CVE-2026-14681

PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL

State: Published
Severity: 4.2 Medium
Published: Aug 13, 2026
Updated: Aug 29, 2026
Reserved: Jul 3, 2026

Description

Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.6 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.

Scores

CVSS	Score	Vector	Source
3.1	4.2 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N	PostgreSQL

Weaknesses

CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Affected Products

Product	Versions
PostgreSQLn/a	18 to before 18.6Affected 17 to before 17.11Affected

References

https://www.postgresql.org/support/security/CVE-2026-14681/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.