CVE-2026-6478 is a vulnerability in PostgreSQL 13 where an attacker can recover credentials by exploiting a covert timing channel in the MD5 password comparison process. This timing side-channel allows attackers to infer password information based on the time taken to compare MD5 hashes. Red Hat has released an update for PostgreSQL 13 on Red Hat Enterprise Linux 8 to mitigate this vulnerability. The advisory classifies the security impact as Important. No CVSS score is provided in the advisory.

The vulnerability enables credential recovery through a timing side-channel attack on MD5 password comparison, potentially allowing unauthorized access if exploited. This compromises the confidentiality of user credentials in PostgreSQL 13 installations on affected Red Hat Enterprise Linux 8 systems.

Red Hat has released an official security update for PostgreSQL 13 on Red Hat Enterprise Linux 8 that addresses this vulnerability. Users should apply the update as detailed in the Red Hat advisory (RHSA-2026:28208) and the referenced update article (https://access.redhat.com/articles/11258). No additional mitigations are specified or required beyond applying the official patch.