Not Failing Securely ('Failing Open') in Postgresql JDBC Driver - CVE-2026-107314
Published: November 6, 2026
Vulnerability identifier: #VU159845
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-107314
CWE-ID: CWE-636
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to obtain an application's database password.
The vulnerability exists due to the PostgreSQL JDBC Driver treating an empty set of permitted authentication methods as unrestricted when the non-default requireAuth configuration excludes every supported method or names none. An unauthenticated remote attacker can request cleartext password authentication while positioned between the application and its database server, causing the driver to transmit the database password.
Affected software
Postgresql JDBC Driver
How to mitigate CVE-2026-107314
Install security update from vendor's website.
Postgresql JDBC Driver - update to 42.7.14