL major versions 17 and 18, specifically versions >=17 and <17.11 and >=18 and <18.5. Versions before 17 are not affected.
Potential Impact
The impact is a reduction in the expected security level of authentication and message integrity during connection establishment. An attacker or user may be able to connect using TLS encryption alone even when pg_hba.conf requires GSSAPI, potentially exposing the connection to weaker protection than intended. The CVSS score of 4.2 reflects limited confidentiality and integrity impact with no availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should carefully review their pg_hba.conf and TLS configuration to ensure that authentication and encryption policies are enforced as intended. Monitoring PostgreSQL vendor advisories for updates on this vulnerability is recommended.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- PostgreSQL
- Date Reserved
- 2026-07-03T20:28:19.093Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7dc617bf8831d5393e53b0
Added to database: 08/13/2026, 13:26:47 UTC
Last enriched: 08/13/2026, 13:44:11 UTC
Last updated: 08/13/2026, 23:40:59 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.