CVE-2026-6478

Summary

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Affected Software

VendorProductVersion RangeStatus
n/aPostgreSQL18 < 18.4affected
n/aPostgreSQL17 < 17.10affected
n/aPostgreSQL16 < 16.14affected
n/aPostgreSQL15 < 15.18affected
n/aPostgreSQL0 < 14.23affected

Weaknesses

  • CWE-385: Covert Timing Channel

Workarounds

reset password with password_encryption=scram-sha-256

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison

Additional References

References