CVE-2026-107314: medium-severity vulnerability in pgjdbc
pgjdbc does not enforce requireAuth when the value excludes every authentication method
Published
10Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.9
exploitation probability
—
observed exploitation
nono source reports it
pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method the server asks for, including cleartext password authentication. A value without a method in it, such as requireAuth=, (a single comma), is affected the same way. An attacker positioned between the application and its server can ask for cleartext password authentication and receive the database password. A positive list such as requireAuth=scram-sha-256, and a partial exclusion such as requireAuth=!password,!md5, are enforced correctly. The property has no default value, so a deployment that does not set it is not affected. 42.7.14 fixes the problem: such a connection is refused with SQLState 08004, and a value without a method in it is rejected as invalid.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
pgjdbc · pgjdbcRelated CVEs — pgjdbc
In the same product, most dangerous first.
CVE-2024-1597CRITICALpgjdbc SQL Injection via line comment generationEPSS 4.8%CVE-2026-42198HIGHpgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoSEPSS 4.1%CVE-2022-31197HIGHSQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbcEPSS 2.2%CVE-2022-41946MEDIUMTemporaryFolder on unix-like systems does not limit access to created files in pgjdbcEPSS 0.5%CVE-2025-49146HIGHpgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require ConfigurationEPSS 0.5%CVE-2026-54291HIGHSilent channel-binding authentication downgrade via unsupported certificate algorithmsEPSS 0.2%