Skip to main content

PostgreSQL CVE-2026-6478

| EUVDEUVD-2026-30289 MEDIUM
Covert Timing Channel (CWE-385)
2026-05-14 PostgreSQL GHSA-r6v6-v5r9-3ggh
Information Disclosure PostgreSQL
6.5
CVSS 3.1 · Vendor: PostgreSQL
Share

Severity by source

Vendor (PostgreSQL) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
SUSE
MEDIUM
qualitative
Red Hat
8.2 HIGH
qualitative

Primary rating from Vendor (PostgreSQL).

CVSS VectorVendor: PostgreSQL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
Patch available
May 14, 2026 - 15:01 EUVD
Analysis Generated
May 14, 2026 - 14:03 vuln.today
CVE Published
May 14, 2026 - 13:00 nvd
MEDIUM 6.5

DescriptionCVE.org

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

AnalysisAI

Timing-channel attack in PostgreSQL MD5 password authentication enables remote unauthenticated attackers to extract user credentials through statistical analysis of authentication response times, affecting versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23. The vulnerability exploits variable-time comparison operations during MD5 password hash verification, but does not impact the default scram-sha-256 authentication method. Databases migrated from PostgreSQL 13 or earlier may retain MD5-hashed passwords and remain vulnerable despite running newer versions.

Technical ContextAI

PostgreSQL's legacy MD5 password authentication mechanism uses a comparison function that exhibits timing variations correlated with password correctness. This is a timing-channel vulnerability (CWE-385: Comparison Using Wrong Factors) where the duration of cryptographic operations leaks information about secret values. An attacker observing network response times can statistically infer MD5 password hash correctness without exhaustive brute-force attempts. The scram-sha-256 authentication method, introduced as the default in PostgreSQL 10 and mandatory in current releases, uses constant-time comparison and is not vulnerable. However, legacy MD5 passwords persisting from PostgreSQL 13 and earlier installations remain exposed, even after upgrading to patched versions, unless explicitly rehashed with scram-sha-256.

RemediationAI

Apply vendor-released security patches: upgrade to PostgreSQL 18.4, 17.10, 16.14, 15.18, or 14.23 or later. After patching, execute an immediate password reset or rehash operation for all user accounts to convert MD5 hashes to scram-sha-256 using the ALTER USER command with PASSWORD clause or the pg_upgrade utility with the --auth-local scram option for new installations. For environments unable to patch immediately, implement compensating controls: disable MD5 authentication at the server level by setting password_encryption = 'scram-sha256' in postgresql.conf and disallowing md5 in pg_hba.conf (require scram-sha-256 via authentication rules); restrict database network exposure using firewalls to limit authentication probe traffic; monitor authentication logs for anomalous timing-probe patterns (rapid failed attempts from single sources). These controls prevent new MD5 accounts but do not protect existing MD5 hashes. See PostgreSQL security advisory at https://www.postgresql.org/support/security/CVE-2026-6478/ for version-specific patch details.

More in PostgreSQL

View all
CVE-2025-1094 HIGH POC
8.1 Feb 13

PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
CVE-2024-55964 CRITICAL POC
9.8 Mar 26

An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
CVE-2013-1899 MEDIUM POC
6.5 Apr 04

Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
CVE-2026-20253 CRITICAL POC
9.8 Jun 10

Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
CVE-2017-7546 CRITICAL
9.8 Aug 16

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
CVE-2015-1352 MEDIUM POC
5.0 Mar 30

The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
CVE-2024-10553 CRITICAL POC
9.8 Mar 20

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
CVE-2019-9193 HIGH POC
7.2 Apr 01

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
CVE-2026-40887 CRITICAL POC
9.1 Apr 14

## Summary An unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query strin
CVE-2022-24760 CRITICAL POC
10.0 Mar 12

Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
CVE-2025-56157 CRITICAL POC
9.8 Dec 18

Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
CVE-2024-12909 CRITICAL POC
9.8 Mar 20

A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for

Same weakness CWE-385 – Covert Timing Channel

View all
CVE-2020-25658 MEDIUM POC
5.9
CVE-2024-45192 MEDIUM POC
5.3
CVE-2026-5598 HIGH
8.9
CVE-2025-9231 MEDIUM
6.5
CVE-2025-49087 MEDIUM POC
4.0
CVE-2023-3640 HIGH
7.8
CVE-2024-25964 HIGH
7.5
CVE-2022-24409 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

Share

CVE-2026-6478 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy