CVE-2026-14681
Received Received - Intake

PostgreSQL GSSAPI Message Integrity Bypass via TLS

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: PostgreSQL

Description
Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.5 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-14681
EUVD
EUVD-2026-57845

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
postgresql postgresql From 17.0 (inc) to 17.11 (exc)
postgresql postgresql From 17 (inc) to 18.5 (exc)
postgresql postgresql From 18 (inc) to 18.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-924 The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper enforcement of GSSAPI encryption in PostgreSQL when used with SSL. It allows a user to bypass pg_hba.conf rules by negotiating GSSAPI through an initial direct TLS connection, even if the configuration requires GSSAPI. The connection may then proceed using only TLS encryption, which could be less restrictive than intended.

Detection Guidance

Check PostgreSQL logs for connections that bypass pg_hba.conf rules despite GSSAPI requirements. Monitor for TLS-only connections where GSSAPI was expected. Review pg_hba.conf configurations for inconsistencies between TLS and GSSAPI settings.

Impact Analysis

This vulnerability could allow unauthorized access or data exposure if an attacker exploits it to bypass intended security controls. The connection might use weaker encryption than configured, increasing the risk of data interception or manipulation.

Compliance Impact

This vulnerability may lead to non-compliance with data protection regulations like GDPR or HIPAA by allowing unauthorized access or weaker encryption than required. Organizations using affected PostgreSQL versions must apply patches to maintain compliance.

Mitigation Strategies

Upgrade PostgreSQL to versions 18.5, 17.11, or later. Ensure pg_hba.conf rules strictly enforce GSSAPI where required. Disable TLS-only connections if they conflict with security policies. Apply patches from PostgreSQL 18.6, 17.11, 16.15, 15.19, 14.24, or 19 Beta 3.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14681. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart