StackRadar

CVE-2026-100351

High

Advisory

Published 15 Oct 2026In the index since 16 Oct 2026
Severity
High
worst across findings
CVSS
7.4
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
41
of 18,137 indexed, latest versions
Container images
15
deployed by those charts
Fix available
1 of 1
affected package

kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

Carried by container images the latest versions of 41 of 18,137 indexed charts deploy, on 15 images.

Affected packageAffected versionsFixed inImages
github.com/getkin/kin-openapigolangv0.144.0, v0.145.0, v0.146.00.147.015
OSV records
GHSA-23vg-4cjm-66q5

Charts affected

41 by stars
ChartLatestAffected imagesRadar Score
kube-prometheus-stackprometheus-communityOfficialVerified publisher92.9.01 of 6See more

kube-prometheus-stack prometheus-community 92.9.0

1 of the 6 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:13.2.4-distrolessae3d3add290a
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

1,504
grafanagrafana-communityVerified publisher14.0.01 of 1See more

grafana grafana-community 14.0.0

1 of the 1 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:13.2.4-distrolessae3d3add290a
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

354
victoria-metrics-k8s-stackvictoriametricsVerified publisher0.96.01 of 7See more

victoria-metrics-k8s-stack victoriametrics 0.96.0

1 of the 7 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:13.2.3-distroless202e5d5b3f84
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

1,740
oktetooktetoOfficialVerified publisher0.0.0-2026-08-311 of 10See more

okteto okteto 0.0.0-2026-08-31

1 of the 10 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
ghcr.io/okteto/backend:0.0.0-2026-08-316171cb2b2a72
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

8,657
kube-prometheus-stackkube-prometheus-stack-oci92.9.01 of 6See more

kube-prometheus-stack kube-prometheus-stack-oci 92.9.0

1 of the 6 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:13.2.4-distrolessae3d3add290a
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

1,504
klusterviewklusterviewVerified publisher0.1.01 of 4See more

klusterview klusterview 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:latestb28bae15e219
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

3,861
haproxyhaproxytechVerified publisher1.30.21 of 1See more

haproxy haproxytech 1.30.2

1 of the 1 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
haproxytech/haproxy-alpine:3.4.41fe3f201ebb5
github.com/getkin/kin-openapi@v0.146.0
0.147.0

Open the chart page →

841
grafanacloudposse0.2.61 of 1See more

grafana cloudposse 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:latestb28bae15e219
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

383
lgtmlgtmVerified publisher0.28.21 of 9See more

lgtm lgtm 0.28.2

1 of the 9 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:13.2.3-distroless202e5d5b3f84
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

2,155
mongodb-atlas-operatormongodb-helm-charts2.17.01 of 1See more

mongodb-atlas-operator mongodb-helm-charts 2.17.0

1 of the 1 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
mongodb/mongodb-atlas-kubernetes-operator:2.17.0cfe202a2a076
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

249
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.41 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.4

1 of the 34 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:13.2.2-distroless69a5d2d957ca
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

27,427
kube-prometheus-stackwenerme92.9.01 of 6See more

kube-prometheus-stack wenerme 92.9.0

1 of the 6 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:13.2.4-distrolessae3d3add290a
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

1,504
monitoringantmediaVerified publisher1.0.01 of 6See more

monitoring antmedia 1.0.0

1 of the 6 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:latestb28bae15e219
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

2,406
catalyst-agentscatalyst-agents0.1.351 of 18See more

catalyst-agents catalyst-agents 0.1.35

1 of the 18 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:13.1.3ab5cb380e3ff
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

25,104
kube-ceemsceemsOfficialVerified publisher1.55.01 of 5See more

kube-ceems ceems 1.55.0

1 of the 5 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:13.2.4-distrolessae3d3add290a
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

1,050
netcupscp-exporterchristianhuthVerified publisher2.1.01 of 1See more

netcupscp-exporter christianhuth 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
ghcr.io/mrueg/netcupscp-exporter:v0.5.25b86c2c0b0e0
github.com/getkin/kin-openapi@v0.145.0
0.147.0

