Cleartext Storage Vulnerability in PostgreSQL Affects Encryption Mechanisms
CVE-2026-14663

6.5MEDIUM

Key Information:

Vendor

PostgreSQL
Status
Postgresql
Vendor
CVE Published:
13 August 2026

What is CVE-2026-14663?

This vulnerability in PostgreSQL's pgcrypto extension relates to the storage of cleartext data due to the use of disabled ciphers in encryption processes. It allows adversaries to recover sensitive information through the faulty ciphertext generated during encryption. When applications accept encrypted input, decryption can succeed without the correct key, circumventing protection mechanisms like the Modification Detection Code (MDC). Functions impacted include pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, and their bytea counterparts. Users of PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 are especially vulnerable.

Affected Version(s)

PostgreSQL 18 < 18.5

PostgreSQL 17 < 17.11

PostgreSQL 16 < 16.15

References

https://www.postgresql.org/support/security/CVE-2026-14663/

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL project thanks Shishir Sharma for reporting this problem.
.