StackRadar

CVE-2021-26291

Critical

Advisory

Published 16 Jun 2021In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
0.087
95th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
28
of 17,781 indexed, latest versions
Container images
28
deployed by those charts
Fix available
2 of 2
affected packages

Origin Validation Error in Apache Maven

Carried by container images the latest versions of 28 of 17,781 indexed charts deploy, on 28 images.

Affected packageAffected versionsFixed inImages
maven-coremaven2.2.1, 3.0, 3.0.4, 3.0.5+4 more3.8.128
maven-compatmaven3.0, 3.0.4, 3.0.5, 3.1.0+4 more3.8.125
OSV records
GHSA-2f88-5hg8-9x2x
Also known as
BIT-maven-2021-26291

Charts affected

28 by stars
ChartLatestAffected imagesRadar Score
milvusmilvus4.0.311 of 5See more

milvus milvus 4.0.31

1 of the 5 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.8.2d538416d5afe
maven-compat@3.0.5
maven-core@3.0.5
3.8.1
3.8.1

Open the chart page →

32,259
kubernetes-loggingkubernetes-logging4.8.01 of 6See more

kubernetes-logging kubernetes-logging 4.8.0

1 of the 6 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
opensearchproject/logstash-oss-with-opensearch-output-plugin:8.9.043b0cdaf26ed
maven-compat@3.3.9
maven-core@3.3.9
3.8.1
3.8.1

Open the chart page →

10,530
prestocloudnativeapp0.1.11 of 1See more

presto cloudnativeapp 0.1.1

1 of the 1 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
bivas/presto:0.19605545994f806
maven-compat@3.0.4
maven-core@3.0.4
3.8.1
3.8.1

Open the chart page →

7,226
pulsarcnieg1.0.81 of 2See more

pulsar cnieg 1.0.8

1 of the 2 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.6.14db6ff0b4045
maven-compat@3.0.5
maven-core@3.0.5
3.8.1
3.8.1

Open the chart page →

16,860
apache-ranger-admindata-platform-stableVerified publisher0.2.01 of 2See more

apache-ranger-admin data-platform-stable 0.2.0

1 of the 2 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
egdsandaru/apache-ranger-admin:1.0.0681baa1926f4
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1

Open the chart page →

8,245
mintakaeclipse-aeriosVerified publisher1.0.01 of 2See more

mintaka eclipse-aerios 1.0.0

1 of the 2 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
fiware/mintaka:0.7.092a3c5cf43c0
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1

Open the chart page →

11,482
apollofiware0.1.41 of 1See more

apollo fiware 0.1.4

1 of the 1 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
quay.io/fiware/apollo:0.0.1055330b1b60c1
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1

Open the chart page →

6,936
canis-majorfiware0.2.31 of 1See more

canis-major fiware 0.2.3

1 of the 1 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
quay.io/fiware/canis-major:1.5.15bb40472e4ff5
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1

Open the chart page →

8,528
dss-validation-servicefiware0.0.191 of 1See more

dss-validation-service fiware 0.0.19

1 of the 1 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1

Open the chart page →

4,536
endpoint-auth-servicefiware0.1.41 of 4See more

endpoint-auth-service fiware 0.1.4

1 of the 4 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
quay.io/fiware/endpoint-configuration-service:0.4.30dc38a87b844
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1

Open the chart page →

11,835
mintakafiware0.4.71 of 1See more

mintaka fiware 0.4.7

1 of the 1 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
fiware/mintaka:latestefc6793388cc
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1

Open the chart page →

7,019
trusted-issuers-registryfiware0.13.01 of 1See more

trusted-issuers-registry fiware 0.13.0

1 of the 1 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
quay.io/fiware/trusted-issuers-registry:0.11.1a8a9ec461034
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1

Open the chart page →

7,087
base-depflofree-chartVerified publisher1.0.11 of 1See more

base-dep flofree-chart 1.0.1

1 of the 1 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
flofree/base-project:2.1.16b6486c5f81e
maven-compat@3.0
maven-core@3.0
3.8.1
3.8.1

Open the chart page →

2,797
mod-copycatfolio-org0.1.31 of 1See more

mod-copycat folio-org 0.1.3

1 of the 1 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
folioci/mod-copycat:latest1513fad2b799
maven-compat@3.0
maven-core@3.0
3.8.1
3.8.1

Open the chart page →

1,466
pretend-youre-xyzzygeek-cookbookVerified publisher3.4.21 of 1See more

pretend-youre-xyzzy geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
emcniece/dockeryourxyzzy:404eccbccc15c
maven-compat@3.5.4
maven-core@3.5.4
3.8.1
3.8.1

Open the chart page →

581
ibm-microclimateibm-charts0.1.02 of 8See more

ibm-microclimate ibm-charts 0.1.0

2 of the 8 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
maven-compat@3.5.2
maven-core@2.2.1
3.8.1
3.8.1
ibmcom/microclimate-theia:lateste17bdccc5030
maven-compat@3.3.9
maven-core@3.0
3.8.1
3.8.1

Open the chart page →

57,669
jenkinsjenkins-x0.10.381 of 2See more

jenkins jenkins-x 0.10.38

1 of the 2 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
jenkinsci/jenkins:2.67a1f33f004659
maven-compat@3.1.0
maven-core@3.1.0
3.8.1
3.8.1

Open the chart page →

10,682
kron-aapm-agentkron-aapm-agent1.1.01 of 1See more

kron-aapm-agent kron-aapm-agent 1.1.0

1 of the 1 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
krontechnology/aapm-agent:1.1.07feef7d2ab42
maven-core@3.0
3.8.1

