CVE-2026-54291
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The pgjdbc PostgreSQL JDBC driver versions 42.7.4 through 42.7.11 allow silent downgrade of SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256. A man-in-the-middle attacker can exploit a certificate lacking the proper channel binding hash to trigger the downgrade and bypass protection.
Risk Assessment
The organization is at risk of man-in-the-middle attacks on PostgreSQL connections, potentially leading to interception or modification of data transmitted between the application and the database.
Recommendation
Immediately upgrade the pgjdbc driver to version 42.7.12 or later, which includes a fix preventing silent downgrade of authentication.
Original NVD description (English source)
pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.