CVE-2026-14681 PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL
Attackers can bypass GSSAPI encryption requirements by negotiating TLS instead, weakening connection security in PostgreSQL.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-14681?
CVE-2026-14681 is a medium-severity vulnerability in Postgresql Postgresql, published on 13 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.6 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.
Weakness: CWE-924
Which versions are affected by CVE-2026-14681?
1 open source package ship an affected version, including postgresql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
postgresql Bitnami | From 17.0.0 | 17.11.0, 18.5.0 |
Products include Postgresql Postgresql.
How do I fix CVE-2026-14681?
Upgrade postgresql to a fixed version for your release line: 17.11.0 or 18.5.0.
Is CVE-2026-14681 being exploited?
There is no known exploitation of CVE-2026-14681 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as ALPINE-CVE-2026-14681, BIT-postgresql-2026-14681, DEBIAN-CVE-2026-14681, ECHO-1690-243f-9082, GHSA-gfpv-wrhp-wwh6, MINI-26rm-x4p3-6pm8 and 2 more.