CVE-2026-6478
MEDIUM EPSS 14.8%
Published May 14, 20261mo ago · Modified Jun 17, 20261w ago
6.5 CVSS 3.1
Published May 14, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago
Description
Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Low
Availability None
Threat Intelligence
EPSS Exploit Probability
14.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-385
Affected Products 5
| Vendor | Product | Version | Range |
|---|---|---|---|
| postgresql | postgresql | * | <14.23 |
| postgresql | postgresql | * | ≥15.0 – <15.18 |
| postgresql | postgresql | * | ≥16.0 – <16.14 |
| postgresql | postgresql | * | ≥17.0 – <17.10 |
| postgresql | postgresql | * | ≥18.0 – <18.4 |
References 1
- postgresql.org https://www.postgresql.org/support/security/CVE-2026-6478/
Remediation
- postgresql.org https://www.postgresql.org/support/security/CVE-2026-6478/