Bug 2547743 (CVE-2026-107314)

Summary:	CVE-2026-107314 org.postgresql/postgresql: PostgreSQL JDBC Driver: Information disclosure via requireAuth restriction bypass
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anthomas, ant, aschwart, asyoung, aszczucz, ataylor, boliveir, ccranfor, cescoffi, cmah, csuconic, dbruscin, drichtar, eglynn, ehelms, ehugonne, ewittman, fmongiar, ggainey, gmalinko, gsmet, gtully, janstey, jhollowa, jjoyce, jmartisk, jpasqual, jpechane, jpretori, jschluet, jsherman, juwatts, kaycoth, kvanderr, lhh, manderse, mburns, mdellweg, mgarciac, mhulan, mposolda, nipatil, nmoumoul, olubyans, osousa, ozzy, pantinor, pcreech, pdelbell, pjindal, prichard, rchan, rgemmell, rgodfrey, rguimara, rhel-process-autobot, rkubis, rmartinc, rstepani, sbiarozk, sdawley, smallamp, ssilvert, sthirugn, sthorger, tbish, tlavocat, tmalecek, varjain, vmuzikar, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the PostgreSQL JDBC Driver (pgjdbc), which may lead to information disclosure. When the requireAuth connection property is configured to exclude all supported authentication mechanisms or lacks a valid method, the driver fails to enforce authentication restrictions and accepts any method requested by the server. A man-in-the-middle attacker positioned between the application and the database server can exploit this flaw by requesting cleartext password authentication to intercept database credentials.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-07 23:11:16 UTC

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method the server asks for, including cleartext password authentication. A value without a method in it, such as requireAuth=, (a single comma), is affected the same way. An attacker positioned between the application and its server can ask for cleartext password authentication and receive the database password. A positive list such as requireAuth=scram-sha-256, and a partial exclusion such as requireAuth=!password,!md5, are enforced correctly. The property has no default value, so a deployment that does not set it is not affected. 42.7.14 fixes the problem: such a connection is refused with SQLState 08004, and a value without a method in it is rejected as invalid.