Database/Control plane, storage & DevOps

PostgreSQL pgcrypto: PGP functions emit recoverable cleartext when OpenSSL disables the cipher

CVE-2026-14663Control plane, storage & DevOpscurated

Impact

When the linked OpenSSL version or configuration has the selected cipher disabled, pgcrypto's PGP functions produce faulty ciphertext from which the cleartext can be recovered by direct observation. The same defect makes decryption succeed under the wrong key, which discards the modest integrity signal the Modification Detection Code provided. Affected calls are pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt and their _bytea variants. This matters where a fleet's control plane keeps PostgreSQL as the system of record and uses pgcrypto to protect tenant API keys or credentials at rest - hardened OpenSSL profiles that disable legacy ciphers are exactly the configuration that turns the protection off.

Who can reach it

Anyone who can read the affected column, or who holds a backup or dump of it - in practice any database role with SELECT on the table, plus anyone with filesystem or backup access. No compromise of the server process is required, and the record scores it network-reachable with no privileges.

What to do

Upgrade to PostgreSQL 18.6, 17.11, 16.15, 15.19 or 14.24 and restart the instance. The patch does not repair data already written: audit which columns were produced by the pgp_* functions under an OpenSSL build with disabled ciphers, treat that data as exposed, and re-encrypt it with rotated keys after upgrading. Confirm which ciphers your OpenSSL configuration disables, since that determines whether you were ever affected.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-14663 https://www.postgresql.org/support/security/CVE-2026-14663/

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.