Open the chart page →

392
monitoring-stackdata354-helmVerified publisher1.4.21 of 4See more

monitoring-stack data354-helm 1.4.2

1 of the 4 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:latestb28bae15e219
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

3,425
routergroundcover1.13.991 of 7See more

router groundcover 1.13.99

1 of the 7 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
public.ecr.aws/groundcovercom/grafana-groundcover:v0.0.55-grafana11.3.77d261462727d
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

8,845
monitoring-stackhelm-charts-alexis-carbillet0.1.01 of 11See more

monitoring-stack helm-charts-alexis-carbillet 0.1.0

1 of the 11 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:latestb28bae15e219
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

16,121
grafana-chartmy-personal-grafana0.1.01 of 1See more

grafana-chart my-personal-grafana 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:latestb28bae15e219
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

383
jupyterhub-metricsncsaVerified publisher1.3.01 of 5See more

jupyterhub-metrics ncsa 1.3.0

1 of the 5 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:latestb28bae15e219
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

4,560
pax-prometheuspaxtecnologia0.7.31 of 8See more

pax-prometheus paxtecnologia 0.7.3

1 of the 8 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:13.2.2-distroless69a5d2d957ca
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

4,226
loki-stackpyalive-cdmswebappVerified publisher2.6.51 of 4See more

loki-stack pyalive-cdmswebapp 2.6.5

1 of the 4 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:latestb28bae15e219
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

9,012
cache-stackquench-cache-stackVerified publisher0.0.121 of 4See more

cache-stack quench-cache-stack 0.0.12

1 of the 4 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinneddc5f670bac19
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

1,000
grafanaquench-grafanaVerified publisher0.0.161 of 1See more

grafana quench-grafana 0.0.16

1 of the 1 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinneddc5f670bac19
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

920
harbor-observabilityquench-harbor-observabilityVerified publisher0.0.171 of 2See more

harbor-observability quench-harbor-observability 0.0.17

1 of the 2 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinneddc5f670bac19
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

966
lgtm-stackquench-lgtm-stackVerified publisher0.0.371 of 9See more

lgtm-stack quench-lgtm-stack 0.0.37

1 of the 9 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinneddc5f670bac19
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

1,283
logging-stackquench-logging-stackVerified publisher0.0.211 of 3See more

logging-stack quench-logging-stack 0.0.21

1 of the 3 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinneddc5f670bac19
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

1,086
observability-stackquench-observability-stackVerified publisher0.0.271 of 5See more

observability-stack quench-observability-stack 0.0.27

1 of the 5 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinneddc5f670bac19
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

1,014
postgres-ha-stackquench-postgres-ha-stackVerified publisher0.0.101 of 5See more

postgres-ha-stack quench-postgres-ha-stack 0.0.10

1 of the 5 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinneddc5f670bac19
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

1,054
profiling-stackquench-profiling-stackVerified publisher0.0.91 of 2See more

profiling-stack quench-profiling-stack 0.0.9

1 of the 2 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinneddc5f670bac19
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

924
tracing-stackquench-tracing-stackVerified publisher0.0.181 of 3See more

tracing-stack quench-tracing-stack 0.0.18

1 of the 3 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/grafanadigest-pinneddc5f670bac19
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

1,039
speedtestsantisbon0.1.01 of 3See more

speedtest santisbon 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:latestb28bae15e219
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

14,371
slurm-bridgeslurm-bridge1.2.33 of 3See more

slurm-bridge slurm-bridge 1.2.3

3 of the 3 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
ghcr.io/slinkyproject/slurm-bridge-admission:1.2.3042e3827a68f
github.com/getkin/kin-openapi@v0.144.0
0.147.0
ghcr.io/slinkyproject/slurm-bridge-controllers:1.2.3e2e3e2c82d2c
github.com/getkin/kin-openapi@v0.144.0
0.147.0
ghcr.io/slinkyproject/slurm-bridge-scheduler:1.2.353db9c40f2b9
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

