CVE-2026-14663 PostgreSQL CVE debrief

Who should care

PostgreSQL users and administrators, especially those using versions before 18.6, 17.11, 16.15, 15.19, and 14.24, should be aware of this vulnerability and take necessary actions to protect their installations.

Technical summary

The CVE-2026-14663 vulnerability involves cleartext storage in PostgreSQL pgcrypto disabled ciphers. An attacker can recover cleartext via direct observation of the faulty ciphertext. The OpenSSL version and configuration determine the disabled ciphers. If an application accepts encrypted data as input, decryption can succeed even with the wrong key, compromising the Modification Detection Code (MDC) protection. Affected functions include pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, pgp_sym_encrypt_bytea, pgp_sym_decrypt_bytea, pgp_pub_encrypt_bytea, and pgp_pub_decrypt_bytea. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are vulnerable.

Defensive priority

Medium-priority defensive actions are required to address cleartext storage in PostgreSQL pgcrypto disabled ciphers.

Recommended defensive actions

• Inventory and assess PostgreSQL installations for versions before 18.6, 17.11, 16.15, 15.19, and 14.24.
• Apply vendor patches or upgrades to affected PostgreSQL versions.
• Review and update OpenSSL configurations to ensure proper cipher settings.
• Monitor for suspicious activity related to encrypted data handling.
• Implement additional security controls to protect sensitive data.

Evidence notes

The CVE description indicates that cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key, losing the modest protection from the Modification Detection Code (MDC). Affected functions include pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, pgp_sym_encrypt_bytea, pgp_sym_decrypt_bytea, pgp_pub_encrypt_bytea, and pgp_pub_decrypt_bytea. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.