pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.

oracle CPUOct2026: MySQL Cluster >=9.7.0|<=9.7.4

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.38

oracle CPUOct2026: MySQL Cluster >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.50

oracle CPUOct2026: MySQL Cluster >=26.7.0|<=26.7.2

oracle CPUOct2026: MySQL Server >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Server >=9.7.0|<=9.7.4

According to its self-reported version number, the Atlassian Crowd application running on the remote host is prior to 7.2.2. It is, therefore, affected by multiple vulnerabilities, including flaws in bundled third-party dependencies :

- A broken authentication and session management vulnerability in Atlassian Crowd. (CVE-2026-21582)

- Multiple denial of service vulnerabilities in the bundled Netty dependency. (CVE-2026-56745, CVE-2026-59901, CVE-2026-45416, CVE-2026-55831, CVE-2026-55833, CVE-2026-48043, CVE-2026-56819)

- Multiple injection vulnerabilities in the bundled axios dependency. (CVE-2026-44494, CVE-2026-42041, CVE-2026-44490, CVE-2026-42035, CVE-2026-42033)

- A server-side request forgery (SSRF) vulnerability in the bundled axios dependency. (CVE-2026-44492)

- Multiple information disclosure vulnerabilities in the bundled axios dependency. (CVE-2026-67320, CVE-2026-44487, CVE-2026-44486)

- A SQL injection vulnerability in the bundled Hibernate ORM dependency. (CVE-2026-0603)

- A man-in-the-middle vulnerability in the bundled PostgreSQL JDBC Driver dependency. (CVE-2026-54291)

- A denial of service vulnerability in the bundled underscore dependency. (CVE-2026-27601)

- Multiple insecure deserialization vulnerabilities in the bundled jackson-databind dependency. (CVE-2026-54513, CVE-2026-54512)

- An improper authorization vulnerability in the bundled Netty dependency. (CVE-2026-44249)

- A broken authentication and session management vulnerability in the bundled Spring Security dependency. (CVE-2026-47838)

- A denial of service vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-41284)

- Multiple denial of service vulnerabilities in the bundled Spring Framework dependency. (CVE-2026-41842, CVE-2026-41851, CVE-2026-41850)

- A man-in-the-middle vulnerability in the bundled Netty dependency. (CVE-2026-50010)

- Multiple denial of service vulnerabilities in the bundled axios dependency. (CVE-2026-44496, CVE-2026-44488)

- Multiple denial of service vulnerabilities in the bundled Micrometer dependency. (CVE-2026-40983, CVE-2026-40984)

- An information disclosure vulnerability in the bundled postcss dependency. (CVE-2026-45623)

- A business logic vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-43513)

- An injection vulnerability in the bundled js-cookie dependency. (CVE-2026-46625)

- A cross-site scripting (XSS) vulnerability in the bundled Spring Framework dependency. (CVE-2026-41845)

- A remote code execution vulnerability in the bundled axios dependency. (CVE-2026-44495)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Atlassian Jira application running on the remote host is prior to 10.3.24 or 10.4.x prior to 11.3.10. It is, therefore, affected by multiple vulnerabilities, including flaws in bundled third-party dependencies :

- A remote code execution vulnerability in the bundled lodash dependency. (CVE-2026-4800)

- A remote code execution vulnerability in the bundled @babel/traverse dependency. (CVE-2023-45133)

- Multiple denial of service vulnerabilities in the bundled node-tar dependency. (CVE-2026-59873, CVE-2026-59874, CVE-2026-59871)

- A broken authentication and session management vulnerability in Atlassian Jira. (CVE-2026-21582)

- A file inclusion vulnerability in the bundled rollup dependency. (CVE-2026-27606)

- An injection vulnerability in the bundled axios dependency. (CVE-2026-44494)

- Multiple denial of service vulnerabilities in the bundled Netty dependency. (CVE-2026-59901, CVE-2026-56745, CVE-2026-55833, CVE-2026-56819, CVE-2026-45416, CVE-2026-48043, CVE-2026-42587, CVE-2026-55831, CVE-2026-42583)

- A denial of service vulnerability in the bundled react-router dependency. (CVE-2026-55685)

- A remote code execution vulnerability in the bundled form-data dependency. (CVE-2026-12143)

- A server-side request forgery (SSRF) vulnerability in the bundled axios dependency. (CVE-2026-44492)

- A man-in-the-middle vulnerability in the bundled PostgreSQL JDBC Driver dependency. (CVE-2026-54291)