793
slurm-operatorslurm-operator1.2.31 of 2See more

slurm-operator slurm-operator 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
ghcr.io/slinkyproject/slurm-operator:1.2.3b35e76c09e58
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

494
stunner-prometheusstunner0.2.11 of 4See more

stunner-prometheus stunner 0.2.1

1 of the 4 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:latestb28bae15e219
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

4,389
todolist-charttodolist-chart0.1.71 of 10See more

todolist-chart todolist-chart 0.1.7

1 of the 10 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:latestb28bae15e219
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

8,372
kube-prometheus-stackwener92.9.01 of 6See more

kube-prometheus-stack wener 92.9.0

1 of the 6 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:13.2.4-distrolessae3d3add290a
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

1,504
victoria-metrics-k8s-stackwener0.96.01 of 7See more

victoria-metrics-k8s-stack wener 0.96.0

1 of the 7 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:13.2.3-distroless202e5d5b3f84
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

1,740
victoria-metrics-k8s-stackwenerme0.96.01 of 7See more

victoria-metrics-k8s-stack wenerme 0.96.0

1 of the 7 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:13.2.3-distroless202e5d5b3f84
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

1,740
prometheus-monitoring-stackyotron-helm-charts1.2.01 of 3See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

1 of the 3 container images this version deploys carry CVE-2026-100351.

Container imageDigestPackageFixed in
grafana/grafana:latestb28bae15e219
github.com/getkin/kin-openapi@v0.144.0
0.147.0

Open the chart page →

904

Container images carrying it

15 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
grafana/grafana:latestb28bae15e219
github.com/getkin/kin-openapi@v0.144.0
0.147.0
12
ghcr.io/quenchworks/images/grafanadc5f670bac19
github.com/getkin/kin-openapi@v0.144.0
0.147.0
9
grafana/grafana:13.2.4-distrolessae3d3add290a
github.com/getkin/kin-openapi@v0.144.0
0.147.0
6
grafana/grafana:13.2.3-distroless202e5d5b3f84
github.com/getkin/kin-openapi@v0.144.0
0.147.0
4
grafana/grafana:13.2.2-distroless69a5d2d957ca
github.com/getkin/kin-openapi@v0.144.0
0.147.0
2
grafana/grafana:13.1.3ab5cb380e3ff
github.com/getkin/kin-openapi@v0.144.0
0.147.0
1
haproxytech/haproxy-alpine:3.4.41fe3f201ebb5
github.com/getkin/kin-openapi@v0.146.0
0.147.0
1
mongodb/mongodb-atlas-kubernetes-operator:2.17.0cfe202a2a076
github.com/getkin/kin-openapi@v0.144.0
0.147.0
1
ghcr.io/mrueg/netcupscp-exporter:v0.5.25b86c2c0b0e0
github.com/getkin/kin-openapi@v0.145.0
0.147.0
1
ghcr.io/okteto/backend:0.0.0-2026-08-316171cb2b2a72
github.com/getkin/kin-openapi@v0.144.0
0.147.0
1
ghcr.io/slinkyproject/slurm-bridge-admission:1.2.3042e3827a68f
github.com/getkin/kin-openapi@v0.144.0
0.147.0
1
ghcr.io/slinkyproject/slurm-bridge-controllers:1.2.3e2e3e2c82d2c
github.com/getkin/kin-openapi@v0.144.0
0.147.0
1
ghcr.io/slinkyproject/slurm-bridge-scheduler:1.2.353db9c40f2b9
github.com/getkin/kin-openapi@v0.144.0
0.147.0
1
ghcr.io/slinkyproject/slurm-operator:1.2.3b35e76c09e58
github.com/getkin/kin-openapi@v0.144.0
0.147.0
1
public.ecr.aws/groundcovercom/grafana-groundcover:v0.0.55-grafana11.3.77d261462727d
github.com/getkin/kin-openapi@v0.144.0
0.147.0
1

syft 1.42.1 · advisories as of 16 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.