CVE-2026-6478 is a vulnerability in PostgreSQL where a covert timing channel in the comparison of MD5-hashed passwords during authentication can be exploited to recover user credentials. This vulnerability affects PostgreSQL versions before 18.4, 17.10, 16.14, 15.18, and 14.23. The issue does not impact scram-sha-256 password authentication, which is the default in supported releases. The vulnerability is relevant for databases that retain MD5-hashed passwords, often due to upgrades from PostgreSQL 13 or earlier. The CVSS v3.1 base score is 6.5 (medium severity), with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity but not availability. Red Hat has issued security advisories and errata addressing this vulnerability with updated PostgreSQL packages.

An attacker can exploit the timing channel in MD5 password comparison to recover user credentials sufficient to authenticate to the PostgreSQL database. This compromises confidentiality and integrity of user authentication. The vulnerability does not affect the default scram-sha-256 password method, limiting impact to systems still using MD5-hashed passwords, typically from upgrades. There are no known exploits in the wild at this time.

Red Hat has released updated PostgreSQL packages that fix this vulnerability. Users should apply the security updates provided in the Red Hat advisories (e.g., RHSA-2026:27718 and related errata) to remediate the issue. Since the vulnerability does not affect scram-sha-256 passwords, migrating to this authentication method where possible further mitigates risk. Patch status is confirmed via Red Hat advisories; therefore, applying the official updates is the recommended remediation.