CVE-2026-54291: 
Java vulnerability analysis and mitigation

CVE-2026-54291 is a silent channel-binding authentication downgrade vulnerability in pgjdbc, the open-source PostgreSQL JDBC Driver. Affecting versions 42.7.4 through 42.7.11, it allows connections configured with channelBinding=require to be silently downgraded from SCRAM-SHA-256-PLUS (with channel binding) to plain SCRAM-SHA-256 (without it), nullifying the man-in-the-middle (MitM) protection the setting is intended to guarantee. The vulnerability was published on July 6, 2026, and patched in version 42.7.12. It carries a CVSS v3.1 base score of 5.9 (Medium) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, Feedly).

The vulnerability stems from two compounding flaws classified as CWE-636 (Not Failing Securely / Failing Open) and CWE-757 (Selection of Less-Secure Algorithm During Negotiation). First, the bundled com.ongres.scram:scram-client library (versions 3.1 or 3.2) returns an empty byte array — rather than throwing an error — when it cannot derive a tls-server-end-point channel-binding hash for certificates using algorithms without an associated RFC 5929 hash (e.g., Ed25519, Ed448, post-quantum algorithms). Second, pgjdbc's ScramAuthenticator only checks that the server advertised a -PLUS mechanism but neither rejects the empty binding value nor verifies that the negotiated mechanism actually uses channel binding, allowing the connection to proceed over plain SCRAM-SHA-256. The fix in 42.7.12 adds explicit enforcement in ScramAuthenticator.java: it fails the connection when no channel-binding data can be extracted from the server certificate under require mode, and after negotiation, it asserts that the selected mechanism is a -PLUS variant (GitHub Advisory, Fix Commit).

Successful exploitation allows a network-positioned attacker to perform a man-in-the-middle attack against PostgreSQL connections that rely on channelBinding=require for MitM protection. The primary impact is to integrity (CVSS integrity: High), as the attacker can intercept and potentially tamper with database traffic after stripping the channel-binding guarantee. Confidentiality is not directly impacted by the downgrade itself, but a successful MitM position could expose query data and credentials in transit. Only connections explicitly configured with channelBinding=require are affected; connections using the default prefer, allow, or disable policies are not, as fallback to plain SCRAM is their documented behavior (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a network-adjacent attacker capable of intercepting the TLS connection and presenting a certificate using an algorithm without a tls-server-end-point hash (e.g., Ed25519), making it high-complexity and non-automatable. The EPSS score is approximately 0.0025 (0.25%), reflecting low near-term exploitation probability (Feedly). The vulnerability was reported by researcher KEIJOT (GitHub Advisory).

1. Reconnaissance: Identify applications using pgjdbc versions 42.7.4–42.7.11 with channelBinding=require configured in their JDBC connection strings, targeting environments where the PostgreSQL server uses a certificate with an algorithm lacking a tls-server-end-point hash (e.g., Ed25519, Ed448).
2. Position for MitM: Gain a network-adjacent position capable of intercepting TLS traffic between the Java application and the PostgreSQL server (e.g., via ARP spoofing, DNS poisoning, or rogue network device on the same segment).
3. Present a crafted certificate: During the TLS handshake, present a substitute server certificate signed with an algorithm (e.g., Ed25519) that has no associated RFC 5929 tls-server-end-point channel-binding hash. The vulnerable scram-client library will return an empty byte array for the binding data.
4. Trigger silent downgrade: Because pgjdbc's ScramAuthenticator does not reject the empty binding value and only checks that the server advertised a -PLUS mechanism (not that the negotiated mechanism uses it), the authentication silently proceeds over plain SCRAM-SHA-256 without channel binding.
5. Intercept/tamper with traffic: With channel binding bypassed, the attacker's MitM position is no longer detected or blocked by the authentication mechanism, allowing interception or modification of database queries and responses (GitHub Advisory, Fix Commit).

• Logs: Absence of expected PSQLException or connection rejection errors when channelBinding=require is set and the server certificate uses Ed25519 or similar algorithms — in vulnerable versions, the connection succeeds silently instead of failing.
• Network: TLS handshakes to PostgreSQL servers (default port 5432) where the server certificate's signature algorithm is Ed25519, Ed448, or a post-quantum algorithm, combined with SCRAM authentication proceeding without a -PLUS mechanism negotiated.
• Application Behavior: JDBC connections completing successfully with channelBinding=require against a server presenting a certificate algorithm unsupported by RFC 5929 tls-server-end-point — this should fail in patched versions but silently succeeds in vulnerable ones.
• Network: Unexpected intermediate hosts or certificate mismatches observed in TLS session inspection between the application server and PostgreSQL database host (GitHub Advisory).

The primary fix is to upgrade pgjdbc to version 42.7.12 or later, which enforces channel binding independently in ScramAuthenticator and fails the connection explicitly when binding data cannot be derived (GitHub Advisory, PostgreSQL News). There is no pgJDBC configuration workaround that restores channel-binding enforcement on affected releases. As a compensating control for those unable to upgrade immediately, configure sslmode=verify-full with a truststore containing only your server's CA certificate — this independently blocks MitM attacks at the TLS layer by ensuring the server certificate is verified. Connections that rely solely on channelBinding=require in lieu of certificate verification have no equivalent workaround and must upgrade. Additionally, upgrading the underlying com.ongres.scram:scram-client dependency to version 3.3 addresses the root cause in the library (tracked as GHSA-p9jg-fcr6-3mhf) (scram 3.3 Release).

The PostgreSQL project published an official security release announcement for pgjdbc 42.7.12 (PostgreSQL News). Tenable added detection support via Nessus plugin 325326 shortly after disclosure (Tenable). The vulnerability received coverage in DevOps-focused news digests and was noted on Bluesky by security community accounts. Community reaction has been measured, reflecting the high attack complexity and limited scope (only channelBinding=require users are affected).