medium CVSS 6.5 EPSS 0.56%

CVE-2026-6478·PostgreSQL vulnerability

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Severity
medium
Software
PostgreSQL
Fixed in
18.4
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.56% — higher than 45% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

From: 18.0

Until: 18.4

Fixed in: 18.4

How to fix this CVE

Upgrade PostgreSQL to version 18.4 or later to eliminate the timing channel vulnerability in MD5 password authentication. Organizations running PostgreSQL 18.0–18.3 should prioritize this update, especially if legacy MD5-hashed passwords remain in their user tables from pre-13 migrations. While SCRAM-SHA-256 is the default in current releases, any database accepting MD5 hashes is exposed to password recovery through timing analysis.

sudo dnf update postgresql-server postgresql-contrib

Defensia detects this vulnerability

How to check if you are affected

  1. Step 1: Check PostgreSQL version with `psql --version` or connect to the database and run `SELECT version();`
  2. Step 2: Query user authentication methods with `SELECT usename, usepassword FROM pg_shadow;` or `\du` in psql to identify MD5-hashed passwords (those prefixed with 'md5')
  3. Step 3: Review PostgreSQL logs for repeated authentication attempts from a single source within short time intervals, which may indicate timing-based credential recovery: `grep 'authentication failed' /var/log/postgresql/postgresql.log`
  4. Step 4: Verify the patch by running `SELECT version();` after upgrade and confirm the version is 18.4 or higher

FAQ

What is CVE-2026-6478?

This vulnerability exploits a timing side-channel in PostgreSQL's MD5 password comparison logic, allowing attackers to infer password characters by measuring response delays during authentication. The flaw does not affect SCRAM-SHA-256 hashes, which use constant-time comparison.

Is CVE-2026-6478 being actively exploited?

No, there are no known active exploits or public proof-of-concept code for this vulnerability at this time, and it is not listed in the CISA Known Exploited Vulnerabilities catalog.

What versions of PostgreSQL are affected by CVE-2026-6478?

PostgreSQL versions 18.0 through 18.3 are vulnerable. Versions 18.4, 17.10, 16.14, 15.18, and 14.23 (and later) contain the fix.

How do I check if my server is vulnerable to CVE-2026-6478?

Run `psql -c 'SELECT version();'` to check your PostgreSQL version. If it returns 18.0–18.3, your installation is vulnerable. Additionally, query `SELECT usename FROM pg_shadow WHERE usepassword ~ '^md5';` to identify databases still using legacy MD5 password hashes.

Does Defensia detect CVE-2026-6478?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-6478 will appear in your dashboard with remediation steps.

Related PostgreSQL CVEs

CVE-2026-14669CVSS 8.8Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14671CVSS 8.8Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14670CVSS 8.8Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-15742CVSS 8.8Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-16238CVSS 8.8Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-6478. Free for 1 server.

Get started free