CVE-2026-14672

EUVD-2026-57838

13.08.2026, 13:17

Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count.  This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations.  Within major versions 16-18, minor versions before PostgreSQL 18.5, 17.11, and 16.15 are affected.  Versions before PostgreSQL 16 are unaffected.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Debian Releases

Debian Product

Codename

postgresql-13

bullseye	13.16-0+deb11u1 fixed
bullseye (security)	13.23-0+deb11u4 fixed

postgresql-15

bookworm	15.18-0+deb12u1 fixed
bookworm (security)	15.19-0+deb12u1 fixed

postgresql-17

trixie	vulnerable
trixie (security)	17.11-0+deb13u1 fixed

postgresql-18

forky	vulnerable
sid	vulnerable

Common Weakness Enumeration

CWE-204 - Observable Response Discrepancy
The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

References

https://www.postgresql.org/support/security/CVE-2026-14672/