A covert timing channel exists in PostgreSQL when it compares MD5-hashed passwords. The timing differences allow an attacker who can trigger authentication attempts to deduce the correct hash and recover user credentials, enabling unauthorized authentication. The flaw does not affect passwords encrypted with SCRAM‑SHA‑256, which is the default method in all current releases.

The vulnerability is present in PostgreSQL releases prior to 18.4, 17.10, 16.14, 15.18 and 14.23. Databases that upgraded from PostgreSQL 13 or earlier may still contain MD5‑hashed passwords, even though the default configuration now uses SCRAM‑SHA‑256.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to observe timed authentication responses, either over the network or locally. Once exploited, the attacker can obtain user passwords sufficient for authentication, representing a significant risk to confidentiality and system integrity.