CVE-2026-14672
MediumAdvisory
Published 13 Aug 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.003
- 17th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 152
- of 17,781 indexed, latest versions
- Container images
- 130
- deployed by those charts
- Fix available
- 7 of 8
- affected packages
PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle
Carried by container images the latest versions of 152 of 17,781 indexed charts deploy, on 130 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| postgresql-17deb | 17.5-1, 17.5-1.pgdg130+1, 17.6-0+deb13u1, 17.6-2.pgdg13+1+7 more | 17.11, 17.11-0+deb13u1 | 55 |
| postgresql18apk | 18.1-r0, 18.2-r0, 18.3-r0, 18.4-r0 | 18.5-r0 | 26 |
| postgresqlbitnami | 16.1.0-14, 16.1.0-34, 16.2.0-2, 16.2.0-4+15 more | 16.15.0 | 20 |
| postgresql17apk | 17.2-r0, 17.4-r0, 17.5-r0, 17.6-r0+3 more | 17.11-r0 | 12 |
| postgresql-16deb | 16.2-1ubuntu4, 16.6-0ubuntu0.24.04.1, 16.9-0ubuntu0.24.04.1, 16.10-0ubuntu0.24.04.1+2 more | 16.15-0ubuntu0.24.04.1 | 11 |
| PostgreSQLbitnami | 16.0.0, 16.1.0, 16.1.0-34, 16.2.0-2+3 more | 16.15.0 | 7 |
| postgresql-18deb | 18.4-0ubuntu0.26.04.1, 18.4-1.pgdg26.04+1 | 18.6-0ubuntu0.26.04.1 | 4 |
| postgresql-9.3deb | 9.3.22-0ubuntu0.14.04 | no fix listed | 1 |
- OSV records
- ALPINE-CVE-2026-14672BIT-postgresql-2026-14672DEBIAN-CVE-2026-14672UBUNTU-CVE-2026-14672ECHO-1137-4f23-2f4e
- Also known as
- USN-8653-1
Charts affected
152 by stars
Container images carrying it
130 by charts deploying them
A fixed version is listed for 7 of the 8 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| grafana/ | 499851658393 | postgresql17 | 17.11-r0 | 1 |
| huacnlee/ | 560be93229a5 | postgresql18 | 18.5-r0 | 1 |
| jupyterjsc/ | aea53b13f235 | postgresql18 | 18.5-r0 | 1 |
| library/ | 983261ecc40a | postgresql18 | 18.5-r0 | 1 |
| library/ | 6d1b2bd0947e | postgresql18 | 18.5-r0 | 1 |
| library/ | b7faa1653c39 | postgresql-17 | 17.11-0+deb13u1 | 1 |
| library/ | aadf2c0696f5 | postgresql-17 | 17.11-0+deb13u1 | 1 |
| library/ | ebba4f4de37f | postgresql-17 | 17.11-0+deb13u1 | 1 |
| library/ | da5aee29682d | postgresql-17 | 17.11-0+deb13u1 | 1 |
| library/ | 04ac44a2595b | postgresql-17 | 17.11-0+deb13u1 | 1 |
| library/ | 15acbc64c92f | postgresql18 | 18.5-r0 | 1 |
| library/ | 4d3fa1c0db9a | postgresql18 | 18.5-r0 | 1 |
| linkstackorg/ | 1c8b05399ee4 | postgresql17 | 17.11-r0 | 1 |
| lissy93/ | d3c95edc0a8b | postgresql18 | 18.5-r0 | 1 |
| mediagis/ | 7923a8e67197 | postgresql-16 | 16.15-0ubuntu0.24.04.1 | 1 |
| mindsdb/ | 163011c09299 | postgresql-17 | 17.11-0+deb13u1 | 1 |
| mybb/ | f2a54bce31c5 | postgresql18 | 18.5-r0 | 1 |
| netboxcommunity/ | 91b823a05cb5 | postgresql-18 | 18.6-0ubuntu0.26.04.1 | 1 |
| novosga/ | 34b9acbe6e51 | postgresql18 | 18.5-r0 | 1 |
| octoboxio/ | d909041c46eb | postgresql18 | 18.5-r0 | 1 |
| opendatacube/ | 120457ffcd69 | postgresql-16 | 16.15-0ubuntu0.24.04.1 | 1 |
| passbolt/ | af3a620902a0 | postgresql-17 | 17.11-0+deb13u1 | 1 |
| photoprism/ | 650c6ad5a651 | postgresql-18 | 18.6-0ubuntu0.26.04.1 | 1 |
| photoprism/ | 958642220223 | postgresql-18 | 18.6-0ubuntu0.26.04.1 | 1 |
| pretix/ | 5df3b7aa852e | postgresql-17 | 17.11-0+deb13u1 | 1 |
| privatebin/ | 13290e2f04bf | postgresql18 | 18.5-r0 | 1 |
| proxysql/ | 947a7abad45b | postgresql-17 | 17.11-0+deb13u1 | 1 |
| qonstrukt/ | 089af7925aa1 | postgresql-16 | 16.15-0ubuntu0.24.04.1 | 1 |
| rommapp/ | b909e95d1aab | postgresql17 | 17.11-r0 | 1 |
| roundcube/ | 17d9d9580962 | postgresql-17 | 17.11-0+deb13u1 | 1 |
| sissbruecker/ | 0c0a9a04c7eb | postgresql-17 | 17.11-0+deb13u1 | 1 |
| sonroyaalmerol/ | 3f60f3abe990 | postgresql-17 | 17.11-0+deb13u1 | 1 |
| sslhep/ | 1d12f943cec5 | postgresql-17 | 17.11-0+deb13u1 | 1 |
| sslhep/ | e7aff7f97b89 | postgresql-17 | 17.11-0+deb13u1 | 1 |
| sslhep/ | b01b8ee966ed | postgresql-17 | 17.11-0+deb13u1 | 1 |
| sslhep/ | 0e4175a4e1eb | postgresql-17 | 17.11-0+deb13u1 | 1 |
| sslhep/ | 671980005c57 | postgresql-17 | 17.11-0+deb13u1 | 1 |
| sslhep/ | 596db2abdd09 | postgresql-17 | 17.11-0+deb13u1 | 1 |
| sslhep/ | 54aaf1721d03 | postgresql-17 | 17.11-0+deb13u1 | 1 |
| sslhep/ | 2cb88ceab5bb | postgresql-17 | 17.11-0+deb13u1 | 1 |
| sslhep/ | c284442b44e3 | postgresql-17 | 17.11-0+deb13u1 | 1 |
| szurubooru/ | accf2ad9fbc3 | postgresql17 | 17.11-r0 | 1 |
| temporalio/ | a3a52e6ca122 | postgresql17 | 17.11-r0 | 1 |
| temporalio/ | cfde8170c92f | postgresql18 | 18.5-r0 | 1 |
| tock/ | abf7880e0449 | postgresql-17 | 17.11-0+deb13u1 | 1 |
| twentycrm/ | e7d9948bf284 | postgresql18 | 18.5-r0 | 1 |
| vabene1111/ | 0f8d061895e9 | postgresql17 | 17.11-r0 | 1 |
| vaultwarden/ | 43498a94b22f | postgresql-17 | 17.11-0+deb13u1 | 1 |
| vaultwarden/ | 9a8eec71f4a5 | postgresql-17 | 17.11-0+deb13u1 | 1 |
| wger/ | 997ead43aabd | postgresql-16 | 16.15-0ubuntu0.24.04.1 | 1 |