CVE-2026-14672 PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle
An unauthenticated attacker can determine if a user exists by observing SCRAM iteration counts, provided the user has a non-default configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-14672?
CVE-2026-14672 is a medium-severity vulnerability in Postgresql Postgresql, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations. Within major versions 16-18, minor versions before PostgreSQL 18.6, 17.11, and 16.15 are affected. Versions before PostgreSQL 16 are unaffected.
Weakness: CWE-204
Which versions are affected by CVE-2026-14672?
1 open source package ship an affected version, including postgresql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
postgresql Bitnami | From 16.0.0 | 16.15.0, 17.11.0, 18.5.0 |
Products include Postgresql Postgresql.
How do I fix CVE-2026-14672?
Upgrade postgresql to a fixed version for your release line: 16.15.0, 17.11.0 or 18.5.0.
Is CVE-2026-14672 being exploited?
There is no known exploitation of CVE-2026-14672 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as ALPINE-CVE-2026-14672, AZL-95702, BELL-CVE-2026-14672, BIT-postgresql-2026-14672, DEBIAN-CVE-2026-14672, ECHO-1137-4f23-2f4e and 5 more.