BIT-postgresql-2026-14681
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/postgresql/BIT-postgresql-2026-14681.json
- JSON Data
- https://api.osv.dev/v1/vulns/BIT-postgresql-2026-14681
- Aliases
-
- CVE-2026-14681
- Published
- 2026-08-19T08:52:46.290Z
- Modified
- 2026-08-31T08:00:07.394439984Z
- Summary
- PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL
- Details
-
Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pghba.conf rules, via initial direct TLS connection. Despite a pghba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.6 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.
- Database specific
{ "severity": "Medium", "cpes": [ "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*" ] }- References
Affected packages
Bitnami / postgresql
Package
- Name
- postgresql
- Purl
- pkg:bitnami/postgresql
Severity
- 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator