CVE-2026-14672·PostgreSQL vulnerability
Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations. Within major versions 16-18, minor versions before PostgreSQL 18.6, 17.11, and 16.15 are affected. Versions before PostgreSQL 16 are unaffected.
- Severity
- medium
- Software
- PostgreSQL
- Fixed in
- 18.5
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.25% — higher than 16% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Affected versions
From: 18.0
Until: 18.5
Fixed in: 18.5
How to fix this CVE
Upgrade PostgreSQL to version 18.6 or later to eliminate the authentication timing side-channel that allows user enumeration. Organizations running PostgreSQL 18.0–18.5 should prioritize this update, particularly if any database users have custom SCRAM iteration counts configured. Apply the update during a planned maintenance window and verify the new version is running before returning to production traffic.
sudo dnf update postgresql-server postgresql-contrib postgresql-libsDefensia detects this vulnerability
How to check if you are affected
- Step 1: Check the PostgreSQL version with: sudo -u postgres psql --version or SELECT version();
- Step 2: Verify SCRAM authentication is enabled by querying: SELECT name, setting FROM pg_settings WHERE name = 'password_encryption';
- Step 3: Review authentication logs for repeated failed login attempts targeting specific usernames: grep 'FATAL' /var/log/postgresql/postgresql*.log | grep -i scram
- Step 4: Confirm the patch was applied by verifying SELECT version(); returns PostgreSQL 18.6 or later, and cross-check with: dpkg -l | grep postgresql or rpm -qa | grep postgresql
FAQ
What is CVE-2026-14672?
This vulnerability is a user enumeration flaw in PostgreSQL's SCRAM authentication mechanism. An attacker can determine whether a username exists on a PostgreSQL server by observing differences in the SCRAM iteration count returned during failed authentication attempts, particularly if the target user has a non-default iteration configuration.
Is CVE-2026-14672 being actively exploited?
No, this vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and no public exploits have been released. However, user enumeration attacks are a common reconnaissance technique, so timely patching remains important.
What versions of PostgreSQL are affected by CVE-2026-14672?
PostgreSQL versions 18.0 through 18.5 are vulnerable. Versions 17.11, 16.15, and all releases prior to version 16 are not affected. The fix is available in PostgreSQL 18.6 and later.
How do I check if my server is vulnerable to CVE-2026-14672?
Run: sudo -u postgres psql -c 'SELECT version();' If the output shows PostgreSQL 18.0–18.5, your installation is vulnerable. Cross-reference the exact minor version and apply the update immediately.
Does Defensia detect CVE-2026-14672?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-14672 will appear in your dashboard with remediation steps.
Related PostgreSQL CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-14672. Free for 1 server.
Get started free