StackRadar

CVE-2026-14681

Medium

Advisory

Published 13 Aug 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.2
base score, highest
EPSS
0.001
0th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
120
of 17,781 indexed, latest versions
Container images
106
deployed by those charts
Fix available
5 of 6
affected packages

PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL

Carried by container images the latest versions of 120 of 17,781 indexed charts deploy, on 106 images.

Affected packageAffected versionsFixed inImages
postgresql-17deb17.5-1, 17.5-1.pgdg130+1, 17.6-0+deb13u1, 17.6-2.pgdg13+1+7 more17.11, 17.11-0+deb13u155
postgresql18apk18.1-r0, 18.2-r0, 18.3-r0, 18.4-r018.5-r026
postgresql17apk17.2-r0, 17.4-r0, 17.5-r0, 17.6-r0+3 more17.11-r012
postgresqlbitnami17.2.0-1, 17.2.0-4, 17.4.0-9, 17.5.0-9+4 more17.11.08
postgresql-18deb18.4-0ubuntu0.26.04.1, 18.4-1.pgdg26.04+118.6-0ubuntu0.26.04.14
postgresql-9.3deb9.3.22-0ubuntu0.14.04no fix listed1
OSV records
ALPINE-CVE-2026-14681BIT-postgresql-2026-14681DEBIAN-CVE-2026-14681UBUNTU-CVE-2026-14681ECHO-1690-243f-9082
Also known as
USN-8653-1

Charts affected

120 by stars
ChartLatestAffected imagesRadar Score
pgbouncerpostgres-pgbouncerVerified publisher0.4.01 of 1See more

pgbouncer postgres-pgbouncer 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-14681.

Container imageDigestPackageFixed in
edoburu/pgbouncer:latest4c1ca296ef52
postgresql18@18.4-r0
18.5-r0

Open the chart page →

651
prompt-dbprompt-dbVerified publisher1.0.71 of 3See more

prompt-db prompt-db 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-14681.

Container imageDigestPackageFixed in
ghcr.io/erlkoenig91/prompt-db-backend:1.0.7ab120359810d
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1

Open the chart page →

3,332
kresusrm3lVerified publisher0.2.11 of 3See more

kresus rm3l 0.2.1

1 of the 3 container images this version deploys carry CVE-2026-14681.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:17.5.0-debian-12-r16687034f33da6
postgresql@17.5.0-11
17.11.0

Open the chart page →

15,591
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-14681.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
postgresql-17@17.6-0+deb13u1
17.11-0+deb13u1

Open the chart page →

10,605
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-14681.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
postgresql17@17.7-r0
17.11-r0

Open the chart page →

4,499
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-14681.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:17.2.0-debian-12-r2e6fa49bb0347
postgresql@17.2.0-1
17.11.0

Open the chart page →

7,413
linkdingrubxkubeVerified publisher1.2.31 of 1See more

linkding rubxkube 1.2.3

1 of the 1 container images this version deploys carry CVE-2026-14681.

Container imageDigestPackageFixed in
sissbruecker/linkding:1.46.20c0a9a04c7eb
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1

Open the chart page →

2,051
transmissionryuunosukeds31.6.21 of 2See more

transmission ryuunosukeds3 1.6.2

1 of the 2 container images this version deploys carry CVE-2026-14681.

Container imageDigestPackageFixed in
library/python:3.9da5aee29682d
postgresql-17@17.6-0+deb13u1
17.11-0+deb13u1

Open the chart page →

9,534
nextcloudsb-helm-charts0.4.01 of 2See more

nextcloud sb-helm-charts 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-14681.

Container imageDigestPackageFixed in
library/nextcloud:31.0.10-apacheb7faa1653c39
postgresql-17@17.6-0+deb13u1
17.11-0+deb13u1

Open the chart page →

9,755
pev2schichtelVerified publisher0.3.01 of 1See more

pev2 schichtel 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-14681.

Container imageDigestPackageFixed in
dalibo/explain.dalibo.com:2.20.12a0b749c2f7f
postgresql18@18.2-r0
18.5-r0

Open the chart page →

1,178
teamspeak3schichtelVerified publisher1.0.21 of 1See more

teamspeak3 schichtel 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-14681.

