PostgreSQL pgjdbc up to 42.7.13 Authentication requireAuth missing encryption

Summaryinfo

A vulnerability identified as problematic has been detected in PostgreSQL pgjdbc up to 42.7.13. This impacts an unknown function of the component Authentication. The manipulation of the argument requireAuth leads to missing encryption. This vulnerability is listed as CVE-2026-107314. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in PostgreSQL pgjdbc up to 42.7.13 and classified as problematic. This issue affects some unknown functionality of the component Authentication. The manipulation of the argument requireAuth with an unknown input leads to a missing encryption vulnerability. Using CWE to declare the problem leads to CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. Impacted is confidentiality. The summary by CVE is:

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method the server asks for, including cleartext password authentication. A value without a method in it, such as requireAuth=, (a single comma), is affected the same way. An attacker positioned between the application and its server can ask for cleartext password authentication and receive the database password. A positive list such as requireAuth=scram-sha-256, and a partial exclusion such as requireAuth=!password,!md5, are enforced correctly. The property has no default value, so a deployment that does not set it is not affected. 42.7.14 fixes the problem: such a connection is refused with SQLState 08004, and a value without a method in it is rejected as invalid.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-107314 since 10/07/2026. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1600 for this issue.

Upgrading to version 42.7.14 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Database Software

Vendor

• PostgreSQL

Name

• pgjdbc

Version

• 42.7.0
• 42.7.1
• 42.7.2
• 42.7.3
• 42.7.4
• 42.7.5
• 42.7.6
• 42.7.7
• 42.7.8
• 42.7.9
• 42.7.10
• 42.7.11
• 42.7.12
• 42.7.13

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion