CVE-2026-107314

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107314", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-10-07T16:53:39.434Z", "datePublished": "2026-10-07T23:03:01.500Z", "dateUpdated": "2026-10-08T14:47:31.949Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-10-07T23:03:01.500Z"}, "title": "pgjdbc does not enforce requireAuth when the value excludes every authentication method", "descriptions": [{"lang": "en", "value": "pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method the server asks for, including cleartext password authentication. A value without a method in it, such as requireAuth=, (a single comma), is affected the same way. An attacker positioned between the application and its server can ask for cleartext password authentication and receive the database password. A positive list such as requireAuth=scram-sha-256, and a partial exclusion such as requireAuth=!password,!md5, are enforced correctly. The property has no default value, so a deployment that does not set it is not affected. 42.7.14 fixes the problem: such a connection is refused with SQLState 08004, and a value without a method in it is rejected as invalid."}], "affected": [{"vendor": "pgjdbc", "product": "pgjdbc", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.postgresql:postgresql", "repo": "https://github.com/pgjdbc/pgjdbc", "programFiles": ["pgjdbc/src/main/java/org/postgresql/core/AuthMethod.java"], "programRoutines": [{"name": "org.postgresql.core.AuthMethod.parseRequireAuth"}, {"name": "org.postgresql.core.AuthMethod.checkAuth"}], "defaultStatus": "unaffected", "versions": [{"version": "42.7.11", "lessThan": "42.7.14", "status": "affected", "versionType": "maven"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-636", "description": "CWE-636 Not Failing Securely ('Failing Open')"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Upgrade to pgjdbc 42.7.14 or later, and replace a requireAuth value that excludes every method or names none with a positive list of the methods the server uses."}], "workarounds": [{"lang": "en", "value": "Replace the requireAuth value with a positive list of the methods the server uses, for example requireAuth=scram-sha-256; a positive list is enforced correctly on every affected version. A deployment that uses SCRAM over TLS can also set channelBinding=require, which refuses every authentication request other than SCRAM. Verifying the server certificate with sslmode=verify-full against a trusted CA prevents an attacker from presenting a substitute server."}], "credits": [{"lang": "en", "type": "reporter", "value": "Daniel Coles"}], "references": [{"url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h", "tags": ["vendor-advisory"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-08T14:45:17.563568Z", "id": "CVE-2026-107314", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T14:47:31.949Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-107314", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-08T14:45:17.563568Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T14:47:13.036Z"}}], "cna": {"title": "pgjdbc does not enforce requireAuth when the value excludes every authentication method", "credits": [{"lang": "en", "type": "reporter", "value": "Daniel Coles"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://github.com/pgjdbc/pgjdbc", "vendor": "pgjdbc", "product": "pgjdbc", "versions": [{"status": "affected", "version": "42.7.11", "lessThan": "42.7.14", "versionType": "maven"}], "packageName": "org.postgresql:postgresql", "programFiles": ["pgjdbc/src/main/java/org/postgresql/core/AuthMethod.java"], "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "programRoutines": [{"name": "org.postgresql.core.AuthMethod.parseRequireAuth"}, {"name": "org.postgresql.core.AuthMethod.checkAuth"}]}], "solutions": [{"lang": "en", "value": "Upgrade to pgjdbc 42.7.14 or later, and replace a requireAuth value that excludes every method or names none with a positive list of the methods the server uses."}], "references": [{"url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "Replace the requireAuth value with a positive list of the methods the server uses, for example requireAuth=scram-sha-256; a positive list is enforced correctly on every affected version. A deployment that uses SCRAM over TLS can also set channelBinding=require, which refuses every authentication request other than SCRAM. Verifying the server certificate with sslmode=verify-full against a trusted CA prevents an attacker from presenting a substitute server."}], "descriptions": [{"lang": "en", "value": "pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method the server asks for, including cleartext password authentication. A value without a method in it, such as requireAuth=, (a single comma), is affected the same way. An attacker positioned between the application and its server can ask for cleartext password authentication and receive the database password. A positive list such as requireAuth=scram-sha-256, and a partial exclusion such as requireAuth=!password,!md5, are enforced correctly. The property has no default value, so a deployment that does not set it is not affected. 42.7.14 fixes the problem: such a connection is refused with SQLState 08004, and a value without a method in it is rejected as invalid."