CVE-2026-14672 in PostgreSQL
Summary
by MITRE • 08/13/2026
Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations. Within major versions 16-18, minor versions before PostgreSQL 18.5, 17.11, and 16.15 are affected. Versions before PostgreSQL 16 are unaffected.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a subtle but significant information disclosure flaw in PostgreSQL's SCRAM authentication mechanism that enables unauthenticated attackers to determine the existence of specific user accounts through careful observation of authentication response characteristics. The issue stems from an observable response discrepancy where the server provides different iteration counts in authentication challenges depending on whether the targeted user exists in the system. When a legitimate user account exists with a custom scram_iterations value, the authentication challenge will reflect that specific iteration count rather than the default value used for non-existent users.
The technical implementation of this vulnerability exploits the SCRAM-SHA-256 authentication protocol's design where servers must provide iteration counts in their initial authentication challenges to clients. In properly functioning PostgreSQL implementations, all valid user accounts should respond with their configured iteration counts during authentication attempts. However, when an attacker sends authentication requests for non-existent users, the server returns the default iteration count value as defined in the PostgreSQL configuration, while legitimate users with custom iteration settings return their specific values. This differential response creates a timing and value-based side channel that reveals user account existence information.
The operational impact of this vulnerability extends beyond simple user enumeration since it provides attackers with systematic information about valid accounts within the database system. An attacker can leverage this knowledge to focus subsequent attack attempts on known valid users, potentially reducing the complexity of brute force attacks or password spraying operations. The vulnerability affects a broad range of PostgreSQL versions including major releases 16 through 18, though older versions remain unaffected as they lack the specific implementation pattern that exposes this information disclosure. This makes it particularly concerning for organizations running recent PostgreSQL deployments who may be unknowingly exposing account information through routine authentication attempts.
Security implications align with CWE-203 Information Disclosure Through Discrepancy and can be categorized under ATT&CK technique T1212 Exploitation for Credential Access, as this vulnerability enables attackers to gather intelligence about valid credentials without direct authentication access. The attack vector requires no privileged access but does need network connectivity to the PostgreSQL server and knowledge of the target system's authentication endpoints. Organizations should prioritize patching affected versions, with specific attention to PostgreSQL 16.15, 17.11, and 18.5 releases, while also implementing additional monitoring for unusual authentication patterns that might indicate enumeration attempts. The vulnerability demonstrates how seemingly minor implementation details in cryptographic protocols can create significant security implications when not carefully considered from an information flow perspective.
This flaw particularly affects systems where PostgreSQL serves as a backend for applications with sensitive data access requirements, as it provides attackers with a low-effort method for account discovery. The vulnerability's impact is amplified in environments where user enumeration could lead to further exploitation opportunities such as targeted password attacks against discovered accounts or privilege escalation attempts through compromised valid users. Organizations should implement additional authentication monitoring and consider implementing rate limiting or account lockout mechanisms to mitigate potential abuse of this information disclosure channel, while also ensuring that all PostgreSQL installations are updated to patched versions that eliminate the observable response discrepancy.
The security community recognizes this as a specific case of information leakage in authentication protocols where implementation details inadvertently reveal system state information. This vulnerability highlights the importance of careful consideration of side channel attacks during cryptographic protocol implementations and demonstrates how even well-established authentication mechanisms can contain subtle flaws when deployed in production environments. The affected versions represent a significant portion of currently supported PostgreSQL releases, making this vulnerability particularly widespread and requiring immediate attention from database administrators across various deployment scenarios.