CVE-2026-2007
HighAdvisory
Published 12 Feb 2026In the index since 6 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.2
- base score, highest
- EPSS
- 0.005
- 41st percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 17
- of 17,781 indexed, latest versions
- Container images
- 15
- deployed by those charts
- Fix available
- 3 of 4
- affected packages
The matching OSV records carry no description.
Carried by container images the latest versions of 17 of 17,781 indexed charts deploy, on 15 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| postgresql17apk | 17.2-r0, 17.4-r0, 17.5-r0, 17.6-r0+1 more | 17.8-r0 | 8 |
| postgresql16apk | 16.3-r0, 16.9-r0 | 16.12-r0 | 5 |
| postgresql18apk | 18.1-r0 | 18.2-r0 | 1 |
| postgresql-9.3deb | 9.3.22-0ubuntu0.14.04 | no fix listed | 1 |
- OSV records
- ALPINE-CVE-2026-2007UBUNTU-CVE-2026-2007
Charts affected
17 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| oncallgrafana | 1.16.5 | 1 of 12See more | 16,251 |
| healthchecksgabe565Verified publisher | 0.17.0 | 1 of 1See more | 2,286 |
| psonoankra-chartsVerified publisher | 1.2.0 | 1 of 2See more | 2,388 |
| kubedashdevopstalesOfficialVerified publisher | 4.0.0 | 1 of 8See more | 9,205 |
| redirectwyrihaximusnetVerified publisher | 1.1.0 | 1 of 1See more | 1,581 |
| temporalcastaiVerified publisher | 0.54.2 | 1 of 14See more | 16,198 |
| galaxy-stablecloudve | 2.0.0 | 1 of 5See more | 70,895 |
| csghubcsghubVerified publisher | 2.4.3 | 1 of 34See more | 58,897 |
| csgshipcsghubVerified publisher | 0.4.6 | 1 of 10See more | 11,335 |
| dataflowcsghubVerified publisher | 2.5.0 | 1 of 7See more | 6,632 |
| heimdallegebackVerified publisher | 2.0.4 | 1 of 1See more | 1,664 |
| rommernail-romm | 1.0.1 | 1 of 1See more | 2,896 |
| borgmaticgabe565Verified publisher | 0.10.1 | 1 of 1See more | 2,438 |
| octoboxhalkeye | 0.1.1 | 1 of 1See more | 3,255 |
| ja-shortenerja-shortenerVerified publisher | 0.1.0 | 1 of 2See more | 2,089 |
| tandoorrtomik-helm-chartsVerified publisher | 0.0.1 | 1 of 1See more | 4,499 |
| wexa-studiowexa-studio | 1.2.0 | 1 of 15See more | 14,983 |
Container images carrying it
15 by charts deploying them
A fixed version is listed for 3 of the 4 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| opencsghq/ | 57def8e77d0f | postgresql17 | 17.8-r0 | 3 |
| cr0hn/ | 14482d0bc4a1 | postgresql17 | 17.8-r0 | 1 |
| devopstales/ | 8bb837da5aec | postgresql16 | 16.12-r0 | 1 |
| galaxy/ | 8e577a626dfd | postgresql-9.3 | no fix listed | 1 |
| grafana/ | 499851658393 | postgresql17 | 17.8-r0 | 1 |
| linuxserver/ | 71597f4461e4 | postgresql16 | 16.12-r0 | 1 |
| octoboxio/ | d909041c46eb | postgresql18 | 18.2-r0 | 1 |
| psono/ | 3b974b43ea03 | postgresql16 | 16.12-r0 | 1 |
| rommapp/ | b909e95d1aab | postgresql17 | 17.8-r0 | 1 |
| temporalio/ | 37e2e33dbd7b | postgresql16 | 16.12-r0 | 1 |
| temporalio/ | a3a52e6ca122 | postgresql17 | 17.8-r0 | 1 |
| vabene1111/ | 0f8d061895e9 | postgresql17 | 17.8-r0 | 1 |
| ghcr.io/ | 835b72878606 | postgresql17 | 17.8-r0 | 1 |
| ghcr.io/ | b5c6bfb00b03 | postgresql17 | 17.8-r0 | 1 |
| ghcr.io/ | bf5983d754d7 | postgresql16 | 16.12-r0 | 1 |