- Multiple information disclosure vulnerabilities in the bundled axios dependency. (CVE-2026-44487, CVE-2026-44486)

- An improper authorization vulnerability in the bundled Netty dependency. (CVE-2026-44249)

- A broken authentication and session management vulnerability in the bundled Spring Security dependency. (CVE-2026-47838)

- A server-side request forgery (SSRF) vulnerability in the bundled ip-address dependency. (CVE-2026-69192)

- A denial of service vulnerability in the bundled brace-expansion dependency. (CVE-2026-13149)

- An injection vulnerability in the bundled js-cookie dependency. (CVE-2026-46625)

- A man-in-the-middle vulnerability in the bundled Netty dependency. (CVE-2026-50010)

- A denial of service vulnerability in the bundled undici dependency. (CVE-2026-12151)

- An injection vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-24734)

- A denial of service vulnerability in the bundled Spring Framework dependency. (CVE-2026-41842)

- A denial of service vulnerability in the bundled axios dependency. (CVE-2026-44488)

- A denial of service vulnerability in the bundled Micrometer dependency. (CVE-2026-40983)

- A cross-site scripting (XSS) vulnerability in the bundled Spring Framework dependency. (CVE-2026-41845)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 9.2.23 or 9.3.x prior to 10.2.15. It is, therefore, affected by multiple vulnerabilities, including flaws in bundled third-party dependencies :

- An injection vulnerability in the bundled minimist dependency. (CVE-2021-44906)

- A security misconfiguration vulnerability in the bundled Bouncy Castle dependency. (CVE-2025-14813)

- Multiple denial of service vulnerabilities in the bundled node-tar dependency. (CVE-2026-59873, CVE-2026-59874, CVE-2026-59871)

- A man-in-the-middle vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-53434)

- Multiple denial of service vulnerabilities in the bundled linkify-it dependency. (CVE-2026-48801, CVE-2026-59887)

- A SQL injection vulnerability in the bundled Hibernate ORM dependency. (CVE-2026-0603)

- A file inclusion vulnerability in the bundled node-tar dependency. (CVE-2026-29786)

- A man-in-the-middle vulnerability in the bundled PostgreSQL JDBC Driver dependency. (CVE-2026-54291)

- A denial of service vulnerability in the bundled underscore dependency. (CVE-2026-27601)

- A denial of service vulnerability in the bundled PostgreSQL JDBC Driver dependency. (CVE-2026-42198)

- An information disclosure vulnerability in the bundled postcss dependency. (CVE-2026-45623)

- A denial of service vulnerability in the bundled Micrometer dependency. (CVE-2026-40983)

- A denial of service vulnerability in the bundled axios dependency. (CVE-2026-25639)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11,
    channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding
    to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to
    guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate
    whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled
    com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator
    checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking
    that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.
    (CVE-2026-54291)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11,     channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding     to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to     guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate     whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled     com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator     checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking     that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12.
    (CVE-2026-54291)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 7701f760-745c-11f1-bc50-6cc21735f730 advisory.

    PostgreSQL project reports:

                channelBinding=require connections can be silently                 downgraded from SCRAM-SHA-256-PLUS (with channel                 binding) to plain SCRAM-SHA-256 (without it), losing the                 man-in-the-middle protection the setting is meant to                 guarantee. An attacker who can intercept the TLS                 connection triggers the downgrade with a certificate                 whose signature algorithm has no tls-server-end-point                 channel-binding hash. Examples are Ed25519, Ed448, and                 post-quantum algorithms.


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115706	Atlassian Crowd < 7.2.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115700	Atlassian Jira 10.4.x < 11.3.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
115699	Atlassian Jira < 10.3.24 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
115692	Atlassian Confluence 9.3.x < 10.2.15 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
115691	Atlassian Confluence < 9.2.23 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
459806	Echo: org.postgresql:postgresql: security update to 42.7.12	Tenable Cloud Security	Echo Local Security Checks	Local	high
459806	Echo: org.postgresql:postgresql: security update to 42.7.12	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
325326	Linux Distros Unpatched Vulnerability : CVE-2026-54291	Nessus	Misc.	Local	high
323940	FreeBSD : PostgresSQL JDBC -- Silent channel-binding authentication downgrade via unsupported certificate algorithms (7701f760-745c-11f1-bc50-6cc21735f730)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2026-54291

high

Tenable Plugins

Coming Soon

high

critical

critical

critical

critical

high

high

high

high