StackRadar

CVE-2026-10050

High

Advisory

Published 22 Jul 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.005
40th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
265
of 17,787 indexed, latest versions
Container images
246
deployed by those charts
Fix available
3 of 3
affected packages

Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

Carried by container images the latest versions of 265 of 17,787 indexed charts deploy, on 246 images.

Affected packageAffected versionsFixed inImages
jetty-securitymaven9.4.5.v20170502, 9.4.6.v20170531, 9.4.8.v20171121, 9.4.10.v20180503+71 more9.4.63, 10.0.31, 11.0.31, 12.0.36+1 more246
jetty-ee8-securitymaven12.0.25, 12.1.6, 12.1.812.0.36, 12.1.1010
jetty-ee9-securitymaven12.1.3, 12.1.5, 12.1.6, 12.1.7+1 more12.1.109
OSV records
GHSA-2fvj-hgj9-j2gr

Charts affected

265 by stars
ChartLatestAffected imagesRadar Score
teku-validatorstakewise4.3.21 of 2See more

teku-validator stakewise 4.3.2

1 of the 2 container images this version deploys carry CVE-2026-10050.

Container imageDigestPackageFixed in
consensys/teku:25.4.1bf6ecd2ea716
jetty-security@11.0.25
11.0.31

Open the chart page →

3,192
fdi-dotstatsuite-sfs-solrstatcan1.0.21 of 4See more

fdi-dotstatsuite-sfs-solr statcan 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-10050.

Container imageDigestPackageFixed in
library/solr:8.11.18c5f7881cebb
jetty-security@9.4.44.v20210927
9.4.63

Open the chart page →

6,065
solrstatcan1.5.102 of 3See more

solr statcan 1.5.10

2 of the 3 container images this version deploys carry CVE-2026-10050.

Container imageDigestPackageFixed in
library/solr:8.11.18c5f7881cebb
jetty-security@9.4.44.v20210927
9.4.63
library/zookeeper:3.5.5b7a76ec06f68
jetty-security@9.4.17.v20190418
9.4.63

Open the chart page →

8,805
trinostatcan1.23.41 of 2See more

trino statcan 1.23.4

1 of the 2 container images this version deploys carry CVE-2026-10050.

Container imageDigestPackageFixed in
trinodb/trino:405ee80ab5eeab2
jetty-security@9.4.49.v20220914
9.4.63

Open the chart page →

13,817
rundecksvtech-public-helm-charts1.0.01 of 2See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-10050.

Container imageDigestPackageFixed in
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
jetty-security@9.4.48.v20220622
9.4.63

Open the chart page →

18,828
hadoop-deploymenttejaswita-hadoop-helmchart1.0.01 of 1See more

hadoop-deployment tejaswita-hadoop-helmchart 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-10050.

Container imageDigestPackageFixed in
apache/hadoop:3af361b20bec0
jetty-security@9.4.51.v20230217
9.4.63

Open the chart page →

4,239
clickhousetemp-charts0.7.11 of 3See more

clickhouse temp-charts 0.7.1

1 of the 3 container images this version deploys carry CVE-2026-10050.

Container imageDigestPackageFixed in
library/zookeeper:3.6.180ad2170ad62
jetty-security@9.4.24.v20191120
9.4.63

Open the chart page →

8,705
tikatikaVerified publisher0.3.01 of 1See more

tika tika 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-10050.

Container imageDigestPackageFixed in
ghcr.io/kenchrcum/tika:3.3.0-full708446bc6783
jetty-security@11.0.26
11.0.31

Open the chart page →

1,826
kafkatwomartensVerified publisher0.2.11 of 2See more

kafka twomartens 0.2.1

1 of the 2 container images this version deploys carry CVE-2026-10050.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:latest0ad069035863
jetty-security@12.0.34
12.0.36

Open the chart page →

1,569
zookeepertwomartensVerified publisher0.2.21 of 1See more

zookeeper twomartens 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-10050.

Container imageDigestPackageFixed in
confluentinc/cp-zookeeper:latest7610a50b13e7
jetty-security@9.4.57.v20241219
9.4.63

Open the chart page →

1,733
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-10050.

