PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms

🗓️ 21 Jul 2026 17:47:39Reported by GitHub Advisory DatabaseType

PostgreSQL JDBC fixes silent downgrade of channel binding for SCRAM-SHA-256-PLUS when cert lacks binding hash.

Reporter	Title	Published	Views	Family All 215
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.	21 Jul 202605:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Tivoli Netcool Impact	29 Sep 202614:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Aug 202614:47	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability has been found in IBM Guardium Discover and Classify (IGDC)	22 Oct 202615:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a man-in-the-middle attack in Postgres [CVE-2026-54291]	27 Jul 202620:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Protection is affected by a security vulnerability (CVE-2026-54291)	21 Oct 202612:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a 'Failing Open' issue in pgjdbc PostgreSQL JDBC Driver (CVE-2026-54291)	22 Oct 202617:05	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in pgjdbc affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:06	–	ibm
FreeBSD	PostgresSQL JDBC -- Silent channel-binding authentication downgrade via unsupported certificate algorithms	30 Jun 202600:00	–	freebsd
attackerkb	CVE-2026-54291	6 Jul 202618:55	–	attackerkb

Vulners

Node

org.postgresql postgresqlRange42.7.4–42.7.12maven

Source	Link
github	www.github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-54291
github	www.github.com/pgjdbc/pgjdbc/commit/77df98e4e66c12936ded3478a0954f6f580bad99
github	www.github.com/ongres/scram/releases/tag/3.3
github	www.github.com/advisories/GHSA-j92g-9f8w-j867

21 Jul 2026 17:47Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.15.9

CVSS 48.2

EPSS0.00236

SSVC