Read the docs
TI-2026-39191 Aliases CVE-2026-54291GHSA-j92g-9f8w-j867

Silent channel-binding authentication downgrade via unsupported certificate algorithms

Priority LOW 35CWE-636Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 4 fixed, 7 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00236 14th percentileScored 2026-11-07
Fix Partial pgjdbc (pgjdbc): 42.7.12org.postgresql:postgresql (Maven): 42.7.12Red Hat: 4 advisoriesRed Hat: 4 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PostgreSQLpgjdbc42.7.4 to before 42.7.1242.7.12Patch availableCNA
—org.postgresql:postgresql (Maven)42.7.4 to before 42.7.1242.7.12Patch availableGHSA-j92g-9f8w-j867
  • pgjdbc VendorPostgreSQL Affected 42.7.4 to before 42.7.12 Fixed in 42.7.12 Patch available CNA
  • org.postgresql:postgresql (Maven) Vendor— Affected 42.7.4 to before 42.7.12 Fixed in 42.7.12 Patch available GHSA-j92g-9f8w-j867

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:*42.7.4 to before 42.7.12VulnerablePostgreSQL
  • cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* Versions 42.7.4 to before 42.7.12 Vulnerable ·PostgreSQL

Remediation

  • Fix · CNA pgjdbc (pgjdbc) Fixed in 42.7.12
  • Fix · GHSA-j92g-9f8w-j867 org.postgresql:postgresql (Maven) Fixed in 42.7.12 Advisory →

Red Hat 4 advisories

  • RHSA-2026:56523 Released 2026-08-18 · Red Hat rating Critical
    Red Hat build of Keycloak 26.6.6 Security Update
    • Red Hat build of Keycloak 26.6.6
  • RHSA-2026:56520 Released 2026-08-18 · Red Hat rating Critical
    Red Hat build of Keycloak 26.4.15 Security Update
    • Red Hat build of Keycloak 26.4.15
  • RHSA-2026:53643 Released 2026-08-13 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.5 release and security update
    • Red Hat build of Quarkus 3.27.5
Show 1 more Red Hat advisories
  • RHSA-2026:51653 Released 2026-08-13 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.3 release and security update
    • Red Hat build of Quarkus 3.33.3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 4AffectedNo fix planned: Will not fix
Red Hat AMQ Broker 7AffectedNo fix planned: Will not fix
Red Hat Build of KeycloakAffectedNo fix yet
Red Hat Data Grid 8AffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix yet: Fix deferred
Red Hat build of Apicurio Registry 3AffectedNo fix planned: Will not fix
Red Hat build of Debezium 3AffectedNo fix planned: Will not fix
Red Hat build of Keycloak 26.4.15Fixed RHSA-2026:56520
Red Hat build of Keycloak 26.6.6Fixed RHSA-2026:56523
Red Hat build of Quarkus 3.27.5Fixed RHSA-2026:53643
Red Hat build of Quarkus 3.33.3Fixed RHSA-2026:51653
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54291
  2. 2026-10-03 Alias added: GHSA-j92g-9f8w-j867
  3. 2026-10-23 Fix available: RHSA-2026:56520 · Red Hat
  4. 2026-10-23 Fix available: RHSA-2026:56523 · Red Hat
  5. 2026-10-23 Fix available: Red Hat build of Keycloak 26.4.15, Red Hat build of Keycloak 26.6.6 · Red Hat

References

Patch 2

Advisory 1

Other 2

  • TI-2024-01491 pgjdbc SQL Injection via line comment generation CVSS 3.1CRITICAL 10.0
  • TI-2022-06097 Unchecked Class Instantiation when providing Plugin Classes CVSS 3.1CRITICAL 9.8
  • TI-2022-13237 SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc CVSS 3.1HIGH 8.0
  • TI-2022-09860 In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call… CVSS 3.1CRITICAL 9.8
  • TI-2026-30519 pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS CVSS 3.1HIGH 7.5
  • TI-2025-31226 pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration CVSS 3.1HIGH 8.2
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences