CVE-2026-6478
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A covert timing channel in the comparison of MD5-hashed passwords in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, existing databases may have MD5-hashed passwords from upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Risk Assessment
The organization risks theft of user credentials, potentially leading to unauthorized database access and data breaches.
Recommendation
Upgrade PostgreSQL to version 18.4, 17.10, 16.14, 15.18, 14.23 or later. Consider migrating passwords from MD5 to scram-sha-256.
Other vulnerabilities in PostgreSQL
See all- CVE-2017-15098High
Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.
- CVE-2017-7548High
PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to an authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service.
- CVE-2017-7547High
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8, and 9.6.4 are vulnerable to an authorization flaw allowing remote authenticated attackers to retrieve passwords from user mappings defined by foreign server owners without actually having the privileges to do so.
- CVE-2017-7484High
Some selectivity estimation functions in PostgreSQL before version 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, potentially leaking data. An unprivileged attacker could exploit this flaw to steal information from tables they would otherwise not have access to.
- CVE-2016-5424High
PostgreSQL versions before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 may allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges through mishandling of special characters in database or role names.
- CVE-2016-5423High
PostgreSQL versions before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server crash), obtain sensitive memory information, or possibly execute arbitrary code via (1) a CASE expression within the test value subexpression of another CASE or (2) inlining of an SQL function that implements the equality operator used for a CASE expression involving values of different types.
- CVE-2016-2193High
PostgreSQL before 9.5.x before 9.5.2 does not properly maintain row-security status in cached plans, which might allow attackers to bypass intended access restrictions.
- CVE-2016-0773High
PostgreSQL versions before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 are vulnerable to remote attacks that can lead to denial of service via an infinite loop or buffer overflow.
- CVE-2016-0766High
PostgreSQL versions before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 do not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, allowing attackers to gain privileges via unspecified vectors.
- CVE-2024-10976Medium
Incomplete tracking in PostgreSQL of tables with row security allows reused queries to view or change different rows than intended. Fixes for CVE-2023-2455 and CVE-2016-2193 missed cases involving subqueries, WITH queries, and security invoker views.
Original NVD description (English source)
Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.