Container imageDigestPackageFixed in
apache/tika:2.9.2.1-fullae0b86d3c4d0
jetty-security@9.4.54.v20240208
9.4.63

Open the chart page →

45,392
queryservicewbstack0.2.11 of 1See more

queryservice wbstack 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-10050.

Container imageDigestPackageFixed in
ghcr.io/wbstack/queryservice:0.3.6_0.6b83b5b81d4b6
jetty-security@9.4.12.v20180830
9.4.63

Open the chart page →

4,649
drillwearefrank1.3.62 of 3See more

drill wearefrank 1.3.6

2 of the 3 container images this version deploys carry CVE-2026-10050.

Container imageDigestPackageFixed in
apache/drill:1.21.11f96558fd292
jetty-security@9.4.44.v20210927
9.4.63
bitnamilegacy/zookeeper:3.9.0-debian-11-r1110ed1ea3c8d1
jetty-security@9.4.51.v20230217
9.4.63

Open the chart page →

9,399
hazelcastwenerme5.10.31 of 2See more

hazelcast wenerme 5.10.3

1 of the 2 container images this version deploys carry CVE-2026-10050.

Container imageDigestPackageFixed in
hazelcast/management-center:5.5.20095e0320623
jetty-security@12.0.12
12.0.36

Open the chart page →

2,623
metabasewiremindVerified publisher2.27.5-wiremind01 of 1See more

metabase wiremind 2.27.5-wiremind0

1 of the 1 container images this version deploys carry CVE-2026-10050.

Container imageDigestPackageFixed in
metabase/metabase:v0.61.1.x9491ed11c901
jetty-ee9-security@12.1.7
jetty-security@12.1.7
12.1.10
12.1.10

