6.5

CVE-2026-14663: postgresql Cleartext Storage in a File or on Disk

CVSS: 6.5v3.1MediumModified
AliasesALPINE-CVE-2026-14663UBUNTU-CVE-2026-14663DEBIAN-CVE-2026-14663
Published 13-08-2026Last modified 29-08-2026
Open JSON

Vulnerability summary

CVE-2026-14663 is a medium (CVSS 6.5) Cleartext Storage in a File or on Disk vulnerability in postgresql. EPSS estimates a 0.10% chance of exploitation in the next 30 days, higher than 0.6% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.10%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 33 · Related 30
MGASA-2026-0347OPENSUSE-SU-2026:11552-1OPENSUSE-SU-2026:11553-1OPENSUSE-SU-2026:11554-1OPENSUSE-SU-2026:11555-1OPENSUSE-SU-2026:11565-1

Timeline

  1. 13-08-2026
    PublishedVulnerability first disclosed.
  2. 29-08-2026
    Last modifiedVulnerability information updated.

Description

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key. This in turn loses the modest protection from the Modification Detection Code (MDC). Affected functions are pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, pgp_sym_encrypt_bytea, pgp_sym_decrypt_bytea, pgp_pub_encrypt_bytea, and pgp_pub_decrypt_bytea. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.10%

Chance of exploitation in the next 30 days

Percentile

1%

Versus all other CVEs

30-day change

0.00 pp

From 0.10% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.10%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu7 products
  • postgresql-10All versions (No fix recorded)
  • postgresql-12All versions (No fix recorded)
  • postgresql-14< 14.24-0ubuntu0.22.04.1
  • postgresql-16< 16.15-0ubuntu0.24.04.1
  • postgresql-18< 18.6-0ubuntu0.26.04.1
Alpine3 products
  • postgresql16< 16.15-r0
  • postgresql17< 17.11-r0
  • postgresql18< 18.5-r0
Debian3 products
  • postgresql-15< 15.19-0+deb12u1
  • postgresql-17< 17.11-0+deb13u1
  • postgresql-18< 18.6-1
Postgresql1 product
  • postgresql≥ 14.0, < 14.24 | ≥ 15.0, < 15.19 | ≥ 16.0, < 16.15 | ≥ 17.0, < 17.11 | ≥ 18.0, < 18.5

4 vendors · 14 products

References

8 links