pgjdbc does not enforce requireAuth when the value excludes every authentication method
pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method the server asks for, including cleartext password authentication. A value without a method in it, such as requireAuth=, (a single comma), is affected the same way. An attacker positioned between the application and its server can ask for cleartext password authentication and receive the database password. A positive list such as requireAuth=scram-sha-256, and a partial exclusion such as requireAuth=!password,!md5, are enforced correctly. The property has no default value, so a deployment that does not set it is not affected. 42.7.14 fixes the problem: such a connection is refused with SQLState 08004, and a value without a method in it is rejected as invalid.
CVE-2026-107314
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-107314
pgjdbc
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/pgjdbc/pgjdbc",
"vendor": "pgjdbc",
"product": "pgjdbc",
"versions": [
{
"status": "affected",
"version": "42.7.11",
"lessThan": "42.7.14",
"versionType": "maven"
}
],
"packageName": "org.postgresql:postgresql",
"programFiles": [
"pgjdbc/src/main/java/org/postgresql/core/AuthMethod.java"
],
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "org.postgresql.core.AuthMethod.parseRequireAuth"
},
{
"name": "org.postgresql.core.AuthMethod.checkAuth"
}
]
}
]- Related CVEs
- CVE-2026-107314
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #12568 · Revision 1
- Added to Heist Feed
- Publisher date