---
id: CVE-2026-14681
title: >-
  Improper enforcement of message integrity in PostgreSQL GSSAPI support allows
  a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct
  TLS connection
summary: >-
  Improper enforcement of message integrity in PostgreSQL GSSAPI support allows
  a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct
  TLS connection.  Despite a pg_hba.conf that appears to require GSSAPI, the
  connect…
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-924
vendor: postgresql
product: postgresql
affected:
  - 'postgresql >= 17.0, < 17.11'
  - 'postgresql >= 18.0, < 18.5'
patched:
  - postgresql 18.5
published: '2026-08-13'
updated: '2026-08-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-14681'
references:
  - url: 'https://www.postgresql.org/support/security/CVE-2026-14681/'
    label: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
tags:
  - nvd
epss: 0.00066
epssPercentile: 0.00015
ingestedAt: '2026-08-29T23:43:53.542Z'
---

## Overview

Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection.  Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone.  If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection.  Within major versions 17-18, minor versions before PostgreSQL 18.6 and 17.11 are affected.  Versions before PostgreSQL 17 are unaffected.

## Affected

- `postgresql >= 17.0, < 17.11`
- `postgresql >= 18.0, < 18.5`

## Remediation

Upgrade past the affected range:

- `postgresql 18.5`