CVE-2026-107314

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method the server asks for, including cleartext password authentication. A value without a method in it, such as requireAuth=, (a single comma), is affected the same way. An attacker positioned between the application and its server can ask for cleartext password authentication and receive the database password. A positive list such as requireAuth=scram-sha-256, and a partial exclusion such as requireAuth=!password,!md5, are enforced correctly. The property has no default value, so a deployment that does not set it is not affected. 42.7.14 fixes the problem: such a connection is refused with SQLState 08004, and a value without a method in it is rejected as invalid.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h

Configurations

No configuration.

History

07 Oct 2026, 23:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-07 23:17

Updated : 2026-10-08 20:49

NVD link : CVE-2026-107314

Mitre link : CVE-2026-107314

CVE.ORG link : CVE-2026-107314

JSON object : View

Products Affected

No product.

CWE

CWE-636

Not Failing Securely ('Failing Open')

{"id": "CVE-2026-107314", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107314", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-08T14:45:17.563568Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "affectedData": [{"repo": "https://github.com/pgjdbc/pgjdbc", "vendor": "pgjdbc", "product": "pgjdbc", "versions": [{"status": "affected", "version": "42.7.11", "lessThan": "42.7.14", "versionType": "maven"}], "packageName": "org.postgresql:postgresql", "programFiles": ["pgjdbc/src/main/java/org/postgresql/core/AuthMethod.java"], "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "programRoutines": [{"name": "org.postgresql.core.AuthMethod.parseRequireAuth"}, {"name": "org.postgresql.core.AuthMethod.checkAuth"}]}]}], "published": "2026-10-07T23:17:00.337", "references": [{"url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "description": [{"lang": "en", "value": "CWE-636"}]}], "descriptions": [{"lang": "en", "value": "pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method the server asks for, including cleartext password authentication. A value without a method in it, such as requireAuth=, (a single comma), is affected the same way. An attacker positioned between the application and its server can ask for cleartext password authentication and receive the database password. A positive list such as requireAuth=scram-sha-256, and a partial exclusion such as requireAuth=!password,!md5, are enforced correctly. The property has no default value, so a deployment that does not set it is not affected. 42.7.14 fixes the problem: such a connection is refused with SQLState 08004, and a value without a method in it is rejected as invalid."}], "lastModified": "2026-10-08T20:49:23.240", "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}