CVE-2026-54291
published 2026-07-06CVE-2026-54291: pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from…
PriorityP431medium5.9CVSS 3.1
AVNACHPRNUINSUCNIHAN
EPSS
0.24%
13.9th percentile
pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| pgjdbc | pgjdbc | — | — |
| postgresql | postgresql | — | — |
| postgresql | postgresql_jdbc_driver | >= 42.7.4 < 42.7.12 | 42.7.12 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms
ghsa·2026-07-21
CVE-2026-54291 [HIGH] CWE-636 PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms
PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms
### Impact
`channelBinding=require` connections can be silently downgraded from `SCRAM-SHA-256-PLUS` (with channel binding) to plain `SCRAM-SHA-256` (without it), losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection triggers the downgrade with a certificate whose signature algorithm has no `tls-server-end-point` channel-binding hash. Examples are `Ed25519`, `Ed448`, and post-quantum algorithms.
Two issues combine in releases 42.7.4 through 42.7.11:
1. The bundled `com.ongres.scram:scram-client` (3.1 or 3.2) returns an empty byte array instead of failing when it cannot derive the binding hash for such a cert
VulDB
pgjdbc up to 42.7.11 ScramAuthenticator ScramAuthenticator.java authenticate channelBinding channel accessible
vuldb·2026-07-06·CVSS 8.2
CVE-2026-54291 [HIGH] pgjdbc up to 42.7.11 ScramAuthenticator ScramAuthenticator.java authenticate channelBinding channel accessible
A vulnerability has been found in pgjdbc up to 42.7.11 and classified as critical. Impacted is the function Authenticate of the file ScramAuthenticator.java of the component ScramAuthenticator. Performing a manipulation of the argument channelBinding results in channel accessible by non-endpoint.
This vulnerability is identified as CVE-2026-54291. The attack can be initiated remotely. There is not any exploit available.
Red Hat
org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade
vendor_redhat·2026-07-06·CVSS 5.9
CVE-2026-54291 [MEDIUM] CWE-940 org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade
org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade
pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without
No detection rules found.
No public exploits indexed.
2026-07-06
Published