CVE-2026-6478: PostgreSQL discloses MD5-hashed passwords via covert timing channel

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-14 · updated 2026-08-25
Weakness: CWE-385

Description

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Affected products

PostgreSQL: before 14.23; from 15.0 before 15.18; from 16.0 before 16.14; from 17.0 before 17.10; from 18.0 before 18.4 — fixed in 14.23, 15.18, 16.14, 17.10, 18.4

How to fix

Upgrade to a fixed version: PostgreSQL 14.23, 15.18, 16.14, 17.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-6478 or the next vulnerability affects your stack