Loading vulnerability…
PostgreSQL GSSAPI Encryption Policy Bypass over Direct TLS
CVE-2026-14681 is an improper message-integrity enforcement vulnerability in PostgreSQL GSSAPI support when combined with SSL/TLS. By initiating a direct TLS connection, a user can negotiate GSSAPI contrary to host-based authentication rules. A connection that appears to require GSSAPI protection may instead exchange data using TLS encryption alone. If TLS settings are more permissive than the GSSAPI settings, the session can continue with weaker protection than intended. PostgreSQL 17 before 17.11 and PostgreSQL 18 before 18.6 are affected; versions before PostgreSQL 17 are unaffected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses intended GSSAPI connection-protection requirements, potentially causing limited confidentiality and integrity loss when the permitted TLS configuration provides weaker protection. Under suitable network and TLS conditions, this may facilitate a machine-in-the-middle attack and disclosure of sensitive information. Traffic remains TLS-encrypted; the vulnerability does not inherently expose plaintext or provide arbitrary code execution. No availability impact is identified.
If you can’t patch tonight, do this now.
Until patched, review host-based access rules and TLS configuration to prevent TLS-only sessions from satisfying access paths intended to require GSSAPI protection. Ensure TLS authentication and connection-protection requirements are at least as restrictive as the intended GSSAPI policy. Restrict PostgreSQL network access to trusted clients and networks. These measures reduce exposure but do not replace the update.
Patch, then assume compromise.
Upgrade PostgreSQL 17 to version 17.11 or later, or PostgreSQL 18 to version 18.6 or later. PostgreSQL 18.5 was not shipped because of a regression and should not be used as the remediation target. Alternatively, install the applicable distribution security update containing the fix, then restart PostgreSQL so the updated server code takes effect.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.