PostgreSQL JDBC Driver Vulnerability in pgjdbc Affects Multiple Versions

CVE-2026-107314

What is CVE-2026-107314?

The PostgreSQL JDBC Driver (pgjdbc), specifically versions 42.7.11 through 42.7.13, fails to enforce adequate restrictions when the requireAuth connection property excludes all defined authentication methods. This flaw allows an attacker to exploit the driver by requesting cleartext password authentication, compromising sensitive database credentials. When set incorrectly or left empty, applications could unknowingly accept any method requested by the server, leading to potential data breaches. Version 42.7.14 addresses this vulnerability by enforcing restrictions and properly rejecting invalid configurations.

References