Vulnerability · Published Aug 13, 2026 · Assigned by PostgreSQL
CVE-2026-14681PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL
Medium 4.2
In plain English
A medium-severity security flaw in PostgreSQL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.6 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.21 | postgresql15 | 15.19-r0 | ALPINE-CVE-2026-14681 |
| Alpine:v3.22 | postgresql15 | 15.19-r0 | ALPINE-CVE-2026-14681 |
| Alpine:v3.21 | postgresql17 | 17.11-r0 | ALPINE-CVE-2026-14681 |
| Alpine:v3.22 | postgresql17 | 17.11-r0 | ALPINE-CVE-2026-14681 |
| Alpine:v3.23 | postgresql17 | 17.11-r0 | ALPINE-CVE-2026-14681 |
| Alpine:v3.24 | postgresql17 | 17.11-r0 | ALPINE-CVE-2026-14681 |
| Alpine:v3.23 | postgresql18 | 18.5-r0 | ALPINE-CVE-2026-14681 |
| Alpine:v3.24 | postgresql18 | 18.5-r0 | ALPINE-CVE-2026-14681 |
| Debian:13 | postgresql-17 | 17.11-0+deb13u1 | DEBIAN-CVE-2026-14681 |
| Debian:14 | postgresql-18 | 18.6-1 | DEBIAN-CVE-2026-14681 |
| Ubuntu:22.04:LTS | postgresql-14 | 14.24-0ubuntu0.22.04.1 | USN-8653-1 |
| Ubuntu:24.04:LTS | postgresql-16 | 16.15-0ubuntu0.24.04.1 | USN-8653-1 |
| Ubuntu:26.04:LTS | postgresql-18 | 18.6-0ubuntu0.26.04.1 | USN-8653-1 |
| Ubuntu:26.04:LTS | postgresql-18 | 18.6-0ubuntu0.26.04.1 | UBUNTU-CVE-2026-14681 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | PostgreSQL | 18 – before 18.617 – before 17.11 |
Weakness: CWE-924 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N