CVE-2026-14681: PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL
Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pghba.conf rules, via initial direct TLS connection. Despite a pghba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.5 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14681?
CVE-2026-14681 has a medium severity rating of 4.2.
How do I fix CVE-2026-14681?
To fix CVE-2026-14681, ensure the PostgreSQL configuration enforces GSSAPI encryption as required in pg_hba.conf.
What is the impact of CVE-2026-14681?
CVE-2026-14681 allows users to bypass GSSAPI requirements, potentially leading to insecure TLS connections.
Who is affected by CVE-2026-14681?
PostgreSQL users who rely on GSSAPI for secure communication are affected by CVE-2026-14681.
When was CVE-2026-14681 published?
CVE-2026-14681 was published on August 13, 2026.