Missing Encryption of Sensitive Data in PostgreSQL - CVE-2026-14663
Published: August 15, 2026
Vulnerability identifier: #VU142641
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-14663
CWE-ID: CWE-311
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose cleartext data and tamper with encrypted data.
The vulnerability exists due to improper encryption in pgcrypto functions when processing OpenSSL-disabled ciphers. A remote attacker can observe faulty ciphertext or supply encrypted input to disclose cleartext data and tamper with encrypted data.
The OpenSSL version and configuration determine which ciphers are disabled, and decryption may succeed even with the wrong key.
Affected software
PostgreSQL
Debian Linux
postgresql-17 (Debian package)
Debian Linux
postgresql-17 (Debian package)
How to mitigate CVE-2026-14663
Install security update from vendor's website.
PostgreSQL - addressed in versions 14.24, 15.19, 16.15, 17.11, 18.5
postgresql-17 (Debian package) - update to 17.11-0+deb13u1
postgresql-17 (Debian package) - update to 17.11-0+deb13u1