CVE-2026-14681

A flaw was found in PostgreSQL. Improper enforcement of message integrity in PostgreSQL's GSSAPI (Generic Security Service Application Program Interface) support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules by initiating a direct TLS (Transport Layer Security) connection. This enables the connection to proceed with only TLS encryption, even when GSSAPI is required. If the TLS settings are less secure than the GSSAPI settings, the connection may operate with reduced protection, potentially leading to information disclosure or integrity compromise.

This Moderate severity flaw in PostgreSQL's GSSAPI support allows a remote, authenticated attacker with low privileges to bypass pg_hba.conf rules requiring GSSAPI encryption. By initiating a direct TLS connection, the attacker can force a less secure connection if TLS settings are more permissive, potentially compromising data integrity and confidentiality. The high attack complexity reduces the overall risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate the risk associated with this flaw, restrict network access to the PostgreSQL server to only trusted hosts and networks. This reduces the attack surface and limits the ability of unauthorized users to establish connections that could bypass GSSAPI enforcement via direct TLS. Warning: Restricting network access may impact legitimate client connections if not configured carefully. Changes to firewall rules or network configurations may require a service reload or restart to take effect.