CVE-2026-6478 is a medium-severity vulnerability in PostgreSQL that arises from a covert timing channel in the comparison of MD5-hashed passwords during authentication. An attacker can exploit this timing side channel to recover user credentials remotely, enabling unauthorized database access. This vulnerability does not affect scram-sha-256 password hashes, which are the default in all supported PostgreSQL releases. However, databases upgraded from PostgreSQL 13 or earlier may still use MD5-hashed passwords and thus remain vulnerable. Red Hat has issued security advisories and patches for affected PostgreSQL versions, particularly for PostgreSQL 13 on Red Hat Enterprise Linux 8. The recommended mitigation is to migrate all user passwords away from MD5 hashing by altering passwords, which updates the hash to the stronger scram-sha-256 method.

The vulnerability allows remote attackers to recover user credentials through a covert timing channel in MD5 password comparison, potentially leading to unauthorized authentication to the PostgreSQL database. This compromises confidentiality and integrity of user credentials but does not affect availability. Systems using scram-sha-256 password hashing are not impacted. The CVSS v3.1 base score assigned by Red Hat is 8.2 (high), reflecting high confidentiality impact and low integrity impact with no availability impact.

A security update fixing this vulnerability is available from Red Hat for PostgreSQL 13 on Red Hat Enterprise Linux 8. Users should apply the official patch from Red Hat advisories (e.g., RHSA-2026:28208). Additionally, to mitigate the risk, all PostgreSQL user passwords should be migrated from MD5 hashing to scram-sha-256 by resetting passwords using the SQL command: ALTER USER username WITH PASSWORD 'new_password'; This will update the password hash to the default stronger algorithm and require users to re-authenticate. Services relying on these credentials may need to be restarted to apply changes. No other mitigation is indicated by the vendor advisory.