CVE-2026-6478 describes a covert timing channel vulnerability in PostgreSQL authentication involving the comparison of MD5-hashed passwords. This timing channel can be exploited by an attacker to recover credentials sufficient to authenticate as a user. The vulnerability specifically affects MD5 password authentication and does not impact scram-sha-256 authentication, which is the default in supported PostgreSQL versions. The issue affects PostgreSQL versions prior to 18.4, 17.10, 16.14, 15.18, and 14.23, particularly in databases upgraded from versions 13 or earlier that still retain MD5-hashed passwords. No official remediation level or patch links are provided in the available data.

An attacker can exploit the timing channel in MD5 password comparison to recover user credentials sufficient to authenticate to the PostgreSQL database. This could lead to unauthorized access. The vulnerability does not affect scram-sha-256 password authentication, which is the default in supported releases. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability only affects MD5-hashed passwords, migrating to scram-sha-256 password authentication, which is the default in supported PostgreSQL releases, mitigates the risk. Users should verify their PostgreSQL version and upgrade to at least versions 18.4, 17.10, 16.14, 15.18, or 14.23 or later once official patches or updates are released. Monitor the official PostgreSQL security advisories for updates.