CVE-2026-54411

High

Advisory

Published 14 Jun 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.003; 25th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,459; of 17,821 indexed, latest versions
Container images: 2,489; deployed by those charts
Fix available: 2 of 2; affected packages

Red Hat Security Advisory: pam security update

Carried by container images the latest versions of 2,459 of 17,821 indexed charts deploy, on 2,489 images.

Affected package	Affected versions	Fixed in	Images
pamdeb	1.1.8-1ubuntu2, 1.1.8-1ubuntu2.2, 1.1.8-3.2ubuntu2, 1.1.8-3.2ubuntu2.1+33 more	1.4.0-11ubuntu2.7, 1.5.3-5ubuntu5.6, 1.7.0-5+e5, 1.7.0-5ubuntu3.1	2,311
pamrpm	1.1.8-22.el7, 1.1.8-23.el7, 1.3.0-150000.6.86.1, 1.3.0-lp151.7.38+29 more	0:1.1.8-23.el7_9.3, 0:1.3.1-40.el8_10, 0:1.5.1-27.el9_8.1, 0:1.5.1-28.el9_8.1+4 more	178

OSV records: DEBIAN-CVE-2026-54411 RHSA-2026:56131 RHSA-2026:59379 RHSA-2026:60224 RHSA-2026:61227 RHSA-2026:64815 RLSA-2026:56131 RLSA-2026:59379 RLSA-2026:64815 UBUNTU-CVE-2026-54411 ECHO-a8ba-b20f-6dda openSUSE-SU-2026:11201-1 SUSE-SU-2026:22639-1 SUSE-SU-2026:3163-1
Also known as: RHSA-2026:61223, RHSA-2026:61224, RHSA-2026:61225, RHSA-2026:61226, RHSA-2026:61228, RHSA-2026:61230, USN-8601-1

Charts affected

2,459 by stars

Chart

Latest

Affected images

Radar Score

nightingalexxl-job-admin

0.2.11

3 of 6 See more

nightingale xxl-job-admin 0.2.11

3 of the 6 container images this version deploys carry CVE-2026-54411.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	pam@1.5.3-5ubuntu5.5	1.5.3-5ubuntu5.6
flashcatcloud/nightingale :8.0.0-beta.11	ea1b0aaabe09	pam@1.5.2-6+deb12u1	no fix listed
library/redis :6.2	d2ad7b21cafa	pam@1.5.2-6+deb12u2	no fix listed

Open the chart page →

9,743

pgcatxxl-job-admin

0.3.3

1 of 1 See more

pgcat xxl-job-admin 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-54411.

Container image	Digest	Package	Fixed in
ghcr.io/postgresml/pgcat :v1.2.0	627761f6dcbc	pam@1.5.2-6+deb12u1	no fix listed

Open the chart page →

3,197

nginx-chartxxoznge-nginx

0.1.0

1 of 1 See more

nginx-chart xxoznge-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-54411.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	pam@1.7.0-5	no fix listed

Open the chart page →

1,887

helm-demoyahoon-helm-demo

1.0.0

1 of 1 See more

helm-demo yahoon-helm-demo 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-54411.

Container image	Digest	Package	Fixed in
ghcr.io/yahoon/helm-demo :1.0.0	2930290a758c	pam@1.7.0-5	no fix listed

Open the chart page →

1,257

my-nginx-appyasser-nginx-app

0.1.0

1 of 1 See more

my-nginx-app yasser-nginx-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-54411.

Container image	Digest	Package	Fixed in
library/nginx :stable	d5792f71a949	pam@1.7.0-5	no fix listed

Open the chart page →

1,887

api-snapyoukadev

0.1.1

1 of 1 See more

api-snap youkadev 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-54411.

Container image	Digest	Package	Fixed in
youkadev/api-snap :0.1.1	4db0f9428e67	pam@1.5.2-6+deb12u1	no fix listed

Open the chart page →

2,638

changedetection-iozekker6

1.102.0

1 of 1 See more

changedetection-io zekker6 1.102.0

1 of the 1 container images this version deploys carry CVE-2026-54411.

Container image	Digest	Package	Fixed in
ghcr.io/dgtlmoon/changedetection.io :0.60.7	096dae27b5d6	pam@1.5.2-6+deb12u2	no fix listed

Open the chart page →

2,710

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-54411.

Container image	Digest	Package	Fixed in
library/nginx :latest	abe47724e466	pam@1.7.0-5	no fix listed

Open the chart page →

1,593

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-54411.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	pam@1.1.8-3.6ubuntu2.18.04.3	no fix listed
yandex/clickhouse-server :21.3.20	4eccfffb01d7	pam@1.3.1-5ubuntu4.3	no fix listed