Open the chart page →

1,640

Container images carrying it

246 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
wurstmeister/kafka:latest2d4bbf9cc83d
jetty-security@9.4.43.v20210629
9.4.63
7
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2:8.2.2-1-ubi98e01c0305844
jetty-security@12.0.34
12.0.36
7
library/zookeeper:3.5.5b7a76ec06f68
jetty-security@9.4.17.v20190418
9.4.63
6
solsson/kafka:latest41e5d8f6f290
jetty-security@9.4.48.v20220622
9.4.63
5
gchq/hdfs:3.3.35ec58edbb2db
jetty-security@9.4.43.v20210629
9.4.63
3
library/solr:8.11.18c5f7881cebb
jetty-security@9.4.44.v20210927
9.4.63
3
selenium/hub:3.141.5902f251d48d5f
jetty-security@9.4.12.v20180830
9.4.63
3
signoz/zookeeper:3.7.1fcc4a3288154
jetty-security@9.4.43.v20210629
9.4.63
3
apache/druid:37.0.00116fb802786
jetty-ee8-security@12.1.8
jetty-security@12.1.8
12.1.10
12.1.10
2
apache/kafka:4.3.177e3df905404
jetty-security@12.0.34
12.0.36
2
apache/nifi-registry:1.26.07cdfd8deec92
jetty-security@9.4.54.v20240208
9.4.63
2
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
jetty-security@9.4.10.v20180503
9.4.63
2
apache/tika:2.9.2.1-fullae0b86d3c4d0
jetty-security@9.4.54.v20240208
9.4.63
2
bitnamilegacy/zookeeper:3.9.0-debian-11-r1110ed1ea3c8d1
jetty-security@9.4.51.v20230217
9.4.63
2
confluentinc/cp-kafka:6.2.11-1-ubi8ac776fad95a5
jetty-security@9.4.51.v20230217
9.4.63
2
confluentinc/cp-zookeeper:latest7610a50b13e7
jetty-security@9.4.57.v20241219
9.4.63
2
confluentinc/cp-zookeeper:6.2.11-1-ubi8cae577096489
jetty-security@9.4.51.v20230217
9.4.63
2
datagrok/grok_connect:latestf5876d3aebb8
jetty-security@9.4.58.v20250814
9.4.63
2
dependencytrack/apiserver:4.6.3485ac0952c02
jetty-security@10.0.12
10.0.31
2
gisaia/arlas-permissions-server:28.0.0e612fc722e02
jetty-security@12.1.8
12.1.10
2
gisaia/arlas-persistence-server:28.0.0f667e0ee79be
jetty-security@12.1.8
12.1.10
2
gisaia/arlas-server:28.0.04e693e7b6f37
jetty-security@12.1.8
12.1.10
2
graviteeio/apim-management-api:4.12.19-debian27374522cd04
jetty-security@12.1.9
12.1.10
2
hazelcast/management-center:5.5.20095e0320623
jetty-security@12.0.12
12.0.36
2
jenkins/jenkins:2.426.1-jdk11b470bcdc4ecd
jetty-security@10.0.17
10.0.31
2
jenkins/jenkins:2.541.3-jdk21c4098086090c
jetty-ee9-security@12.1.5
jetty-security@12.1.5
12.1.10
12.1.10
2
library/neo4j:5.20.052d3dec8d455
jetty-security@10.0.20
10.0.31
2
library/neo4j:4.3.2-enterprise56a9453c4064
jetty-security@9.4.42.v20210604
9.4.63
2
library/zookeeper:3.6.180ad2170ad62
jetty-security@9.4.24.v20191120
9.4.63
2
library/zookeeper:3.9.5f258365d4882
jetty-security@9.4.58.v20250814
9.4.63
2
mbentley/omada-controller:4.3f4e682274bed
jetty-security@9.4.15.v20190215
9.4.63
2
metabase/metabase:v0.45.21fb334ce4820
jetty-security@9.4.44.v20210927
9.4.63
2
metabase/metabase:v0.61.1.x9491ed11c901
jetty-ee9-security@12.1.7
jetty-security@12.1.7
12.1.10
12.1.10
2
rodolpheche/wiremock:2.26.03be08a386092
jetty-security@9.4.20.v20190813
9.4.63
2
ghcr.io/appscode/inbox-server:latest:postgres-latest536358d7b17e
jetty-security@12.0.20
12.0.36
2
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
jetty-security@11.0.26
11.0.31
2
ghcr.io/janssenproject/jans/auth-server:0.0.0-nightly7752874e71d8
jetty-ee8-security@12.1.8
jetty-ee9-security@12.1.8
jetty-security@12.1.8
12.1.10
12.1.10
12.1.10
2
ghcr.io/janssenproject/jans/casa:0.0.0-nightly3f2d14563495
jetty-ee8-security@12.1.8
jetty-ee9-security@12.1.8
jetty-security@12.1.8
12.1.10
12.1.10
12.1.10
2
ghcr.io/janssenproject/jans/config-api:0.0.0-nightly900e2b88bd08
jetty-ee8-security@12.1.8
jetty-ee9-security@12.1.8
jetty-security@12.1.8
12.1.10
12.1.10
12.1.10
2
ghcr.io/janssenproject/jans/fido2:0.0.0-nightly2a797804f08c
jetty-ee8-security@12.1.8
jetty-ee9-security@12.1.8
jetty-security@12.1.8
12.1.10
12.1.10
12.1.10
2
ghcr.io/janssenproject/jans/scim:0.0.0-nightly096b8bcbbe45
jetty-ee8-security@12.1.8
jetty-ee9-security@12.1.8
jetty-security@12.1.8
12.1.10
12.1.10
12.1.10
2
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.1-1-ubi9d20bd62f0182
jetty-security@12.0.25
12.0.36
2
1dev/server:11.9.0cd5b12fe5471
jetty-security@9.4.54.v20240208
9.4.63
1
5200710/hadoop:3.2.3-java8092d3088a5fb
jetty-security@9.4.48.v20220622
9.4.63
1
5200710/hive:3.1.3-postgresql-metastoree34ab066d2ed
jetty-security@9.4.40.v20210413
9.4.63
1
ahmetfurkandemir/iceberg-rest-fixture-postgresql:1.10.0142231a0b8b7
jetty-security@11.0.26
11.0.31
1
aktosecurity/data-ingestion-service213aded7adc5
jetty-security@9.4.58.v20250814
9.4.63
1
alfio/alf.io:2.0-M5-26060c836a081446
jetty-security@12.0.34
12.0.36
1
alfresco/alfresco-activemq:5.18.7-jre17-rockylinux85472f88d9b0b
jetty-security@9.4.57.v20241219
9.4.63
1
amazon/dynamodb-local:1.20.01ed00881c937
jetty-security@9.4.48.v20220622
9.4.63
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.