CVE-2026-107314

Received Received - Intake

Authentication Bypass in pgjdbc JDBC Driver

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: PostgreSQL

Description

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method the server asks for, including cleartext password authentication. A value without a method in it, such as requireAuth=, (a single comma), is affected the same way. An attacker positioned between the application and its server can ask for cleartext password authentication and receive the database password. A positive list such as requireAuth=scram-sha-256, and a partial exclusion such as requireAuth=!password,!md5, are enforced correctly. The property has no default value, so a deployment that does not set it is not affected. 42.7.14 fixes the problem: such a connection is refused with SQLState 08004, and a value without a method in it is rejected as invalid.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-07

Generated

2026-10-08

AI Q&A

2026-10-08

EPSS Evaluated

N/A

NVD

CVE-2026-107314

Affected Vendors & Products

Vendor	Product	Version / Range
pgjdbc	pgjdbc	42.7.11

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-636	When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

Attack-Flow Graph

Executive Summary

This vulnerability affects pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 to 42.7.13. When the requireAuth connection property excludes all six known authentication methods (e.g., requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none), the driver accepts any method the server requests, including cleartext password authentication. This allows an attacker between the application and server to request and receive the database password.

Detection Guidance

Check if pgjdbc versions 42.7.11 to 42.7.13 are used with requireAuth set to exclude all methods or an empty value. Inspect connection strings for requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none or requireAuth=. Use logging to detect cleartext password authentication attempts.

Impact Analysis

An attacker could intercept and steal database passwords, leading to unauthorized access to sensitive data. This could result in data breaches, loss of confidential information, or further attacks on connected systems.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating regulations like GDPR (data protection) and HIPAA (health information privacy). Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Upgrade pgjdbc to version 42.7.14 or later. Ensure requireAuth is set to a positive list of allowed methods, e.g., requireAuth=scram-sha-256. Avoid using requireAuth with all methods excluded or empty values.

Hi! I’m here to help you understand CVE-2026-107314. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70