Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2026-6478

Covert Timing Channel

Published: May 14, 2026 | Modified: Jul 02, 2026
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
8.2 IMPORTANT
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-6478
CWEhttps://cwe.mitre.org/data/definitions/385.html

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Weakness

Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.

Affected Software

NameVendorStart VersionEnd Version
PostgresqlPostgresql*14.23 (excluding)
PostgresqlPostgresql15.0 (including)15.18 (excluding)
PostgresqlPostgresql16.0 (including)16.14 (excluding)
PostgresqlPostgresql17.0 (including)17.10 (excluding)
PostgresqlPostgresql18.0 (including)18.4 (excluding)
Red Hat Enterprise Linux 10RedHatpostgresql18-0:18.4-1.el10_2*
Red Hat Enterprise Linux 10RedHatpostgresql16-0:16.14-1.el10_2*
Red Hat Enterprise Linux 10.0 Extended Update SupportRedHatpostgresql16-0:16.14-1.el10_0*
Red Hat Enterprise Linux 8RedHatpostgresql:15-8100020260605152259.489197e6*
Red Hat Enterprise Linux 8RedHatlibpq-0:13.23-2.el8_10*
Red Hat Enterprise Linux 8RedHatpostgresql:16-8100020260530205218.489197e6*
Red Hat Enterprise Linux 8RedHatpostgresql:13-8100020260605152256.489197e6*
Red Hat Enterprise Linux 8RedHatpostgresql:12-8100020260605152253.489197e6*
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRedHatpostgresql:12-8040020260624104459.522a0ee4*
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRedHatpostgresql:13-8040020260630100922.522a0ee4*
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnRedHatpostgresql:12-8040020260624104459.522a0ee4*
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnRedHatpostgresql:13-8040020260630100922.522a0ee4*
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRedHatpostgresql:12-8060020260623094704.ad008a3a*
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRedHatpostgresql:13-8060020260625065744.ad008a3a*
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-OnRedHatpostgresql:12-8060020260623094704.ad008a3a*
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-OnRedHatpostgresql:13-8060020260625065744.ad008a3a*
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRedHatpostgresql:15-8080020260615085052.63b34585*
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRedHatpostgresql:12-8080020260626093604.63b34585*
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRedHatpostgresql:15-8080020260615085052.63b34585*
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRedHatpostgresql:12-8080020260626093604.63b34585*
Red Hat Enterprise Linux 9RedHatpostgresql:16-9080020260605131007.rhel9*
Red Hat Enterprise Linux 9RedHatpostgresql:18-9080020260605125734.rhel9*
Red Hat Enterprise Linux 9RedHatpostgresql-0:13.23-3.el9_8*
Red Hat Enterprise Linux 9RedHatpostgresql:15-9080020260605124405.rhel9*
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRedHatpostgresql-0:13.23-1.el9_2.2*
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRedHatpostgresql:15-9020020260625101129.rhel9*
Red Hat Enterprise Linux 9.4 Update Services for SAP SolutionsRedHatpostgresql:16-9040020260612132455.rhel9*
Red Hat Enterprise Linux 9.4 Update Services for SAP SolutionsRedHatpostgresql-0:13.23-1.el9_4.2*
Red Hat Enterprise Linux 9.4 Update Services for SAP SolutionsRedHatpostgresql:15-9040020260616071806.rhel9*
Red Hat Enterprise Linux 9.6 Extended Update SupportRedHatpostgresql:16-9060020260612084605.rhel9*
Red Hat Enterprise Linux 9.6 Extended Update SupportRedHatpostgresql-0:13.23-1.el9_6.2*
Red Hat Enterprise Linux 9.6 Extended Update SupportRedHatpostgresql:15-9060020260622062902.rhel9*
Red Hat Hardened ImagesRedHatpostgresql17-main-17.10-0.1.hum1*
Red Hat Hardened ImagesRedHatpostgresql18-main-18.4-0.1.hum1*
Postgresql-10Ubuntuupstream*
Postgresql-12Ubuntuupstream*
Postgresql-14Ubuntujammy*
Postgresql-16Ubuntunoble*
Postgresql-17Ubuntuquesting*
Postgresql-18Ubuntudevel*
Postgresql-18Ubunturesolute*
Postgresql-9.3Ubuntuupstream*
Postgresql-9.5Ubuntuupstream*

Extended Description

In some instances, knowing when data is transmitted between parties can provide a malicious user with privileged information. Also, externally monitoring the timing of operations can potentially reveal sensitive data. For example, a cryptographic operation can expose its internal state if the time it takes to perform the operation varies, based on the state. Covert channels are frequently classified as either storage or timing channels. Some examples of covert timing channels are the system’s paging rate, the time a certain transaction requires to execute, and the time it takes to gain access to a shared bus.

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use