VulnerabilityModified

CVE-2026-6478

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate.

MEDIUM 6.5EPSS 0.56%

Does this matter?

Lower severity and a low EPSS score (0.56%). Track it; it rarely justifies an emergency change on its own.

Description

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS: 0.56% probability · 45th percentile
CISA KEV: Not listed
Weakness: CWE-385
Affected: postgresql/postgresql
Source: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.