Libpgjava: pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all… (CVE-2026-107314)

The PostgreSQL JDBC Driver (pgjdbc) versions 42.7.11 through 42.7.13 have a vulnerability related to the requireAuth connection property. If this property excludes all six authentication methods known to the driver (e.g., requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none) or is set to an empty or invalid value (such as requireAuth=, or a single comma), the driver enforces no authentication restrictions. Consequently, the driver accepts any authentication method the server requests, including cleartext password authentication. This behavior can allow an attacker positioned between the application and the database server to capture the database password. Deployments that do not set the requireAuth property are not affected. The vulnerability is resolved in version 42.7.14, which refuses such connections with SQLState 08004 and rejects invalid requireAuth values.

An attacker with network position between the application and the PostgreSQL server can exploit this vulnerability to force cleartext password authentication, thereby capturing the database password. This compromises the confidentiality of database credentials but does not affect data integrity or availability directly. The vulnerability requires specific misconfiguration of the requireAuth property to exclude all authentication methods or be set to an invalid value.

Upgrade to pgjdbc version 42.7.14 or later, where the vulnerability is fixed by rejecting connections with invalid or overly restrictive requireAuth settings. If upgrading is not immediately possible, ensure that the requireAuth property is either unset or configured to include at least one valid authentication method (e.g., requireAuth=scram-sha-256). Avoid configurations that exclude all known authentication methods or use empty/invalid values. No other mitigation is indicated by the vendor advisory.