Critical Security Update for PostgreSQL: Credential Recovery Vulnerability in MD5 Password Comparison
Summary
ALSA-2026:28208: Important: postgresql:13 security update. Affects pg_repack across 2 version ranges.
< 1.4.6-3.module_el8.6.0+2760+1746ec94
< 1.4.6-3.module_el8.6.0+3095+ee60d910
Fixed in 1.4.6-3.module_el8.6.0+2760+1746ec94 or 1.4.6-3.module_el8.6.0+3095+ee60d910, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, extensibility, and compliance with SQL standards. It supports various data types and offers features like transactions, subselects, triggers, views, and stored procedures. However, a recent vulnerability has been identified that affects its MD5 password comparison mechanism, potentially allowing unauthorized credential recovery through a covert timing channel.
Vulnerability Detail
The vulnerability, identified as CVE-2026-6478, arises from the way PostgreSQL handles MD5 password comparisons. An attacker could exploit this flaw to recover user credentials by measuring the time it takes for the server to respond to authentication attempts. This covert timing channel could lead to unauthorized access to sensitive data, posing a significant security risk to applications relying on PostgreSQL for data management.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update pg_repack-
< 1.4.6-3.module_el8.6.0+2760+1746ec941.4.6-3.module_el8.6.0+2760+1746ec94 -
< 1.4.6-3.module_el8.6.0+3095+ee60d9101.4.6-3.module_el8.6.0+3095+ee60d910
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, consider disabling MD5 password authentication in your PostgreSQL configuration until the update can be applied. This can be done by modifying the pg_hba.conf file to use a more secure authentication method.
Conclusion
The vulnerability CVE-2026-6478 poses a significant risk to PostgreSQL installations by allowing unauthorized credential recovery through timing attacks. It is crucial to update affected packages to their patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for pg_repack →
FAQ
CVE-2026-6478 is a vulnerability in PostgreSQL that allows attackers to recover user credentials through a covert timing channel in MD5 password comparisons.
If you are using an affected version of PostgreSQL or related packages, you may be at risk. Use tools like Vulert to check your application for vulnerabilities.
If immediate updates are not possible, consider disabling MD5 authentication temporarily and switching to a more secure authentication method.
Detailed information can be found on the CVE page for CVE-2026-6478, which includes the impact, CVSS score, and acknowledgments.
Vulert monitors and alerts in real-time for open-source vulnerabilities using a manifest file like package-lock.json, allowing users to stay informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
