CVE-2026-14663

A flaw was found in PostgreSQL pgcrypto. When using disabled ciphers, a user can recover cleartext data by observing faulty ciphertext. This issue arises because the application may accept encrypted data as input, leading to successful decryption even with an incorrect key. Consequently, the protection offered by the Modification Detection Code (MDC) is lost, resulting in information disclosure.

This is a Moderate impact flaw in PostgreSQL's pgcrypto module where disabled ciphers can lead to information disclosure. An attacker could recover cleartext data by observing faulty ciphertext, as the application may accept encrypted input and decrypt it even with an incorrect key, bypassing the Modification Detection Code. This vulnerability primarily affects instances utilizing the pgcrypto module for encryption, potentially exposing sensitive data if specific OpenSSL configurations disable certain ciphers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, administrators should avoid using pgcrypto encryption and decryption operations with ciphers that are disabled by the system's OpenSSL configuration or local security policies. Organizations should proactively review their OpenSSL cipher policies to ensure required cryptographic algorithms are fully supported, or transition to robust, enabled algorithms within pgcrypto. Additionally, applications should treat all encrypted input as untrusted and independently validate data