The flaw arises when PostgreSQL fails to enforce message integrity for GSSAPI sessions that are also wrapped in TLS. An attacker can initiate a TLS connection that sidesteps the pg_hba.conf rule that mandates GSSAPI, allowing data to flow only over TLS encryption. This undermines the stronger security intent and can expose database traffic to downgrade or man‑in‑the‑middle attacks, exemplifying the improper enforcement of a security control (CWE‑924).

This flaw affects PostgreSQL major versions 17 and 18, specifically all minor releases earlier than 17.11 and 18.6. Versions prior to PostgreSQL 17 are unaffected.

With a CVSS score of 4.2 the vulnerability is moderate. The EPSS score of <1% indicates a low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. Attacks would require a client capable of connecting to the database over TLS and exploiting the misconfiguration to replace GSSAPI authentication with TLS alone, potentially weakening confidentiality if TLS is compromised.