StackRadar

CVE-2026-14672

Medium

Advisory

Published 13 Aug 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.003
17th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
152
of 17,781 indexed, latest versions
Container images
130
deployed by those charts
Fix available
7 of 8
affected packages

PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle

Carried by container images the latest versions of 152 of 17,781 indexed charts deploy, on 130 images.

Affected packageAffected versionsFixed inImages
postgresql-17deb17.5-1, 17.5-1.pgdg130+1, 17.6-0+deb13u1, 17.6-2.pgdg13+1+7 more17.11, 17.11-0+deb13u155
postgresql18apk18.1-r0, 18.2-r0, 18.3-r0, 18.4-r018.5-r026
postgresqlbitnami16.1.0-14, 16.1.0-34, 16.2.0-2, 16.2.0-4+15 more16.15.020
postgresql17apk17.2-r0, 17.4-r0, 17.5-r0, 17.6-r0+3 more17.11-r012
postgresql-16deb16.2-1ubuntu4, 16.6-0ubuntu0.24.04.1, 16.9-0ubuntu0.24.04.1, 16.10-0ubuntu0.24.04.1+2 more16.15-0ubuntu0.24.04.111
PostgreSQLbitnami16.0.0, 16.1.0, 16.1.0-34, 16.2.0-2+3 more16.15.07
postgresql-18deb18.4-0ubuntu0.26.04.1, 18.4-1.pgdg26.04+118.6-0ubuntu0.26.04.14
postgresql-9.3deb9.3.22-0ubuntu0.14.04no fix listed1
OSV records
ALPINE-CVE-2026-14672BIT-postgresql-2026-14672DEBIAN-CVE-2026-14672UBUNTU-CVE-2026-14672ECHO-1137-4f23-2f4e
Also known as
USN-8653-1

Charts affected

152 by stars
ChartLatestAffected imagesRadar Score
keycloakwiremindVerified publisher25.3.11 of 2See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2026-14672.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:17.6.0-debian-12-r4926356130b77
postgresql@17.6.0-2
16.15.0

Open the chart page →

7,624
workshop-pipelinesworkshop-pipelines0.1.61 of 2See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-14672.

Container imageDigestPackageFixed in
ghcr.io/bat-bs/bitnami-pgvector:pg1619ebe07b4daf
postgresql@16.6.0-1
16.15.0

Open the chart page →

11,577

Container images carrying it

130 by charts deploying them

A fixed version is listed for 7 of the 8 affected packages.

Container imageDigestPackageFixed inUsed by
gcr.io/datadoghq/private-action-runner:v1.21.05f5918f843a4
postgresql-16@16.13-0ubuntu0.24.04.1
16.15-0ubuntu0.24.04.1
1
ghcr.io/borgmatic-collective/borgmatic:1.9.9835b72878606
postgresql17@17.2-r0
17.11-r0
1
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
postgresql-17@17.7-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/dani-garcia/vaultwarden:1.35.2d89a6d21e361
postgresql-17@17.6-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
postgresql-17@17.8-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
postgresql-17@17.6-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/erlkoenig91/prompt-db-backend:1.0.7ab120359810d
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/firecrawl/nuq-postgres:latestf9388bd25ae2
postgresql-17@17.9-1.pgdg13+1
17.11-0+deb13u1
1
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
postgresql-17@17.8-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
postgresql18@18.4-r0
18.5-r0
1
ghcr.io/home-operations/bazarr:1.6.0cd63bbd0986c
postgresql18@18.4-r0
18.5-r0
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
postgresql18@18.2-r0
18.5-r0
1
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
postgresql-17@17.10-1.pgdg13+1
17.11-0+deb13u1
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
postgresql-17@17.6-2.pgdg13+1
17.11-0+deb13u1
1
ghcr.io/kubelauncher/postgresql1a27e11e5925
postgresql-18@18.4-1.pgdg26.04+1
18.6-0ubuntu0.26.04.1
1
ghcr.io/linuxserver/healthchecks:version-v3.9b5c6bfb00b03
postgresql17@17.4-r0
17.11-r0
1
ghcr.io/linuxserver/syslog-ng:4.10.247fae7f540f9
postgresql18@18.4-r0
18.5-r0
1
ghcr.io/monicahq/monica-next:main8be69156acbb
postgresql-17@17.5-1
17.11-0+deb13u1
1
ghcr.io/nathanvaughn/webtrees:2.2.6034151b61a80
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/ncsa/jupyterhub-metrics/collector:1.3.0dcb8c731bb1b
postgresql17@17.8-r0
17.11-r0
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
postgresql-17@17.9-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
postgresql-17@17.6-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
postgresql-17@17.6-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
postgresql-17@17.9-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/seanmorley15/adventurelog-backend:v0.13.00250d9cb0d74
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/sissbruecker/linkding:1.45.061b2eb9eed8e
postgresql-17@17.6-0+deb13u1
17.11-0+deb13u1
1
public.ecr.aws/datadog/cloudprem:v0.1.33bda08753668d
postgresql-16@16.14-0ubuntu0.24.04.1
16.15-0ubuntu0.24.04.1
1
public.ecr.aws/groundcovercom/temporalio/admin-tools:1.29.7-20260730-1af8cea3b8538
postgresql-17@17.10-1.pgdg13+1+e1
17.11
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
postgresql18@18.4-r0
18.5-r0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.