StackRadar

CVE-2026-14672

Medium

Advisory

Published 13 Aug 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.003
17th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
152
of 17,781 indexed, latest versions
Container images
130
deployed by those charts
Fix available
7 of 8
affected packages

PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle

Carried by container images the latest versions of 152 of 17,781 indexed charts deploy, on 130 images.

Affected packageAffected versionsFixed inImages
postgresql-17deb17.5-1, 17.5-1.pgdg130+1, 17.6-0+deb13u1, 17.6-2.pgdg13+1+7 more17.11, 17.11-0+deb13u155
postgresql18apk18.1-r0, 18.2-r0, 18.3-r0, 18.4-r018.5-r026
postgresqlbitnami16.1.0-14, 16.1.0-34, 16.2.0-2, 16.2.0-4+15 more16.15.020
postgresql17apk17.2-r0, 17.4-r0, 17.5-r0, 17.6-r0+3 more17.11-r012
postgresql-16deb16.2-1ubuntu4, 16.6-0ubuntu0.24.04.1, 16.9-0ubuntu0.24.04.1, 16.10-0ubuntu0.24.04.1+2 more16.15-0ubuntu0.24.04.111
PostgreSQLbitnami16.0.0, 16.1.0, 16.1.0-34, 16.2.0-2+3 more16.15.07
postgresql-18deb18.4-0ubuntu0.26.04.1, 18.4-1.pgdg26.04+118.6-0ubuntu0.26.04.14
postgresql-9.3deb9.3.22-0ubuntu0.14.04no fix listed1
OSV records
ALPINE-CVE-2026-14672BIT-postgresql-2026-14672DEBIAN-CVE-2026-14672UBUNTU-CVE-2026-14672ECHO-1137-4f23-2f4e
Also known as
USN-8653-1

Charts affected

152 by stars
ChartLatestAffected imagesRadar Score
keycloakwiremindVerified publisher25.3.11 of 2See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2026-14672.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:17.6.0-debian-12-r4926356130b77
postgresql@17.6.0-2
16.15.0

Open the chart page →

7,624
workshop-pipelinesworkshop-pipelines0.1.61 of 2See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-14672.

Container imageDigestPackageFixed in
ghcr.io/bat-bs/bitnami-pgvector:pg1619ebe07b4daf
postgresql@16.6.0-1
16.15.0

Open the chart page →

11,577

Container images carrying it

130 by charts deploying them

A fixed version is listed for 7 of the 8 affected packages.