Open the chart page →

8,884
chirpstackmosquitto-helm-chart0.5.01 of 8See more

chirpstack mosquitto-helm-chart 0.5.0

1 of the 8 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.9.0d056c89b7131
maven-compat@3.0.5
maven-core@3.0.5
3.8.1
3.8.1

Open the chart page →

25,933
pulsarmosquitto-helm-chart0.2.01 of 1See more

pulsar mosquitto-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.10.03b262ab7a7d9
maven-compat@3.0.5
maven-core@3.0.5
3.8.1
3.8.1

Open the chart page →

15,675
my-app-namemy-app-name0.0.21 of 1See more

my-app-name my-app-name 0.0.2

1 of the 1 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
viniciusfcf/gitops-quarkus-app-jvm:latestbba8ee1b5cd5
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1

Open the chart page →

9,149
registration-ms-helm-chartnotesprojectchart0.1.01 of 2See more

registration-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
vlebediantsev/registration-ms-final:latest427af418b75e
maven-core@3.0.5
3.8.1

Open the chart page →

5,916
allurestakaterVerified publisher1.0.11 of 1See more

allure stakater 1.0.1

1 of the 1 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
quay.io/eformat/jenkins-agent-graalvm:latesta3b9a07648b6
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1

Open the chart page →

28,165
nordmart-reviewstakaterVerified publisher0.0.61 of 3See more

nordmart-review stakater 0.0.6

1 of the 3 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
stakater/stakater-nordmart-review:1.0.35954d2be66e95
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1

Open the chart page →

11,554
nordmart-review-instancestakaterVerified publisher1.0.01 of 3See more

nordmart-review-instance stakater 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
stakater/stakater-nordmart-review:1.0.35954d2be66e95
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1

Open the chart page →

11,554
sonarqubestakaterVerified publisher0.10.31 of 2See more

sonarqube stakater 0.10.3

1 of the 2 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
library/sonarqube:6.7.6-community0ae5169e3d0f
maven-core@3.0.5
3.8.1

Open the chart page →

11,841
hermestoukVerified publisher0.6.01 of 3See more

hermes touk 0.6.0

1 of the 3 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
apicurio/apicurio-registry-kafkasql:2.1.0.Finala97d67487532
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1

Open the chart page →

12,455
workshop-pipelinesworkshop-pipelines0.1.61 of 2See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2021-26291.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/workshop-pipelines:lateste383ba3e0966
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1

Open the chart page →

11,577

Container images carrying it

28 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
stakater/stakater-nordmart-review:1.0.35954d2be66e95
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1
2
apachepulsar/pulsar:2.10.03b262ab7a7d9
maven-compat@3.0.5
maven-core@3.0.5
3.8.1
3.8.1
1
apachepulsar/pulsar:2.6.14db6ff0b4045
maven-compat@3.0.5
maven-core@3.0.5
3.8.1
3.8.1
1
apachepulsar/pulsar:2.9.0d056c89b7131
maven-compat@3.0.5
maven-core@3.0.5
3.8.1
3.8.1
1
apachepulsar/pulsar:2.8.2d538416d5afe
maven-compat@3.0.5
maven-core@3.0.5
3.8.1
3.8.1
1
apicurio/apicurio-registry-kafkasql:2.1.0.Finala97d67487532
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1
1
bivas/presto:0.19605545994f806
maven-compat@3.0.4
maven-core@3.0.4
3.8.1
3.8.1
1
egdsandaru/apache-ranger-admin:1.0.0681baa1926f4
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1
1
emcniece/dockeryourxyzzy:404eccbccc15c
maven-compat@3.5.4
maven-core@3.5.4
3.8.1
3.8.1
1
fiware/mintaka:0.7.092a3c5cf43c0
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1
1
fiware/mintaka:latestefc6793388cc
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1
1
flofree/base-project:2.1.16b6486c5f81e
maven-compat@3.0
maven-core@3.0
3.8.1
3.8.1
1
folioci/mod-copycat:latest1513fad2b799
maven-compat@3.0
maven-core@3.0
3.8.1
3.8.1
1
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
maven-compat@3.5.2
maven-core@2.2.1
3.8.1
3.8.1
1
ibmcom/microclimate-theia:lateste17bdccc5030
maven-compat@3.3.9
maven-core@3.0
3.8.1
3.8.1
1
jenkinsci/jenkins:2.67a1f33f004659
maven-compat@3.1.0
maven-core@3.1.0
3.8.1
3.8.1
1
krontechnology/aapm-agent:1.1.07feef7d2ab42
maven-core@3.0
3.8.1
1
library/sonarqube:6.7.6-community0ae5169e3d0f
maven-core@3.0.5
3.8.1
1
opensearchproject/logstash-oss-with-opensearch-output-plugin:8.9.043b0cdaf26ed
maven-compat@3.3.9
maven-core@3.3.9
3.8.1
3.8.1
1
viniciusfcf/gitops-quarkus-app-jvm:latestbba8ee1b5cd5
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1
1
vlebediantsev/registration-ms-final:latest427af418b75e
maven-core@3.0.5
3.8.1
1
quay.io/eformat/jenkins-agent-graalvm:latesta3b9a07648b6
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1
1
quay.io/fiware/apollo:0.0.1055330b1b60c1
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1
1
quay.io/fiware/canis-major:1.5.15bb40472e4ff5
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1
1
quay.io/fiware/endpoint-configuration-service:0.4.30dc38a87b844
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1
1
quay.io/fiware/trusted-issuers-registry:0.11.1a8a9ec461034
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1
1
quay.io/maximilianopizarro/workshop-pipelines:lateste383ba3e0966
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
maven-compat@3.6.2
maven-core@3.6.2
3.8.1
3.8.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.