{"id":"CVE-2026-56868","aliases":["GO-2026-6166"],"title":"GSS authentication completes without mutual proof in github.com/lib/pq","summary":"GSS authentication completes without mutual proof in github.com/lib/pq","severity":"none","vendor":"lib","product":"github.com/lib/pq","ecosystem":"go","affected":["github.com/lib/pq >= 1.6.0"],"published":"2026-08-18","updated":"2026-08-18","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-6166","references":[{"url":"https://github.com/golang/vulndb/issues/6166"}],"tags":["osv","go"],"ingestedAt":"2026-08-18T19:21:38.988Z","slug":"CVE-2026-56868","body":"## Overview\n\ngithub.com/lib/pq does not require a GSSAPI exchange to reach cryptographic completion before accepting AuthenticationOk and ReadyForQuery. After an unauthenticated peer requests GSS authentication, the driver sends its initial GSS token and stores the provider, but it tracks neither whether a continuation occurred nor the provider's done result. The startup loop then accepts AuthenticationOk and completes the connection. The continuation branch also discards provider errors and can proceed after failed mutual authentication.\n\n## Affected packages\n\n- `github.com/lib/pq >= 1.6.0`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}