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-636", "description": "CWE-636 Not Failing Securely ('Failing Open')"}]}], "providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-10-07T23:03:01.500Z"}}}, "cveMetadata": {"cveId": "CVE-2026-107314", "state": "PUBLISHED", "dateUpdated": "2026-10-08T14:47:31.949Z", "dateReserved": "2026-10-07T16:53:39.434Z", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "datePublished": "2026-10-07T23:03:01.500Z", "assignerShortName": "PostgreSQL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.postgresql:postgresql", "product": "pgjdbc", "programFiles": ["pgjdbc/src/main/java/org/postgresql/core/AuthMethod.java"], "programRoutines": [{"name": "org.postgresql.core.AuthMethod.parseRequireAuth"}, {"name": "org.postgresql.core.AuthMethod.checkAuth"}], "repo": "https://github.com/pgjdbc/pgjdbc", "vendor": "pgjdbc", "versions": [{"lessThan": "42.7.14", "status": "affected", "version": "42.7.11", "versionType": "maven"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method the server asks for, including cleartext password authentication. A value without a method in it, such as requireAuth=, (a single comma), is affected the same way. An attacker positioned between the application and its server can ask for cleartext password authentication and receive the database password. A positive list such as requireAuth=scram-sha-256, and a partial exclusion such as requireAuth=!password,!md5, are enforced correctly. The property has no default value, so a deployment that does not set it is not affected. 42.7.14 fixes the problem: such a connection is refused with SQLState 08004, and a value without a method in it is rejected as invalid."}], "id": "CVE-2026-107314", "lastModified": "2026-10-08T20:49:23.240", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107314", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-08T14:45:17.563568Z", "version": "2.0.3"}}]}, "published": "2026-10-07T23:17:00.337", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-636"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"bugzilla": {"description": "org.postgresql/postgresql: PostgreSQL JDBC Driver: Information disclosure via requireAuth restriction bypass", "id": "2547743", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547743"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-319", "details": ["A flaw was found in the PostgreSQL JDBC Driver (pgjdbc), which may lead to information disclosure. When the requireAuth connection property is configured to exclude all supported authentication mechanisms or lacks a valid method, the driver fails to enforce authentication restrictions and accepts any method requested by the server. A man-in-the-middle attacker positioned between the application and the database server can exploit this flaw by requesting cleartext password authentication to intercept database credentials."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, ensure database connection configurations do not use empty values or negation lists that exclude all supported authentication mechanisms in the `requireAuth` property. Instead, configure an explicit allowlist specifying only approved authentication methods (such as `requireAuth=scram-sha-256`) or omit the property entirely if default driver behavior is acceptable.\nAdditionally, protect connection traffic against man-in-the-middle interception by configuring TLS/SSL with full certificate validation on the JDBC connection string (for example, setting `sslmode=verify-full`).\nCaveat: Ensure the PostgreSQL server is configured to support the chosen authentication method and SSL requirements before altering client connection parameters. Modifying connection properties in application configuration files requires restarting the affected application service."}, "name": "CVE-2026-107314", "package_state": [{"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Fix deferred", "package_name": "postgresql", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Fix deferred", "package_name": "postgresql", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:debezium:3", "fix_state": "Fix deferred", "package_name": "postgresql", "product_name": "Red Hat build of Debezium 3"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Fix deferred", "package_name": "postgresql", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Fix deferred", "package_name": "rhbk/keycloak-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Not affected", "package_name": "postgresql", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "postgresql-jdbc", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "javapackages-tools:201801/maven-assembly-plugin", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "mariadb:10.3/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "mariadb-devel:10.3/mariadb", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "postgresql-jdbc", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "postgresql", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "mariadb10.11", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/openvsx-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/server-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Not affected", "package_name": "mariadb", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "candlepin", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-07T23:03:01Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-107314\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107314\nhttps://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h"], "statement": "This vulnerability is evaluated as a Moderate severity flaw rather than Important because successful exploitation requires both an uncommon configuration and a man-in-the-middle network position. By default, the `requireAuth` property is unset in standard deployments, leaving applications secure in standard configurations. The failure to enforce authentication restrictions only manifests when administrators explicitly configure `requireAuth` to negate all known authentication mechanisms or supply invalid syntax. Furthermore, capturing database credentials necessitates an active adversary situated to intercept and manipulate client-to-server database network traffic.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[42.7.11,42.7.14)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "pgjdbc", "source": "cna", "vendor": "pgjdbc"}, "product": "pgjdbc", "vendor": "pgjdbc"}], "created": "2026-10-08T00:30:04.512099+00:00", "updated": "2026-10-09T02:30:19.371772+00:00", "vendors": ["pgjdbc", "pgjdbc$PRODUCT$pgjdbc"], "weaknesses": ["CWE-319", "CWE-636"]}