Read the docs
TI-2026-69330 Aliases CVE-2026-107314

pgjdbc does not enforce requireAuth when it excludes every method

Priority LOW 26CWE-636Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 7 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, or when it has no method in it. The driver fails open (CWE-636) and accepts any method the server requests, including cleartext password authentication. An attacker positioned between the application and its server can request cleartext password authentication and receive the database password. Deployments that do not set requireAuth are not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method the server asks for, including cleartext password authentication. A value without a method in it, such as requireAuth=, (a single comma), is affected the same way. An attacker positioned between the application and its server can ask for cleartext password authentication and receive the database password. A positive list such as requireAuth=scram-sha-256, and a partial exclusion such as requireAuth=!password,!md5, are enforced correctly. The property has no default value, so a deployment that does not set it is not affected. 42.7.14 fixes the problem: such a connection is refused with SQLState 08004, and a value without a method in it is rejected as invalid.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00345 28th percentileScored 2026-11-07
Fix Partial pgjdbc (pgjdbc): 42.7.14Red Hat: 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PostgreSQLpgjdbc42.7.11 to before 42.7.1442.7.14Patch availableCNA
  • pgjdbc VendorPostgreSQL Affected 42.7.11 to before 42.7.14 Fixed in 42.7.14 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:*——PostgreSQL
  • cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:* Versions — — ·PostgreSQL

Remediation

Upgrade pgjdbc to 42.7.14, which refuses such connections with SQLState 08004 and rejects a requireAuth value without a method. Red Hat has no fix plan available for Red Hat AMQ Broker 7, Red Hat Build of Keycloak, Red Hat OpenShift Dev Spaces, Red Hat Satellite 6, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3 and Red Hat build of Quarkus.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA pgjdbc (pgjdbc) Fixed in 42.7.14

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Broker 7AffectedNo fix yet: Fix deferred
Red Hat Build of KeycloakAffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix yet: Fix deferred
Red Hat Satellite 6AffectedNo fix yet: Fix deferred
Red Hat build of Apicurio Registry 3AffectedNo fix yet: Fix deferred
Red Hat build of Debezium 3AffectedNo fix yet: Fix deferred
Red Hat build of QuarkusAffectedNo fix yet
Not affected: 6 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat Hardened Images
  • Red Hat OpenStack Platform 13 (Queens)

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-107314
  2. 2026-10-08 CISA SSVC decision points changed
  3. 2026-10-08 Priority changed: MEDIUM → LOW
  4. 2026-10-09 Affected versions changed · Red Hat
  5. 2026-10-09 CVSS score added · Red Hat
  6. 2026-10-16 Affected versions changed · Red Hat

References

Advisory 1

  • TI-2024-01491 pgjdbc SQL Injection via line comment generation CVSS 3.1CRITICAL 10.0
  • TI-2019-06651 In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and… CVSS 3.0HIGH 7.2
  • TI-2017-05187 Improper authentication in postgresql CVSS 3.0CRITICAL 9.8
  • TI-2022-06097 Unchecked Class Instantiation when providing Plugin Classes CVSS 3.1CRITICAL 9.8
  • TI-2022-13237 SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc CVSS 3.1HIGH 8.0
  • TI-2020-15711 SQL injection in postgresql CVSS 3.1HIGH 8.8
See all 228 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences