medium CVSS 4.2 EPSS <0.1%

CVE-2026-14681·PostgreSQL vulnerability

Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.6 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.

Severity
medium
Software
PostgreSQL
Fixed in
18.5
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at <0.1% — in the bottom 1% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

From: 18.0

Until: 18.5

Fixed in: 18.5

How to fix this CVE

PostgreSQL versions 18.0 through 18.5 contain a flaw in GSSAPI message integrity enforcement that allows clients to bypass authentication requirements specified in pg_hba.conf by establishing TLS-only connections when GSSAPI should be mandatory. Upgrade to PostgreSQL 18.6 or later to restore proper authentication policy enforcement and prevent unauthorized connection downgrades.

sudo dnf update postgresql-server postgresql-contrib

Defensia detects this vulnerability

How to check if you are affected

  1. Check installed PostgreSQL version: SELECT version();
  2. Verify GSSAPI configuration in pg_hba.conf: grep -n 'gss' /etc/postgresql/*/main/pg_hba.conf
  3. Review PostgreSQL logs for TLS-only connections when GSSAPI is required: grep -i 'gss\|SSL' /var/log/postgresql/postgresql.log | tail -100
  4. Confirm the fix: sudo -u postgres psql -c "SELECT version();" and verify version is 18.6 or higher

FAQ

What is CVE-2026-14681?

This vulnerability allows PostgreSQL clients to circumvent GSSAPI authentication policies by negotiating TLS-only encryption instead, effectively bypassing mandatory strong authentication rules configured in pg_hba.conf.

Is CVE-2026-14681 being actively exploited?

No, there are no known active exploits or public proof-of-concepts for this vulnerability at this time.

What versions of PostgreSQL are affected by CVE-2026-14681?

PostgreSQL versions 18.0 through 18.5 are affected. Versions 17 and earlier are not vulnerable. PostgreSQL 18.6 and later contain the fix.

How do I check if my server is vulnerable to CVE-2026-14681?

Run sudo -u postgres psql -c "SELECT version();" and check if the version is between 18.0 and 18.5 and if your pg_hba.conf contains GSSAPI authentication requirements.

Does Defensia detect CVE-2026-14681?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-14681 will appear in your dashboard with remediation steps.

Related PostgreSQL CVEs

CVE-2026-14671CVSS 8.8Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14680CVSS 8.8Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14677CVSS 8.8Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14676CVSS 8.8Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.
CVE-2026-15741CVSS 8.8SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-14681. Free for 1 server.

Get started free