CVE-2026-14663
Received Received - Intake

Cleartext Storage in PostgreSQL pgcrypto Weak Cipher Handling

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: PostgreSQL

Description
Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key. This in turn loses the modest protection from the Modification Detection Code (MDC). Affected functions are pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, pgp_sym_encrypt_bytea, pgp_sym_decrypt_bytea, pgp_pub_encrypt_bytea, and pgp_pub_decrypt_bytea. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-14663
EUVD
EUVD-2026-57832

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
postgresql postgresql to 18.5 (exc)
postgresql postgresql to 17.11 (exc)
postgresql postgresql to 16.15 (exc)
postgresql postgresql to 15.19 (exc)
postgresql postgresql to 14.24 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-313 The product stores sensitive information in cleartext in a file, or on disk.
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves PostgreSQL's pgcrypto extension when OpenSSL-disabled ciphers are used. It allows cleartext data to be silently encrypted or decrypted, bypassing intended security measures. The system fails to handle disabled ciphers properly, enabling attackers to recover plaintext by observing ciphertext directly. This weakens the Modification Detection Code protection.

Detection Guidance

Check PostgreSQL version with 'psql --version' to confirm if it is below 18.5, 17.11, 16.15, 15.19, or 14.24. Inspect pgcrypto extension usage with 'SELECT * FROM pg_extension WHERE extname = 'pgcrypto';' in psql. Review logs for unusual decryption operations involving pgp_sym_encrypt or pgp_pub_encrypt functions.

Impact Analysis

An attacker could recover sensitive plaintext data by observing ciphertext, even if encryption keys are incorrect. This compromises confidentiality and integrity of encrypted data. Applications accepting encrypted input may process it incorrectly, leading to data leaks or unauthorized access.

Compliance Impact

This vulnerability may violate compliance requirements for data encryption and protection, such as GDPR's encryption mandates or HIPAA's safeguards for protected health information. Failure to protect data could result in regulatory penalties or loss of certification.

Mitigation Strategies

Upgrade PostgreSQL to version 18.5, 17.11, 16.15, 15.19, or 14.24 or later immediately. Disable or audit pgcrypto extension usage if not required. Review and update OpenSSL configurations to ensure only secure ciphers are enabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14663. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart