The flaw arises when PostgreSQL fails to enforce message integrity for GSSAPI sessions that are also wrapped in TLS. An attacker can initiate a TLS connection that sidesteps the pg_hba.conf rule that mandates GSSAPI, allowing data to flow only over TLS encryption. This undermines the stronger security intent and can expose database traffic to downgrade or man‑in‑the‑middle attacks, exemplifying the improper enforcement of a security control (CWE‑924).

PostgreSQL 17 through 18 are vulnerable, specifically any minor release before 18.5 and before 17.11. Versions prior to PostgreSQL 17 are not affected.

With a CVSS score of 4.2 the vulnerability is moderate. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, indicating an uncertain but non‑negligible exploitation likelihood. Attacks would require a client capable of connecting to the database over TLS and exploiting the misconfiguration to replace GSSAPI authentication with TLS alone, potentially weakening confidentiality if TLS is compromised.