CVE-2026-6478: PostgreSQL discloses MD5-hashed passwords via covert timing channel
Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Other sources
PostgreSQL discloses MD5-hashed passwords via covert timing channel
— Microsoft
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6478?
CVE-2026-6478 is classified as a high severity vulnerability due to the potential exposure of user credentials.
How do I fix CVE-2026-6478?
To fix CVE-2026-6478, update PostgreSQL to a version that is not affected, specifically switching to scram-sha-256 authentication.
Which versions of PostgreSQL are affected by CVE-2026-6478?
CVE-2026-6478 affects PostgreSQL versions up to 18.4, 17.10, 16.14, 15.18, and 14.23.
What impact does CVE-2026-6478 have on PostgreSQL security?
CVE-2026-6478 allows attackers to potentially recover user credentials, compromising the authentication process.
Is the scram-sha-256 password method affected by CVE-2026-6478?
No, scram-sha-256 passwords are not affected by CVE-2026-6478 and should be used as a secure alternative.