The vulnerability in PostgreSQL involves improper enforcement of message integrity in the GSSAPI authentication mechanism when combined with SSL/TLS. Specifically, a user can bypass pg_hba.conf rules that require GSSAPI by initiating a direct TLS connection first. This can result in the connection using TLS encryption alone, which may be less restrictive than the GSSAPI settings, thus weakening the intended security controls. The issue affects major versions 17 and 18, specifically versions >=17.0 and <17.11, and >=18.0 and <18.6. Versions prior to 17 are unaffected. The vulnerability is tracked as CVE-2026-14681 and is classified under CWE-924 (Improper Enforcement of Message Integrity).

The impact is a reduction in the expected security level of PostgreSQL connections that are configured to require GSSAPI authentication. Due to improper enforcement, connections may fall back to TLS encryption alone, which may be less secure depending on the TLS configuration. This could allow an attacker to bypass intended authentication restrictions and potentially weaken the confidentiality and integrity guarantees of the connection. However, no known exploits in the wild have been reported.

A patch is available for this vulnerability. Users should upgrade PostgreSQL to versions 17.11 or later and 18.6 or later to ensure proper enforcement of GSSAPI authentication when used with SSL/TLS. Until patched, administrators should review their pg_hba.conf and TLS configurations to minimize risk, but the definitive mitigation is to apply the official fix.