CVE-2026-107314: 
Java vulnerability analysis and mitigation

CVE-2026-107314 is an authentication enforcement bypass vulnerability in pgjdbc (PostgreSQL JDBC Driver) that allows a network-positioned attacker to intercept database credentials via a cleartext password downgrade attack. It affects versions 42.7.11 through 42.7.13 of org.postgresql:postgresql (Maven). The vulnerability was published on October 7, 2026, and patched in version 42.7.14. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause lies in AuthMethod.parseRequireAuth, which returns null both when the requireAuth property is unset and when the parsed value leaves no authentication method allowed (e.g., all six known methods are excluded via negation). The AuthMethod.checkAuth function then treats null as "no restriction," causing the driver to accept any authentication method the server proposes — including cleartext password — rather than denying all methods as intended (CWE-636: Not Failing Securely / Failing Open; CWE-319: Cleartext Transmission of Sensitive Information). Affected configurations include requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none (in any order) and syntactically invalid values such as requireAuth=,. Positive allowlists (e.g., requireAuth=scram-sha-256) and partial exclusions are enforced correctly and are not affected (GitHub Advisory).

A network-positioned attacker (man-in-the-middle) can downgrade the authentication negotiation to cleartext password and capture the database password transmitted by the application. The primary impact is high confidentiality loss — specifically, exposure of database credentials — with no direct integrity or availability impact. Captured credentials could subsequently enable unauthorized database access, lateral movement within the data tier, or broader compromise of backend systems (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). Exploitation requires a network-adjacent attacker capable of intercepting traffic between the application and the PostgreSQL server (high attack complexity), and only affects deployments that explicitly misconfigure requireAuth to exclude all supported authentication methods — a condition unlikely to be set intentionally. The EPSS score is approximately 0.0026 (low probability of exploitation), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Identify vulnerable deployments: Determine if the target application uses pgjdbc versions 42.7.11–42.7.13 with a requireAuth connection property configured to exclude all six authentication methods (e.g., requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none) or an invalid value such as requireAuth=,.
2. Position for interception: Gain a man-in-the-middle position on the network path between the Java application and the PostgreSQL database server (e.g., via ARP spoofing, rogue network device, or compromised network segment).
3. Intercept the connection: Capture the TCP connection initiated by the pgjdbc driver to the PostgreSQL server port (default 5432).
4. Downgrade authentication: Respond to the driver's connection request by presenting a PostgreSQL authentication challenge requesting cleartext password authentication instead of a stronger method (e.g., SCRAM-SHA-256).
5. Capture credentials: Because the driver's requireAuth enforcement is silently bypassed (returns null and applies no restriction), the driver complies and transmits the database password in cleartext, which the attacker captures (GitHub Advisory).

• Network: Unexpected cleartext PostgreSQL authentication exchanges (password authentication type 0x03 in the PostgreSQL wire protocol) on port 5432 where SCRAM or other strong methods are expected; unusual ARP activity or duplicate MAC addresses on the network segment between application and database servers.
• Logs: PostgreSQL server logs showing authentication method=password (cleartext) for connections from application hosts that are normally expected to use SCRAM-SHA-256 or other methods; application logs showing successful database connections despite a requireAuth configuration that should have been restrictive.
• Process/Configuration: Presence of requireAuth connection property values in application configuration files or environment variables that exclude all six known methods (e.g., containing all of !password, !md5, !gss, !sspi, !scram-sha-256, !none) or syntactically invalid values such as a lone comma.

Upgrade pgjdbc to version 42.7.14 or later, which refuses connections whose requireAuth value excludes every method (returning SQLState 08004) and rejects syntactically invalid values (GitHub Advisory). As an immediate workaround on affected versions, replace any all-exclusion requireAuth value with a positive allowlist of the authentication methods your server actually uses (e.g., requireAuth=scram-sha-256). Additionally, set channelBinding=require if using SCRAM over TLS, and enforce sslmode=verify-full with a trusted CA to prevent server impersonation. Network-level controls such as segmentation or VPN tunneling between application and database servers further reduce MITM risk (Red Hat Bugzilla).

Red Hat opened a security tracking bug (Bug 2547743) and assigned medium severity, with 71 CC'd team members indicating broad internal review across Red Hat product lines (Red Hat Bugzilla). The advisory was published by maintainer sehrope on the pgjdbc GitHub repository and rated "Moderate" by the project (GitHub Advisory). No significant broader media coverage or notable researcher commentary has been identified at this time.