StackRadar

CVE-2026-6470

Medium

Advisory

Published 13 Aug 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.3
base score, highest
EPSS
0.002
9th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
319
of 17,781 indexed, latest versions
Container images
305
deployed by those charts
Fix available
9 of 13
affected packages

PostgreSQL fails to check type USAGE privilege

Carried by container images the latest versions of 319 of 17,781 indexed charts deploy, on 305 images.

Affected packageAffected versionsFixed inImages
postgresql-15deb15.3-0+deb12u1, 15.3-1.pgdg120+1, 15.4-2.pgdg120+1, 15.5-0+deb12u1+13 more15.19-0+deb12u1121
postgresql-17deb17.5-1, 17.5-1.pgdg130+1, 17.6-0+deb13u1, 17.6-2.pgdg13+1+7 more17.11, 17.11-0+deb13u155
postgresqlbitnami11.8.0-10, 11.12.0-7, 14.4.0-0, 14.4.0-11+25 more14.24.030
postgresql18apk18.1-r0, 18.2-r0, 18.3-r0, 18.4-r018.5-r026
postgresql-14deb14.3-1.pgdg22.04+1, 14.4-0ubuntu0.22.04.1, 14.5-0ubuntu0.22.04.1, 14.6-1.pgdg22.04+1+6 more14.24-0ubuntu0.22.04.118
postgresql-12deb12.7-0ubuntu0.20.04.1, 12.8-0ubuntu0.20.04.1, 12.9-0ubuntu0.20.04.1, 12.11-0ubuntu0.20.04.1+2 moreno fix listed17
postgresql17apk17.2-r0, 17.4-r0, 17.5-r0, 17.6-r0+3 more17.11-r012
PostgreSQLbitnami15.3.0, 15.4.0, 15.5.0-42, 16.0.0+6 more14.24.011
postgresql-16deb16.2-1ubuntu4, 16.6-0ubuntu0.24.04.1, 16.9-0ubuntu0.24.04.1, 16.10-0ubuntu0.24.04.1+2 more16.15-0ubuntu0.24.04.111
postgresql-10deb10.6-0ubuntu0.18.04.1, 10.10-0ubuntu0.18.04.1, 10.12-0ubuntu0.18.04.1, 10.14-0ubuntu0.18.04.1+1 moreno fix listed6
postgresql-18deb18.4-0ubuntu0.26.04.1, 18.4-1.pgdg26.04+118.6-0ubuntu0.26.04.14
postgresql-9.5deb9.5.10-0ubuntu0.16.04, 9.5.14-0ubuntu0.16.04no fix listed3
postgresql-9.3deb9.3.22-0ubuntu0.14.04no fix listed1
OSV records
ALPINE-CVE-2026-6470BIT-postgresql-2026-6470DEBIAN-CVE-2026-6470UBUNTU-CVE-2026-6470ECHO-40e5-0764-92ff
Also known as
USN-8653-1

Charts affected

319 by stars
ChartLatestAffected imagesRadar Score
feedbacksystemthm-mni-iiVerified publisher0.47.11 of 10See more

feedbacksystem thm-mni-ii 0.47.1

1 of the 10 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:15.4.0-debian-11-r455dba7e6a514d
postgresql@15.4.0-6
PostgreSQL@15.4.0
14.24.0
14.24.0

Open the chart page →

28,534
huginnutkuozdemirVerified publisher2.2.11 of 4See more

huginn utkuozdemir 2.2.1

1 of the 4 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
huginn/huginn-single-process:4d17829cf6b15b004ad3f4be196303dca4944810c794eddc7b47
postgresql-10@10.15-0ubuntu0.18.04.1
no fix listed

Open the chart page →

18,137
wgerwgerOfficialVerified publisher1.0.01 of 8See more

wger wger 1.0.0

1 of the 8 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
wger/server:2.6997ead43aabd
postgresql-16@16.14-0ubuntu0.24.04.1
16.15-0ubuntu0.24.04.1

Open the chart page →

8,491
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
postgresql-17@17.6-0+deb13u1
17.11-0+deb13u1

Open the chart page →

12,037
open-elevationbeeinventor0.1.01 of 2See more

open-elevation beeinventor 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
openelevation/open-elevation:latest82fb21612e86
postgresql-12@12.7-0ubuntu0.20.04.1
no fix listed

