CVE-2026-6478 MEDIUM

CVE-2026-6478: PostgreSQL discloses MD5-hashed passwords via covert timing channel

Vendor N/A
Product PostgreSQL
Weakness CWE-385
Published May 14, 2026
Last update June 30, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Key dates

02Disclosure timeline

May 14, 2026 CVE published
June 30, 2026 Record updated