Medium [CVE-2026-14681] Improper enforcement of GSSAPI encryption via direct TLS connection
This medium-severity Red Hat Linux advisory covers CVE-2026-14681 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat package: postgresql18.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone.
If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.5 and 17.11 are affected.
A flaw was found in PostgreSQL. This enables the connection to proceed with only TLS encryption, even when GSSAPI is required.
This Moderate severity flaw in PostgreSQL's GSSAPI support allows a remote, authenticated attacker with low privileges to bypass `pg_hba.conf` rules requiring GSSAPI encryption.
By initiating a direct TLS connection, the attacker can force a less secure connection if TLS settings are more permissive, potentially compromising data integrity and confidentiality. The high attack complexity reduces the overall risk.
Red Hat severity: Moderate — CVSS 4.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). Weakness: CWE-924.
Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE.
Affected products named by the advisory: Red Hat package: postgresql18.
- < 18.5
- < 17.11
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
Mitigation checklist
- To mitigate the risk associated with this flaw, restrict network access to the PostgreSQL server to only trusted hosts and networks. This reduces the attack surface and limits the ability of unauthorized users to establish connections that could bypass GSSAPI enforcement via direct TLS. *Warning:* Restricting network access may impact legitimate client connections if not configured carefully. Changes to firewall rules or network configurations may require a service reload or restart to take effect.
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.