DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54291: CVE-2026-54291: Silent Channel-Binding Authentication Downgrade in PostgreSQL JDBC Driver (pgjdbc)

#security #cve #cybersecurity

CVE-2026-54291: Silent Channel-Binding Authentication Downgrade in PostgreSQL JDBC Driver (pgjdbc)

Vulnerability ID: CVE-2026-54291
CVSS Score: 8.2
Published: 2026-07-21

A critical security bypass and algorithm downgrade vulnerability in the PostgreSQL JDBC Driver (pgjdbc) allows Man-in-the-Middle (MITM) attackers to silently bypass channel binding requirements. When configured with channelBinding=require, the driver fails to assert that the negotiated SCRAM mechanism utilizes channel binding, allowing downgrade to plain SCRAM-SHA-256 when encountering unsupported server certificate signature algorithms (such as Ed25519 or Ed448).

TL;DR

pgjdbc versions 42.7.4 to 42.7.11 silently downgrade connections configured with channelBinding=require to plain, non-channel-bound SCRAM-SHA-256 when a server certificate with an unsupported signature algorithm (like Ed25519) is presented, bypassing Man-in-the-Middle protections.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-757, CWE-636
  • Attack Vector: Network
  • CVSS v4.0 Score: 8.2 (High)
  • CVSS v3.1 Score: 5.9 (Medium)
  • Exploit Status: Proof of Concept / Technical Analysis Available
  • KEV Status: Not Listed in CISA KEV
  • Affected Components: org.postgresql.core.v3.ScramAuthenticator

Affected Systems

  • pgjdbc (PostgreSQL JDBC Driver)
  • pgjdbc: >= 42.7.4, < 42.7.12 (Fixed in: 42.7.12)

Code Analysis

Commit: 77df98e

Enforce channel binding on the pgjdbc side, failing connections under require when channel binding data cannot be extracted.

Exploit Details

Mitigation Strategies

  • Upgrade pgjdbc to version 42.7.12 or higher to enforce post-negotiation channel binding checks.
  • Upgrade com.ongres.scram:scram-client to version 3.3 or higher.
  • Avoid using Ed25519 or Ed448 certificates on PostgreSQL database servers when older drivers are in use.
  • Isolate database network traffic to prevent network-level interception (AiTM).

Remediation Steps:

  1. Identify all deployments using pgjdbc versions between 42.7.4 and 42.7.11.
  2. Update Maven dependencies or Gradle build files to reference org.postgresql:postgresql:42.7.12.
  3. Re-generate application deployment packages and verify transitive dependencies.
  4. Audit active TLS certificates on PostgreSQL servers to ensure they utilize RSA or ECDSA signature algorithms.
  5. Confirm that connections configured with channelBinding=require reject unsupported configurations post-upgrade.

References

Read the full report for CVE-2026-54291 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)