Open the chart page →

13,145
cert-vaultcert-vaultOfficialVerified publisher2.12.01 of 7See more

cert-vault cert-vault 2.12.0

1 of the 7 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:17.4.0-debian-12-r11fb3806e823c2
postgresql@17.4.0-9
14.24.0

Open the chart page →

15,863
typo3christianhuthVerified publisher7.7.01 of 2See more

typo3 christianhuth 7.7.0

1 of the 2 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
martinhelmich/typo3:12.4c83a4f3fd7ae
postgresql-15@15.16-0+deb12u1
15.19-0+deb12u1

Open the chart page →

8,466
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
postgresql-17@17.7-0+deb13u1
17.11-0+deb13u1

Open the chart page →

11,205
paperless-ngxcrystalnetVerified publisher0.2.221 of 3See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
postgresql-15@15.8-0+deb12u1
15.19-0+deb12u1

Open the chart page →

13,761
datacube-explorerdatacube-charts0.5.321 of 1See more

datacube-explorer datacube-charts 0.5.32

1 of the 1 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
opendatacube/explorer:latest120457ffcd69
postgresql-16@16.10-0ubuntu0.24.04.1
16.15-0ubuntu0.24.04.1

Open the chart page →

4,854
dbrepodbrepo1.13.31 of 25See more

dbrepo dbrepo 1.13.3

1 of the 25 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:17.6.0-debian-12-r0de520acd66fc
postgresql@17.6.0-0
14.24.0

Open the chart page →

52,635
domain-lockerdomain-locker0.2.81 of 3See more

domain-locker domain-locker 0.2.8

1 of the 3 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
lissy93/domain-locker:latestd3c95edc0a8b
postgresql18@18.3-r0
18.5-r0

Open the chart page →

1,882
enbuildenbuildVerified publisher0.0.501 of 6See more

enbuild enbuild 0.0.50

1 of the 6 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
postgresql-15@15.18-0+deb12u1
15.19-0+deb12u1

Open the chart page →

31,510
roundcubeencircle360-ossVerified publisher0.8.31 of 1See more

roundcube encircle360-oss 0.8.3

1 of the 1 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
roundcube/roundcubemail:1.6.16-apache-nonroot17d9d9580962
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1

Open the chart page →

5,584
taigafermosit0.0.111 of 7See more

taiga fermosit 0.0.11

1 of the 7 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
taigaio/taiga-back:latest4beed8f62c9f
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1

Open the chart page →

8,496
gentrace-self-hostedgentrace-self-hostedVerified publisher0.1.31 of 9See more

gentrace-self-hosted gentrace-self-hosted 0.1.3

1 of the 9 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
library/postgres:15.38775adb39f0d
postgresql-15@15.3-1.pgdg120+1
15.19-0+deb12u1

Open the chart page →

15,562
odooimioVerified publisher3.0.21 of 3See more

odoo imio 3.0.2

1 of the 3 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
library/postgres:17.10ebba4f4de37f
postgresql-17@17.10-1.pgdg13+1
17.11-0+deb13u1

Open the chart page →

3,068
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
postgresql-17@17.6-2.pgdg13+1
17.11-0+deb13u1

Open the chart page →

15,712
iris-webappiris-webapp0.2.41 of 2See more

iris-webapp iris-webapp 0.2.4

1 of the 2 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
postgresql-17@17.6-0+deb13u1
17.11-0+deb13u1

Open the chart page →

11,764
jupyterhub-outpostjupyter-jscVerified publisher2.4.11 of 1See more

jupyterhub-outpost jupyter-jsc 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
postgresql18@18.4-r0
18.5-r0

Open the chart page →

1,678
kdiffkdiff-snapshotsVerified publisher0.0.2031 of 2See more

kdiff kdiff-snapshots 0.0.203

1 of the 2 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.2035bc5ca66d55a
postgresql-15@15.14-0+deb12u1
15.19-0+deb12u1

Open the chart page →

5,508
kdiff-snapshotskdiff-snapshotsVerified publisher0.0.551 of 1See more

kdiff-snapshots kdiff-snapshots 0.0.55

1 of the 1 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.55d7f93d2182fe
postgresql-15@15.13-0+deb12u1
15.19-0+deb12u1

Open the chart page →

5,789
owncloudkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

owncloud kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
owncloud/server:10.16.274c53d341076
postgresql-14@14.23-0ubuntu0.22.04.1
14.24-0ubuntu0.22.04.1

