---
id: CVE-2026-56868
aliases:
  - GO-2026-6166
title: GSS authentication completes without mutual proof in github.com/lib/pq
summary: GSS authentication completes without mutual proof in github.com/lib/pq
severity: none
vendor: lib
product: github.com/lib/pq
ecosystem: go
affected:
  - github.com/lib/pq >= 1.6.0
published: '2026-08-18'
updated: '2026-08-18'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-6166'
references:
  - url: 'https://github.com/golang/vulndb/issues/6166'
tags:
  - osv
  - go
ingestedAt: '2026-08-18T19:21:38.988Z'
---

## Overview

github.com/lib/pq does not require a GSSAPI exchange to reach cryptographic completion before accepting AuthenticationOk and ReadyForQuery. After an unauthenticated peer requests GSS authentication, the driver sends its initial GSS token and stores the provider, but it tracks neither whether a continuation occurred nor the provider's done result. The startup loop then accepts AuthenticationOk and completes the connection. The continuation branch also discards provider errors and can proceed after failed mutual authentication.

## Affected packages

- `github.com/lib/pq >= 1.6.0`

## Remediation

Refer to the advisory for the patched release.