Container imageDigestPackageFixed inUsed by
grafana/oncall:v1.16.5499851658393
postgresql17@17.6-r0
17.11-r0
1
huacnlee/gobackup:v3.1.1560be93229a5
postgresql18@18.4-r0
18.5-r0
1
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
postgresql18@18.4-r0
18.5-r0
1
library/adminer:5.4.2-standalone983261ecc40a
postgresql18@18.4-r0
18.5-r0
1
library/monica:4.1.2-fpm-alpine6d1b2bd0947e
postgresql18@18.4-r0
18.5-r0
1
library/nextcloud:31.0.10-apacheb7faa1653c39
postgresql-17@17.6-0+deb13u1
17.11-0+deb13u1
1
library/postgres:17.5aadf2c0696f5
postgresql-17@17.5-1.pgdg130+1
17.11-0+deb13u1
1
library/postgres:17.10ebba4f4de37f
postgresql-17@17.10-1.pgdg13+1
17.11-0+deb13u1
1
library/python:3.9da5aee29682d
postgresql-17@17.6-0+deb13u1
17.11-0+deb13u1
1
library/redmine:6.1.204ac44a2595b
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
library/teamspeak:3.13.815acbc64c92f
postgresql18@18.4-r0
18.5-r0
1
library/teamspeak:3.13.74d3fa1c0db9a
postgresql18@18.3-r0
18.5-r0
1
linkstackorg/linkstack:latest1c8b05399ee4
postgresql17@17.8-r0
17.11-r0
1
lissy93/domain-locker:latestd3c95edc0a8b
postgresql18@18.3-r0
18.5-r0
1
mediagis/nominatim:5.3.27923a8e67197
postgresql-16@16.14-0ubuntu0.24.04.1
16.15-0ubuntu0.24.04.1
1
mindsdb/mindsdb:latest163011c09299
postgresql-17@17.9-0+deb13u1
17.11-0+deb13u1
1
mybb/mybb:1.8f2a54bce31c5
postgresql18@18.4-r0
18.5-r0
1
netboxcommunity/netbox:v4.6.10-5.0.291b823a05cb5
postgresql-18@18.4-0ubuntu0.26.04.1
18.6-0ubuntu0.26.04.1
1
novosga/novosga:latest34b9acbe6e51
postgresql18@18.3-r0
18.5-r0
1
octoboxio/octobox:latestd909041c46eb
postgresql18@18.1-r0
18.5-r0
1
opendatacube/explorer:latest120457ffcd69
postgresql-16@16.10-0ubuntu0.24.04.1
16.15-0ubuntu0.24.04.1
1
passbolt/passbolt:5.13.0-1-ceaf3a620902a0
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
photoprism/photoprism:260601650c6ad5a651
postgresql-18@18.4-0ubuntu0.26.04.1
18.6-0ubuntu0.26.04.1
1
photoprism/photoprism:260728958642220223
postgresql-18@18.4-0ubuntu0.26.04.1
18.6-0ubuntu0.26.04.1
1
pretix/standalone:2026.7.05df3b7aa852e
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
privatebin/nginx-fpm-alpine:2.0.613290e2f04bf
postgresql18@18.4-r0
18.5-r0
1
proxysql/proxysql:3.0.8947a7abad45b
postgresql-17@17.9-0+deb13u1
17.11-0+deb13u1
1
qonstrukt/php:8.4-v8-apache089af7925aa1
postgresql-16@16.14-0ubuntu0.24.04.1
16.15-0ubuntu0.24.04.1
1
rommapp/romm:4.4.1b909e95d1aab
postgresql17@17.7-r0
17.11-r0
1
roundcube/roundcubemail:1.6.16-apache-nonroot17d9d9580962
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
sissbruecker/linkding:1.46.20c0a9a04c7eb
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
sonroyaalmerol/docker-sogo:5.12.43f60f3abe990
postgresql-17@17.7-0+deb13u1
17.11-0+deb13u1
1
sslhep/servicex_app:v1.8.51d12f943cec5
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
sslhep/servicex_code_gen_atlas_xaod:v1.8.5e7aff7f97b89
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
sslhep/servicex_code_gen_func_adl_uproot:v1.8.5b01b8ee966ed
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
sslhep/servicex_code_gen_python:v1.8.50e4175a4e1eb
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
sslhep/servicex_code_gen_raw_uproot:v1.8.5671980005c57
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
sslhep/servicex_code_gen_topcp:v1.8.5596db2abdd09
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
sslhep/servicex-did-finder-atlasopenmagic:v1.8.554aaf1721d03
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
sslhep/servicex-did-finder-cernopendata:v1.8.52cb88ceab5bb
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
sslhep/servicex-did-finder-xrootd:v1.8.5c284442b44e3
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
szurubooru/server:2.5accf2ad9fbc3
postgresql17@17.10-r0
17.11-r0
1
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
postgresql17@17.5-r0
17.11-r0
1
temporalio/admin-tools:1.28cfde8170c92f
postgresql18@18.2-r0
18.5-r0
1
tock/gen-ai-orchestrator-server:25.10.7abf7880e0449
postgresql-17@17.8-0+deb13u1
17.11-0+deb13u1
1
twentycrm/twenty:v2.22.0e7d9948bf284
postgresql18@18.4-r0
18.5-r0
1
vabene1111/recipes:2.3.50f8d061895e9
postgresql17@17.7-r0
17.11-r0
1
vaultwarden/server:1.35.443498a94b22f
postgresql-17@17.8-0+deb13u1
17.11-0+deb13u1
1
vaultwarden/server:1.35.79a8eec71f4a5
postgresql-17@17.9-0+deb13u1
17.11-0+deb13u1
1
wger/server:2.6997ead43aabd
postgresql-16@16.14-0ubuntu0.24.04.1
16.15-0ubuntu0.24.04.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.