Detections
Analytics
CVE-2026-6478
high
Description
Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
References
https://www.postgresql.org/support/security/CVE-2026-6478/
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6478.json
https://bugzilla.redhat.com/show_bug.cgi?id=2477447
https://access.redhat.com/security/cve/CVE-2026-6478
https://access.redhat.com/errata/RHSA-2026:35880
https://access.redhat.com/errata/RHSA-2026:34363
https://access.redhat.com/errata/RHSA-2026:34362
https://access.redhat.com/errata/RHSA-2026:34043
https://access.redhat.com/errata/RHSA-2026:33497
https://access.redhat.com/errata/RHSA-2026:33441
https://access.redhat.com/errata/RHSA-2026:32994
https://access.redhat.com/errata/RHSA-2026:32983
https://access.redhat.com/errata/RHSA-2026:29953
https://access.redhat.com/errata/RHSA-2026:29904
https://access.redhat.com/errata/RHSA-2026:29815
https://access.redhat.com/errata/RHSA-2026:29212
https://access.redhat.com/errata/RHSA-2026:28999
https://access.redhat.com/errata/RHSA-2026:28208
https://access.redhat.com/errata/RHSA-2026:28143
https://access.redhat.com/errata/RHSA-2026:28037
https://access.redhat.com/errata/RHSA-2026:27743
https://access.redhat.com/errata/RHSA-2026:27742
https://access.redhat.com/errata/RHSA-2026:27741
https://access.redhat.com/errata/RHSA-2026:27738
https://access.redhat.com/errata/RHSA-2026:27718
https://access.redhat.com/errata/RHSA-2026:26561
https://access.redhat.com/errata/RHSA-2026:26525
https://access.redhat.com/errata/RHSA-2026:26524
https://access.redhat.com/errata/RHSA-2026:26204
https://access.redhat.com/errata/RHSA-2026:26203
https://access.redhat.com/errata/RHSA-2026:26181