CVE-2026-54291
CVE-2026-54291 is a medium-severity vulnerability in Postgresql Postgresql Jdbc Driver with a CVSS 3.x base score of 5.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-636.
Key facts
- Severity: Medium (CVSS 3.x base score 5.9)
- CVSS v4: 8.2
- EPSS exploit prediction: 0% (15th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-636
- Affected product: Postgresql Postgresql Jdbc Driver
- Published:
- Last modified:
Description
pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.
Frequently asked questions
- What is CVE-2026-54291?
- pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.
- How severe is CVE-2026-54291?
- CVE-2026-54291 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
- Is CVE-2026-54291 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-54291?
- CVE-2026-54291 affects Postgresql Postgresql Jdbc Driver. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-54291?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2026-54291 published?
- CVE-2026-54291 was published on 2026-07-06 and last updated on 2026-07-09.
References
- https://github.com/ongres/scram/releases/tag/3.3
- https://github.com/pgjdbc/pgjdbc/commit/77df98e4e66c12936ded3478a0954f6f580bad99
- https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867
Affected products (1)
- cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:*
More vulnerabilities in Postgresql Postgresql Jdbc Driver
- CVE-2024-1597 — Critical (CVSS 10.0): pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the…
- CVE-2022-26520 — Critical (CVSS 9.8): In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler…
- CVE-2025-49146 — High (CVSS 8.2): pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is…
- CVE-2018-10936 — High (CVSS 8.1): A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check…
- CVE-2020-13692 — High (CVSS 7.7): PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.
- CVE-2026-42198 — High (CVSS 7.5): pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to…
All CVEs affecting Postgresql Postgresql Jdbc Driver →
Other CWE-636 vulnerabilities
- CVE-2026-22034 — Critical (CVSS 9.8): Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a…
- CVE-2024-3729 — Critical (CVSS 9.8): The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling…
- CVE-2026-53459 — Critical (CVSS 9.3): Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and…
- CVE-2026-40525 — Critical (CVSS 9.1): OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route…
- CVE-2026-77866 — Critical (CVSS 9.0): Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls a validated URL to…
- CVE-2026-68746 — High (CVSS 8.8): Not Failing Securely ('Failing Open') vulnerability in livebook-dev livebook allows an unauthenticated network client…