Container imageDigestPackageFixed in
library/teamspeak:3.13.74d3fa1c0db9a
postgresql18@18.3-r0
18.5-r0

Open the chart page →

774
photoprismschoolguys-helmcharts0.3.81 of 1See more

photoprism schoolguys-helmcharts 0.3.8

1 of the 1 container images this version deploys carry CVE-2026-14681.

Container imageDigestPackageFixed in
photoprism/photoprism:260601650c6ad5a651
postgresql-18@18.4-0ubuntu0.26.04.1
18.6-0ubuntu0.26.04.1

Open the chart page →

10,348
smtpsmtpVerified publisher1.3.31 of 1See more

smtp smtp 1.3.3

1 of the 1 container images this version deploys carry CVE-2026-14681.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
postgresql18@18.4-r0
18.5-r0

Open the chart page →

1,437
servicexssl-hep1.8.59 of 16See more

servicex ssl-hep 1.8.5

9 of the 16 container images this version deploys carry CVE-2026-14681.

Container imageDigestPackageFixed in
sslhep/servicex_app:v1.8.51d12f943cec5
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
sslhep/servicex_code_gen_atlas_xaod:v1.8.5e7aff7f97b89
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
sslhep/servicex_code_gen_func_adl_uproot:v1.8.5b01b8ee966ed
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
sslhep/servicex_code_gen_python:v1.8.50e4175a4e1eb
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
sslhep/servicex_code_gen_raw_uproot:v1.8.5671980005c57
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
sslhep/servicex_code_gen_topcp:v1.8.5596db2abdd09
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
sslhep/servicex-did-finder-atlasopenmagic:v1.8.554aaf1721d03
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
sslhep/servicex-did-finder-cernopendata:v1.8.52cb88ceab5bb
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
sslhep/servicex-did-finder-xrootd:v1.8.5c284442b44e3
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1

Open the chart page →

66,266
mybbsudermanjr0.1.01 of 3See more

mybb sudermanjr 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-14681.

Container imageDigestPackageFixed in
mybb/mybb:1.8f2a54bce31c5
postgresql18@18.4-r0
18.5-r0

Open the chart page →

2,157
teamspeaksyntaxerror404Verified publisher1.0.101 of 1See more

teamspeak syntaxerror404 1.0.10

1 of the 1 container images this version deploys carry CVE-2026-14681.

Container imageDigestPackageFixed in
library/teamspeak:3.13.815acbc64c92f
postgresql18@18.4-r0
18.5-r0

Open the chart page →

449
joplintobiassackmann0.1.71 of 2See more

joplin tobiassackmann 0.1.7

1 of the 2 container images this version deploys carry CVE-2026-14681.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:17.6.0-debian-12-r4926356130b77
postgresql@17.6.0-2
17.11.0

Open the chart page →

5,535
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-14681.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
postgresql18@18.4-r0
18.5-r0

Open the chart page →

5,550
wexa-studiowexa-studio1.2.01 of 15See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2026-14681.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
postgresql17@17.5-r0
17.11-r0

Open the chart page →

14,983
keycloakwiremindVerified publisher25.3.11 of 2See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2026-14681.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:17.6.0-debian-12-r4926356130b77
postgresql@17.6.0-2
17.11.0

Open the chart page →

7,624

Container images carrying it

106 by charts deploying them

A fixed version is listed for 5 of the 6 affected packages.