Open the chart page →

9,858
opennebulakvaps2.1.15 of 9See more

opennebula kvaps 2.1.1

5 of the 9 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
ghcr.io/kvaps/opennebula:v5.12.0.4-1e28e0e7de11b
postgresql-12@12.7-0ubuntu0.20.04.1
no fix listed
ghcr.io/kvaps/opennebula-exporter:v5.12.0.401563adc95fd
postgresql-12@12.7-0ubuntu0.20.04.1
no fix listed
ghcr.io/kvaps/opennebula-exporter:v5.12.0.4-12b92df1143b9
postgresql-12@12.7-0ubuntu0.20.04.1
no fix listed
ghcr.io/kvaps/opennebula-flow:v5.12.0.4-1600221f0f43f
postgresql-12@12.7-0ubuntu0.20.04.1
no fix listed
ghcr.io/kvaps/opennebula-gate:v5.12.0.4-1a85e03d8bc1d
postgresql-12@12.7-0ubuntu0.20.04.1
no fix listed

Open the chart page →

113,791
food-managermoreillonVerified publisher0.5.01 of 2See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
moreillon/food-manager:lateste8fd856e593d
postgresql-15@15.13-0+deb12u1
15.19-0+deb12u1

Open the chart page →

13,738
redminemt1905027.3.41 of 3See more

redmine mt190502 7.3.4

1 of the 3 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
library/redmine:6.1.204ac44a2595b
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1

Open the chart page →

7,527
clowder2ncsaVerified publisher1.9.71 of 12See more

clowder2 ncsa 1.9.7

1 of the 12 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:15.5.06887635cc793
postgresql@15.5.0-42
PostgreSQL@15.5.0-42
14.24.0
14.24.0

Open the chart page →

37,373
librechatopenshift1.9.01 of 3See more

librechat openshift 1.9.0

1 of the 3 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
ghcr.io/bat-bs/bitnami-pgvector:pg1619ebe07b4daf
postgresql@16.6.0-1
14.24.0

Open the chart page →

5,779
openvaultopenvaultVerified publisher0.8.11 of 2See more

openvault openvault 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
postgresql-15@15.13-0+deb12u1
15.19-0+deb12u1

Open the chart page →

6,873
paperless-ngxpaperlessVerified publisher0.4.01 of 3See more

paperless-ngx paperless 0.4.0

1 of the 3 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
bitnamilegacy/postgresqldigest-pinned926356130b77
postgresql@17.6.0-2
14.24.0

Open the chart page →

8,489
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
treskon/portrait-web-setup:DEV-latesta475d80e4ecf
postgresql-15@15.10-0+deb12u1
15.19-0+deb12u1

Open the chart page →

31,844
phpqonstruktVerified publisher0.2.01 of 1See more

php qonstrukt 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
qonstrukt/php:8.4-v8-apache089af7925aa1
postgresql-16@16.14-0ubuntu0.24.04.1
16.15-0ubuntu0.24.04.1

Open the chart page →

23,964
resurfaceresurfaceioVerified publisher3.9.01 of 3See more

resurface resurfaceio 3.9.0

1 of the 3 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
resurfaceio/resurface:3.7.84d5cda2f64109
postgresql-14@14.17-0ubuntu0.22.04.1
14.24-0ubuntu0.22.04.1

Open the chart page →

7,432
atuinrm3lVerified publisher0.11.01 of 3See more

atuin rm3l 0.11.0

1 of the 3 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:16.2.0-debian-12-r890fda44bfa42
postgresql@16.2.0-4
PostgreSQL@16.2.0-4
14.24.0
14.24.0

Open the chart page →

6,521
fluent-bitromanow-helm-chartsVerified publisher1.7.31 of 1See more

fluent-bit romanow-helm-charts 1.7.3

1 of the 1 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
fluent/fluent-bit:4.0-debuge76397ef3983
postgresql-15@15.14-0+deb12u1
15.19-0+deb12u1

Open the chart page →

7,740
baikalrubxkubeVerified publisher1.3.11 of 1See more

baikal rubxkube 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
ckulka/baikal:0.10.1-nginx434bdd162247
postgresql-15@15.13-0+deb12u1
15.19-0+deb12u1

Open the chart page →

5,315
kyoorubxkubeVerified publisher0.1.102 of 9See more

kyoo rubxkube 0.1.10

2 of the 9 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
ghcr.io/zoriya/kyoo_autosync:4.7.1fbba58ddb1a6
postgresql-15@15.10-0+deb12u1
15.19-0+deb12u1
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
postgresql-15@15.10-0+deb12u1
15.19-0+deb12u1

