CVE-2026-14681

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 17.0 through 17.10 PostgreSQL versions 18.0 through 18.4

Description Improper enforcement of message integrity in GSSAPI support allows a user to negotiate GSSAPI in a manner that contradicts pg hba.conf rules during an initial direct TLS connection. This can result in a connection exchanging data using only TLS encryption, even when pg hba.conf is configured to require GSSAPI. If TLS settings are more permissive than GSS settings, the connection may proceed with a lower level of protection.

Recommendations Update PostgreSQL versions 17.x to 17.11. Update PostgreSQL versions 18.x to 18.5.