CVE-2026-6478

A flaw was found in PostgreSQL. This vulnerability, a covert timing channel, exists in the comparison of MD5-hashed passwords during authentication. A remote attacker could exploit this to recover user credentials, gaining unauthorized access to the database. This issue specifically impacts databases that retain MD5-hashed passwords from upgrades of PostgreSQL 13 or earlier.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, ensure that all PostgreSQL user passwords are not hashed using MD5. Users should migrate to stronger hashing algorithms such as scram-sha-256. This can be achieved by altering user passwords, which will automatically update their hash to the currently configured default. For example, to change a user's password: ALTER USER username WITH PASSWORD 'new_password'; This action will require users to re-authenticate. If a service relies on these credentials, it may require a restart to pick up the new authentication details.