CVE-2026-14672

CVE-2026-14672 is a medium-severity vulnerability in Postgresql with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-204.

Key facts

• Severity: Medium (CVSS 3.x base score 5.3)
• EPSS exploit prediction: 0% (33rd percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-204
• Affected product: Postgresql
• Published: 2026-08-13
• Last modified: 2026-08-19

Description

Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations. Within major versions 16-18, minor versions before PostgreSQL 18.5, 17.11, and 16.15 are affected. Versions before PostgreSQL 16 are unaffected.

Frequently asked questions

What is CVE-2026-14672?

Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations. Within major versions 16-18, minor versions before PostgreSQL 18.5, 17.11, and 16.15 are affected. Versions before PostgreSQL 16 are unaffected.

How severe is CVE-2026-14672?

CVE-2026-14672 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2026-14672 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-14672?

CVE-2026-14672 affects Postgresql. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-14672?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-14672 published?

CVE-2026-14672 was published on 2026-08-13 and last updated on 2026-08-19.

References

• https://www.postgresql.org/support/security/CVE-2026-14672/

Affected products (1)

• cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

More vulnerabilities in Postgresql

• CVE-2013-1903 — Critical (CVSS 10.0): PostgreSQL, possibly 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before…
• CVE-2013-1902 — Critical (CVSS 10.0): PostgreSQL, 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23…
• CVE-2007-3279 — Critical (CVSS 10.0): PostgreSQL 8.1 and probably later versions, when the PL/pgSQL (plpgsql) language has been created, grants certain…
• CVE-2002-1399 — Critical (CVSS 10.0): Unknown vulnerability in cash_out and possibly other functions in PostgreSQL 7.2.1 and earlier, and possibly later…
• CVE-2015-0244 — Critical (CVSS 9.8): PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not…
• CVE-2015-3166 — Critical (CVSS 9.8): The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7,…

All CVEs affecting Postgresql →

Other CWE-204 vulnerabilities

• CVE-2018-25350 — Critical (CVSS 9.8): userSpice 4.3.24 contains a username enumeration vulnerability that allows unauthenticated attackers to discover valid…
• CVE-2026-15747 — Critical (CVSS 9.1): Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a…
• CVE-2026-69519 — High (CVSS 8.6): Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a…
• CVE-2025-5485 — High (CVSS 8.6): User names used to access the web management interface are limited to the device identifier, which is a numerical…
• CVE-2026-27462 — High (CVSS 7.5): Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for…
• CVE-2026-33419 — High (CVSS 7.5): MinIO is a high-performance object storage system. Prior to RELEASE.2026-03-17T21-25-16Z, MinIO AIStor's STS (Security…

Browse all CWE-204 vulnerabilities →