The vulnerability of the JDBC driver pgjdbc for connecting Java programs to a PostgreSQL database lies in its use of an unprotected alternative channel, which allows an attacker to exploit the protected information.

🗓️ 28 Sep 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

Unprotected alternative channel in pgjdbc JDBC driver allows sensitive information disclosure.

Reporter	Title	Published	Views	Family All 197
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.	21 Jul 202605:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Tivoli Netcool Impact	29 Sep 202614:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Aug 202614:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a man-in-the-middle attack in Postgres [CVE-2026-54291]	27 Jul 202620:15	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in pgjdbc affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:06	–	ibm
FreeBSD	PostgresSQL JDBC -- Silent channel-binding authentication downgrade via unsupported certificate algorithms	30 Jun 202600:00	–	freebsd
attackerkb	CVE-2026-54291	6 Jul 202618:55	–	attackerkb
Atlassian	MITM (Man-in-the-Middle) org.postgresql:postgresql Dependency in Bamboo Data Center	7 Aug 202616:32	–	atlassian
Atlassian	MITM (Man-in-the-Middle) org.postgresql:postgresql Dependency in Bitbucket Data Center	23 Jul 202605:30	–	atlassian
Atlassian	MITM (Man-in-the-Middle) org.postgresql:postgresql Dependency in Confluence Data Center	23 Jul 202605:30	–	atlassian

Vulners

Node

OR

red_hat,red_hat_single_sign-onMatch7

postgresql pgjdbcRange<42.7.7

red_hat,red_hat_build_of_quarkusMatch3.27.5

red_hat,red_hat_build_of_quarkusMatch3.33.3

Source	Link
github	www.github.com/advisories/GHSA-j92g-9f8w-j867
github	www.github.com/ongres/scram/releases/tag/3.3
github	www.github.com/pgjdbc/pgjdbc
github	www.github.com/pgjdbc/pgjdbc/commit/77df98e4e66c12936ded3478a0954f6f580bad99
github	www.github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867
security-tracker	www.security-tracker.debian.org/tracker/CVE-2026-54291
deb	www.deb.freexian.com/extended-lts/tracker/CVE-2026-54291
access	www.access.redhat.com/security/cve/CVE-2026-54291
repo	www.repo.red-soft.ru/redos/8.0/x86_64/updates/
web	www.web.nvd.nist.gov/view/vuln/detail

28 Sep 2026 00:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 25.4

CVSS 36.8

EPSS0.00236

pgjdbc JDBC driver PostgreSQL unprotected alternative channel information disclosure