CVE-2026-6478 PostgreSQL discloses MD5-hashed passwords via covert timing channel
Attackers can recover MD5-hashed passwords via timing attacks in legacy PostgreSQL configurations, enabling unauthorized authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6478?
CVE-2026-6478 is a medium-severity vulnerability in Postgresql Postgresql, published on 14 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Weakness: CWE-385
Which versions are affected by CVE-2026-6478?
1 open source package ship an affected version, including postgresql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
postgresql Bitnami | All versions | 14.23.0, 15.18.0, 16.14.0, 17.10.0, 18.4.0 |
Linux distribution packages (10)
pg_repack Rocky Linux:8 | All versions | 0:1.4.6-3.module+el8.10.0+1862+29bef648 |
pg_repack Rocky Linux:8 | All versions | 0:1.4.6-3.module+el8.10.0+40055+b85d5ce2 |
pg_repack Rocky Linux:8 | All versions | 0:1.4.6-3.module+el8.9.0+1594+4a6adae9 |
pg_repack Rocky Linux:8 | All versions | 0:1.4.6-3.module+el8.9.0+1603+444d1b54 |
pgaudit Rocky Linux:8 | All versions | 0:1.5.0-1.module+el8.10.0+40055+b85d5ce2 |
pgaudit Rocky Linux:8 | All versions | 0:1.5.0-1.module+el8.9.0+1594+4a6adae9 |
postgres-decoderbufs Rocky Linux:8 | All versions | 0:0.10.0-2.module+el8.10.0+1862+29bef648 |
postgres-decoderbufs Rocky Linux:8 | All versions | 0:0.10.0-2.module+el8.10.0+40055+b85d5ce2 |
postgres-decoderbufs Rocky Linux:8 | All versions | 0:0.10.0-2.module+el8.9.0+1594+4a6adae9 |
postgres-decoderbufs Rocky Linux:8 | All versions | 0:0.10.0-2.module+el8.9.0+1603+444d1b54 |
Products include Postgresql Postgresql.
How do I fix CVE-2026-6478?
Upgrade postgresql to a fixed version for your release line: 14.23.0, 15.18.0, 16.14.0 or 17.10.0.
Is CVE-2026-6478 being exploited?
There is no known exploitation of CVE-2026-6478 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as ALPINE-CVE-2026-6478, AZL-86819, BELL-CVE-2026-6478, BIT-postgresql-2026-6478, CLSA-2026-1779697425, DEBIAN-CVE-2026-6478 and 11 more.