# CVE-2026-54291: PostgreSQL pgjdbc authentication downgrade in ScramAuthenticator

Source: https://junglewise.ai/threats/cve-2026-54291-postgresql-pgjdbc-authentication-downgrade-in-scramauthenticator  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-54291 · Severity: high · CVSS 4 · Published 2026-07-06

A security flaw in the PostgreSQL Java database driver (pgJDBC) allows an attacker to bypass mandatory security protections during the login process. When a connection is configured to require 'channel binding'—a feature designed to prevent man-in-the-middle attacks—the driver may silently downgrade to a less secure authentication method if it encounters certain types of security certificates. This could allow an attacker who can intercept network traffic to impersonate the database server or capture sensitive authentication data.

Technologies: [org.postgresql:postgresql (Maven)](https://junglewise.ai/threats/technologies/org-postgresql-postgresql). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [PostgreSQL](https://junglewise.ai/threats/vendors/postgresql).

## Quick answers

**Is CVE-2026-54291 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54291 being exploited in the wild.

**How severe is CVE-2026-54291?** High severity, with a CVSS score of 4, published 6 July 2026.

**Which products and versions are affected?** org.postgresql:postgresql (Maven) >= 42.7.4, < 42.7.12, ECOSYSTEM:introduced=42.7.4,fixed=42.7.12; PostgreSQL JDBC Driver >= 42.7.4, < 42.7.12.

**Is there a fix for CVE-2026-54291?** Yes. org.postgresql:postgresql (Maven): upgrade to 42.7.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54291 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54291?** Check whether you run org.postgresql:postgresql (Maven) or PostgreSQL JDBC Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.postgresql:postgresql (Maven): upgrade to 42.7.12 or later

  ```sh
  # set org.postgresql:postgresql to 42.7.12 in your pom.xml or build.gradle
  ```


## Technical details

The PostgreSQL JDBC Driver (pgJDBC) is vulnerable to a silent authentication downgrade from SCRAM-SHA-256-PLUS to SCRAM-SHA-256. This occurs because the ScramAuthenticator component fails to verify that the negotiated authentication mechanism actually uses channel binding, even when 'channelBinding=require' is set. Additionally, the bundled 'scram-client' library returns an empty byte array when encountering unsupported certificate signature algorithms (like Ed25519 or post-quantum algorithms) instead of throwing an error. An attacker capable of intercepting the TLS connection can present such a certificate to trigger the downgrade and bypass man-in-the-middle protections. The issue is fixed in version 42.7.12 by enforcing channel binding checks within the driver's own logic.

## Affected products

- PostgreSQL postgresql-jdbc-driver >= 42.7.4, < 42.7.12

## Identifiers

- CVE-2026-54291
- GHSA-j92g-9f8w-j867

## Timeline

- 2026-06-29: disclosed
- 2026-07-21: advisory
- 2026-07-21: patched: Fixed in version 42.7.12

## References

- [https://api.github.com/users/KEIJOT](https://api.github.com/users/KEIJOT)
- [https://github.com/KEIJOT](https://github.com/KEIJOT)
- [https://api.github.com/users/KEIJOT/gists%7B/gist_id%7D](https://api.github.com/users/KEIJOT/gists%7B/gist_id%7D)
- [https://api.github.com/users/KEIJOT/repos](https://api.github.com/users/KEIJOT/repos)
- [https://avatars.githubusercontent.com/u/33745051?v=4](https://avatars.githubusercontent.com/u/33745051?v=4)
- [https://api.github.com/users/KEIJOT/events%7B/privacy%7D](https://api.github.com/users/KEIJOT/events%7B/privacy%7D)

## Related threats

- [PostgreSQL pgjdbc denial of service via unbounded SCRAM iterations](https://junglewise.ai/threats/cve-2026-42198-postgresql-pgjdbc-denial-of-service-via-unbounded-scram)
- [pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration](https://junglewise.ai/threats/cve-2025-49146-pgjdbc-client-allows-fallback-to-insecure-authentication-despite)
- [org.postgresql:postgresql vulnerable to SQL Injection via line comment generation](https://junglewise.ai/threats/cve-2024-1597-org-postgresql-postgresql-vulnerable-to-sql-injection-via-line)
- [Duplicate Advisory: SQL injection in pgjdbc](https://junglewise.ai/threats/duplicate-advisory-sql-injection-in-pgjdbc-6a4f41dc)
- [TemporaryFolder on unix-like systems does not limit access to created files](https://junglewise.ai/threats/cve-2022-41946-temporaryfolder-on-unix-like-systems-does-not-limit-access-to)