Open the chart page →

30,234
sogosogoVerified publisher0.3.51 of 2See more

sogo sogo 0.3.5

1 of the 2 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
sonroyaalmerol/docker-sogo:5.12.43f60f3abe990
postgresql-17@17.7-0+deb13u1
17.11-0+deb13u1

Open the chart page →

7,126
postgresql-ha-chartsoldevelo-postgresql-ha-chart16.3.41 of 2See more

postgresql-ha-chart soldevelo-postgresql-ha-chart 16.3.4

1 of the 2 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
soldevelo/pgpool:4.6.3-debian-12-r0044d16a65129
postgresql-15@15.16-0+deb12u1
15.19-0+deb12u1

Open the chart page →

4,563
graph-nodestakewise3.1.01 of 3See more

graph-node stakewise 3.1.0

1 of the 3 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
graphprotocol/graph-node:v0.37.0f4452cdedd68
postgresql-15@15.10-0+deb12u1
15.19-0+deb12u1

Open the chart page →

4,661
ckanstatcan0.0.351 of 8See more

ckan statcan 0.0.35

1 of the 8 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
statcan/ckan:2.93921305425b8
postgresql-12@12.7-0ubuntu0.20.04.1
no fix listed

Open the chart page →

24,930
mumblesyntaxerror404Verified publisher1.0.41 of 1See more

mumble syntaxerror404 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
ghcr.io/mumble-voip/mumble-server:v1.6.87002fd613b6a35
postgresql-16@16.14-0ubuntu0.24.04.1
16.15-0ubuntu0.24.04.1

Open the chart page →

2,099
tocktock0.6.31 of 9See more

tock tock 0.6.3

1 of the 9 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
tock/gen-ai-orchestrator-server:25.10.7abf7880e0449
postgresql-17@17.8-0+deb13u1
17.11-0+deb13u1

Open the chart page →

12,907
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
postgresql-15@15.10-0+deb12u1
15.19-0+deb12u1

Open the chart page →

12,581
taigaunxwaresVerified publisher2026.3.81 of 6See more

taiga unxwares 2026.3.8

1 of the 6 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
taigaio/taiga-back:latest4beed8f62c9f
postgresql-17@17.10-0+deb13u1
17.11-0+deb13u1

Open the chart page →

9,148
abstract-nodeabstract-nodeVerified publisher0.1.491 of 2See more

abstract-node abstract-node 0.1.49

1 of the 2 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
matterlabs/external-node:9734bf2-17870579939295dadc06bdf3b
postgresql-15@15.8-0+deb12u1
15.19-0+deb12u1

Open the chart page →

4,554
gobackupadnoctemVerified publisher0.4.01 of 1See more

gobackup adnoctem 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
huacnlee/gobackup:v3.1.1560be93229a5
postgresql18@18.4-r0
18.5-r0

Open the chart page →

1,828
linkstackadnoctemVerified publisher0.4.01 of 1See more

linkstack adnoctem 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
linkstackorg/linkstack:latest1c8b05399ee4
postgresql17@17.8-r0
17.11-r0

Open the chart page →

2,092
antigenic-docuseal-helm-chartantigenic-docuseal-helm-chartVerified publisher0.2.01 of 1See more

antigenic-docuseal-helm-chart antigenic-docuseal-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
docuseal/docuseal:2.4.17493fd7f6728
postgresql18@18.3-r0
18.5-r0

Open the chart page →

2,766
appwriteappwrite-helmVerified publisher1.3.21 of 8See more

appwrite appwrite-helm 1.3.2

1 of the 8 container images this version deploys carry CVE-2026-6470.

Container imageDigestPackageFixed in
appwrite/appwrite:1.9.01aaa70127114
postgresql18@18.2-r0
18.5-r0

Open the chart page →

9,847

Container images carrying it

305 by charts deploying them

A fixed version is listed for 9 of the 13 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
postgresql-15@15.16-0+deb12u1
15.19-0+deb12u1
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
postgresql-15@15.3-0+deb12u1
15.19-0+deb12u1
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
postgresql-15@15.18-0+deb12u1
15.19-0+deb12u1
1
registry.gitlab.com/school_guy/docker-typo3:13.4.30-197d868ed76185d7270d
postgresql-15@15.18-0+deb12u1
15.19-0+deb12u1
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
postgresql18@18.4-r0
18.5-r0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.