Container imageDigestPackageFixed inUsed by
octoboxio/octobox:latestd909041c46eb
postgresql18@18.1-r0
18.5-r0
1
passbolt/passbolt:5.13.0-1-ceaf3a620902a0
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
photoprism/photoprism:260601650c6ad5a651
postgresql-18@18.4-0ubuntu0.26.04.1
18.6-0ubuntu0.26.04.1
1
photoprism/photoprism:260728958642220223
postgresql-18@18.4-0ubuntu0.26.04.1
18.6-0ubuntu0.26.04.1
1
pretix/standalone:2026.7.05df3b7aa852e
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
privatebin/nginx-fpm-alpine:2.0.613290e2f04bf
postgresql18@18.4-r0
18.5-r0
1
proxysql/proxysql:3.0.8947a7abad45b
postgresql-17@17.9-0+deb13u1
17.11-0+deb13u1
1
rommapp/romm:4.4.1b909e95d1aab
postgresql17@17.7-r0
17.11-r0
1
roundcube/roundcubemail:1.6.16-apache-nonroot17d9d9580962
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
sissbruecker/linkding:1.46.20c0a9a04c7eb
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
sonroyaalmerol/docker-sogo:5.12.43f60f3abe990
postgresql-17@17.7-0+deb13u1
17.11-0+deb13u1
1
sslhep/servicex_app:v1.8.51d12f943cec5
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
sslhep/servicex_code_gen_atlas_xaod:v1.8.5e7aff7f97b89
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
sslhep/servicex_code_gen_func_adl_uproot:v1.8.5b01b8ee966ed
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
sslhep/servicex_code_gen_python:v1.8.50e4175a4e1eb
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
sslhep/servicex_code_gen_raw_uproot:v1.8.5671980005c57
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
sslhep/servicex_code_gen_topcp:v1.8.5596db2abdd09
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
sslhep/servicex-did-finder-atlasopenmagic:v1.8.554aaf1721d03
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
sslhep/servicex-did-finder-cernopendata:v1.8.52cb88ceab5bb
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
sslhep/servicex-did-finder-xrootd:v1.8.5c284442b44e3
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
szurubooru/server:2.5accf2ad9fbc3
postgresql17@17.10-r0
17.11-r0
1
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
postgresql17@17.5-r0
17.11-r0
1
temporalio/admin-tools:1.28cfde8170c92f
postgresql18@18.2-r0
18.5-r0
1
tock/gen-ai-orchestrator-server:25.10.7abf7880e0449
postgresql-17@17.8-0+deb13u1
17.11-0+deb13u1
1
twentycrm/twenty:v2.22.0e7d9948bf284
postgresql18@18.4-r0
18.5-r0
1
vabene1111/recipes:2.3.50f8d061895e9
postgresql17@17.7-r0
17.11-r0
1
vaultwarden/server:1.35.443498a94b22f
postgresql-17@17.8-0+deb13u1
17.11-0+deb13u1
1
vaultwarden/server:1.35.79a8eec71f4a5
postgresql-17@17.9-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/borgmatic-collective/borgmatic:1.9.9835b72878606
postgresql17@17.2-r0
17.11-r0
1
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
postgresql-17@17.7-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/dani-garcia/vaultwarden:1.35.2d89a6d21e361
postgresql-17@17.6-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
postgresql-17@17.8-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
postgresql-17@17.6-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/erlkoenig91/prompt-db-backend:1.0.7ab120359810d
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/firecrawl/nuq-postgres:latestf9388bd25ae2
postgresql-17@17.9-1.pgdg13+1
17.11-0+deb13u1
1
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
postgresql-17@17.8-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
postgresql18@18.4-r0
18.5-r0
1
ghcr.io/home-operations/bazarr:1.6.0cd63bbd0986c
postgresql18@18.4-r0
18.5-r0
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
postgresql18@18.2-r0
18.5-r0
1
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
postgresql-17@17.10-1.pgdg13+1
17.11-0+deb13u1
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
postgresql-17@17.6-2.pgdg13+1
17.11-0+deb13u1
1
ghcr.io/kubelauncher/postgresql1a27e11e5925
postgresql-18@18.4-1.pgdg26.04+1
18.6-0ubuntu0.26.04.1
1
ghcr.io/linuxserver/healthchecks:version-v3.9b5c6bfb00b03
postgresql17@17.4-r0
17.11-r0
1
ghcr.io/linuxserver/syslog-ng:4.10.247fae7f540f9
postgresql18@18.4-r0
18.5-r0
1
ghcr.io/monicahq/monica-next:main8be69156acbb
postgresql-17@17.5-1
17.11-0+deb13u1
1
ghcr.io/nathanvaughn/webtrees:2.2.6034151b61a80
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/ncsa/jupyterhub-metrics/collector:1.3.0dcb8c731bb1b
postgresql17@17.8-r0
17.11-r0
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
postgresql-17@17.9-0+deb13u1
17.11-0+deb13u1
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
postgresql-17@17.6-0+deb13u1
17.11-0+deb13u1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.