CVE-2026-14681: postgresql
Vulnerability summary
CVE-2026-14681 is a medium (CVSS 4.2) vulnerability in postgresql. EPSS estimates a 0.07% chance of exploitation in the next 30 days, higher than 0% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 13 · Related 12Timeline
- 13-08-2026PublishedVulnerability first disclosed.
- 29-08-2026Last modifiedVulnerability information updated.
Description
Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.6 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated4.2MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated4.2MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated4.2MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- NVDNIST4.2MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.07%
Chance of exploitation in the next 30 days
Percentile
0%
Versus all other CVEs
30-day change
0.00 pp
From 0.07% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine2 products
- postgresql17< 17.11-r0
- postgresql18< 18.5-r0
Debian2 products
- postgresql-17< 17.11-0+deb13u1
- postgresql-18< 18.6-1
Ubuntu2 products
- postgresql-18< 18.6-0ubuntu0.26.04.1
- postgresql-9.3All versions (No fix recorded)
Postgresql1 product
- postgresql≥ 17.0, < 17.11 | ≥ 18.0, < 18.5
4 vendors · 7 products