Open the chart page →

9,297

Container images carrying it

2,489 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
library/mongo :4.4-bionic	3d0e6df9fd5b	pam@1.1.8-3.6ubuntu2.18.04.3	no fix listed	1
library/mongo :5.0.14-focal	50cae5081ab4	pam@1.3.1-5ubuntu4.4	no fix listed	1
library/mongo :6.0.12	646902910d6a	pam@1.4.0-11ubuntu2.3	1.4.0-11ubuntu2.7	1
library/mongo :4.2	699d652ed674	pam@1.1.8-3.6ubuntu2.18.04.6	no fix listed	1
library/mongo :4.2.1	6ca49afbcb2b	pam@1.1.8-3.6ubuntu2.18.04.1	no fix listed	1
library/mongo :6.0.2	71a63fc2438e	pam@1.3.1-5ubuntu4.3	no fix listed	1
library/mongo :5.0.21	7c81758cb295	pam@1.3.1-5ubuntu4.6	no fix listed	1
library/mongo :7.0.28-jammy	88785f6f665a	pam@1.4.0-11ubuntu2.6	1.4.0-11ubuntu2.7	1
library/mongo :4.2.21-bionic	9cb28f7291d9	pam@1.1.8-3.6ubuntu2.18.04.3	no fix listed	1
library/mongo :7.0.12	ae1cf99fa7bf	pam@1.4.0-11ubuntu2.4	1.4.0-11ubuntu2.7	1
library/mongo :4.4.18	d23ec07162ca	pam@1.3.1-5ubuntu4.4	no fix listed	1
library/mongo :8.0.11	dca8d11fe467	pam@1.5.3-5ubuntu5.4	1.5.3-5ubuntu5.6	1
library/mysql :8.0-debian	9382e4f6f7f0	pam@1.5.2-6+deb12u2	no fix listed	1
library/neo4j :2026.05.0-enterprise	2caf944aa4a5	pam@1.7.0-5	no fix listed	1
library/neo4j :2026.02.2	5ab4ab0358cf	pam@1.7.0-5	no fix listed	1
library/neo4j :2026.05.0	6c162e2432f8	pam@1.7.0-5	no fix listed	1
library/nextcloud :35.0.0 :35.0.0-apache	3e9f6eaa5dc8	pam@1.7.0-5	no fix listed	1
library/nextcloud :31.0.6-apache	588609d76b21	pam@1.5.2-6+deb12u1	no fix listed	1
library/nextcloud :34.0.4-apache	a5ace30c695a	pam@1.7.0-5	no fix listed	1
library/nextcloud :34.0.4-apache	b13a87affb7e	pam@1.7.0-5	no fix listed	1
library/nextcloud :31.0.10-apache	b7faa1653c39	pam@1.7.0-5	no fix listed	1
library/nginx :1.27.4	09369da6b103	pam@1.5.2-6+deb12u1	no fix listed	1
library/nginx :1.29	1881968aff6f	pam@1.7.0-5	no fix listed	1
library/nginx :1.27	6784fb0834aa	pam@1.5.2-6+deb12u1	no fix listed	1
library/nginx :1.25.1	67f9a4f10d14	pam@1.5.2-6	no fix listed	1
library/nginx :1.25.4	9ff236ed47fe	pam@1.5.2-6+deb12u1	no fix listed	1
library/nginx :1.31	a53fc6c27208	pam@1.7.0-5	no fix listed	1
library/nginx :latest	cfb8a89ac237	pam@1.7.0-5	no fix listed	1
library/nginx :1.27.3	fb197595ebe7	pam@1.5.2-6+deb12u1	no fix listed	1
library/node :22-bookworm-slim	48e4b67d85f8	pam@1.5.2-6+deb12u2	no fix listed	1
library/node :20	8f693eaa7e0a	pam@1.5.2-6+deb12u2	no fix listed	1
library/node :lts	be23f54a88d3	pam@1.5.2-6+deb12u2	no fix listed	1
library/node :latest	f5d1cc40abc1	pam@1.7.0-5	no fix listed	1
library/php :8.4-fpm	59fa733c9af6	pam@1.7.0-5	no fix listed	1
library/phpmyadmin :5.2.3-apache	adc486045303	pam@1.7.0-5	no fix listed	1
library/postgres :18.0	073e7c8b84e2	pam@1.7.0-5	no fix listed	1
library/postgres :17.4	304ab8135187	pam@1.5.2-6+deb12u1	no fix listed	1
library/postgres :18.4	3a82e1f56c8f	pam@1.7.0-5	no fix listed	1
library/postgres :16.11	468e1f126ca5	pam@1.7.0-5	no fix listed	1
library/postgres :16.6	557fea37a744	pam@1.5.2-6+deb12u1	no fix listed	1
library/postgres :18.3	69e8582b781c	pam@1.7.0-5	no fix listed	1
library/postgres :15.18	6eb0add3b77c	pam@1.7.0-5	no fix listed	1
library/postgres :15.3	8775adb39f0d	pam@1.5.2-6	no fix listed	1
library/postgres :18.4	8ff36f3c6637	pam@1.7.0-5	no fix listed	1
library/postgres :18.3	a9abf4275f9e	pam@1.7.0-5	no fix listed	1
library/postgres :17.5	aadf2c0696f5	pam@1.7.0-5	no fix listed	1
library/postgres :13.12	ced3ba927f4c	pam@1.5.2-6+deb12u1	no fix listed	1
library/postgres :15.18-bookworm	e8db9bd3e9e1	pam@1.5.2-6+deb12u2	no fix listed	1
library/postgres :14.22	eba8ddbdd837	pam@1.7.0-5	no fix listed	1
library/postgres :17.10	ebba4f4de37f	pam@1.7.0-5	no fix listed	1