org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade

🗓️ 13 Aug 2026 14:51:19Reported by RedHatType

pgjdbc allows TLS MITM downgrade from SCRAM-SHA-256-PLUS to SCRAM-SHA-256 bypassing channel binding.

Reporter	Title	Published	Views	Family All 49
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.	21 Jul 202605:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Aug 202614:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a man-in-the-middle attack in Postgres [CVE-2026-54291]	27 Jul 202620:15	–	ibm
FreeBSD	PostgresSQL JDBC -- Silent channel-binding authentication downgrade via unsupported certificate algorithms	30 Jun 202600:00	–	freebsd
ATTACKERKB	CVE-2026-54291	6 Jul 202618:55	–	attackerkb
Chainguard	CVE-2026-54291 vulnerabilities	23 Jul 202608:23	–	cgr
Circl	CVE-2026-54291	6 Jul 202613:50	–	circl
CVE	CVE-2026-54291	6 Jul 202618:55	–	cve
Cvelist	CVE-2026-54291 Silent channel-binding authentication downgrade via unsupported certificate algorithms	6 Jul 202618:55	–	cvelist
Debian CVE	CVE-2026-54291	6 Jul 202618:55	–	debiancve

Vulners

Node

AND

redhat quarkusRange<3.27el8

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-54291
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/ongres/scram/releases/tag/3.3
github	www.github.com/pgjdbc/pgjdbc/commit/77df98e4e66c12936ded3478a0954f6f580bad99
github	www.github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-54291
cve	www.cve.org/CVERecord

13 Aug 2026 23:29Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.15.9

CVSS 48.2

EPSS0.00203

SSVC