StackRadar

CVE-2026-101902

Medium

Advisory

Published 30 Sept 2026In the index since 1 Oct 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.004
33rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
295
of 17,966 indexed, latest versions
Container images
283
deployed by those charts
Fix available
1 of 1
affected package

Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

Carried by container images the latest versions of 295 of 17,966 indexed charts deploy, on 283 images.

Affected packageAffected versionsFixed inImages
axiosnpm0.27.2, 0.28.0, 0.28.1, 0.30.0+56 more0.34.0, 1.20.0283
OSV records
GHSA-9fr6-4gfg-395g

Charts affected

295 by stars
ChartLatestAffected imagesRadar Score
uptime-kumaloeken-at-homeVerified publisher2.3.21 of 1See more

uptime-kuma loeken-at-home 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
axios@0.31.1
0.34.0

Open the chart page →

36,677
redisinsightlogic3579Verified publisher3.4.01 of 1See more

redisinsight logic3579 3.4.0

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
redis/redisinsight:3.485562d67a912
axios@1.15.0
1.20.0

Open the chart page →

1,778
efklovemew67Verified publisher0.0.11 of 2See more

efk lovemew67 0.0.1

1 of the 2 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
nshou/elasticsearch-kibana:kibana7a1d1e36814d1
axios@0.27.2
0.34.0

Open the chart page →

4,025
wudm0sh1-helm-charts0.2.01 of 1See more

wud m0sh1-helm-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
getwud/wud:8.1.1b1cd01c43839
axios@1.7.9
1.20.0

Open the chart page →

6,936
m9sweeperm9sweeperVerified publisher1.6.01 of 6See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
axios@1.6.5
1.20.0

Open the chart page →

10,204
nodecg-chartmarathon-charts0.1.51 of 2See more

nodecg-chart marathon-charts 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
ghcr.io/rodg/nodecg-base:latest31be4bf87070
axios@1.6.8
1.20.0

Open the chart page →

7,998
searchmcp-helmVerified publisher0.1.31 of 2See more

search mcp-helm 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
laituanmanh/websearch-crawler:latest63b6da557c71
axios@1.8.4
1.20.0

Open the chart page →

10,476
backstagemcwarmanVerified publisher0.10.101 of 2See more

backstage mcwarman 0.10.10

1 of the 2 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
axios@1.8.2
1.20.0

Open the chart page →

10,709
MINTmint8.0.21 of 15See more

MINT mint 8.0.2

1 of the 15 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
mintproject/ensemble-manager:d5656dbc01623e291564d2894c72f0e7cb2408f4222e3b941a36
axios@1.10.0
1.20.0

Open the chart page →

116,845
bofmojaloop5.1.61 of 1See more

bof mojaloop 5.1.6

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
axios@1.13.0
1.20.0

Open the chart page →

2,818
finance-portalmojaloop5.1.44 of 11See more

finance-portal mojaloop 5.1.4

4 of the 11 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
axios@1.11.0
1.20.0
mojaloop/reporting-hub-bop-api-svc:v4.1.2b45a2d6f0f2a
axios@1.8.4
1.20.0
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
axios@1.9.0
1.20.0
mojaloop/role-assignment-service:v2.1.0def4bf273721
axios@1.6.7
1.20.0

Open the chart page →

16,603
reporting-events-processor-svcmojaloop3.5.31 of 1See more

reporting-events-processor-svc mojaloop 3.5.3

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
axios@1.11.0
1.20.0

Open the chart page →

2,943
reporting-hub-bop-api-svcmojaloop4.1.31 of 1See more

reporting-hub-bop-api-svc mojaloop 4.1.3

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
mojaloop/reporting-hub-bop-api-svc:v4.1.2b45a2d6f0f2a
axios@1.8.4
1.20.0

Open the chart page →

1,794
reporting-hub-bop-experience-api-svcmojaloop1.0.31 of 1See more

reporting-hub-bop-experience-api-svc mojaloop 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
axios@1.9.0
1.20.0

Open the chart page →

2,839
role-assignment-servicemojaloop3.1.01 of 1See more

role-assignment-service mojaloop 3.1.0

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
mojaloop/role-assignment-service:v2.1.0def4bf273721
axios@1.6.7
1.20.0

Open the chart page →

2,473
security-role-perm-operator-svcmojaloop3.0.01 of 1See more

security-role-perm-operator-svc mojaloop 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
axios@1.13.0
1.20.0

Open the chart page →

2,818
camera-viewermoreillonVerified publisher0.2.11 of 4See more

camera-viewer moreillon 0.2.1

1 of the 4 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
moreillon/camera-proxy:latestce60056b50c2
axios@1.7.7
1.20.0

Open the chart page →

12,447
tianjimsgbyte0.1.171 of 2See more

tianji msgbyte 0.1.17

1 of the 2 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
moonrailgun/tianji:1.11.2b528c8f8fcc4
axios@1.5.0
1.20.0

Open the chart page →

4,801
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
axios@1.13.2
1.20.0

Open the chart page →

5,552
nightscoutmt1905021.1.01 of 3See more

nightscout mt190502 1.1.0

1 of the 3 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:15.0.3f604dc4c03ca
axios@1.5.1
1.20.0

Open the chart page →

6,974
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
axios@1.18.0
1.20.0

Open the chart page →

1,595
uptime-kumancsaVerified publisher1.7.31 of 1See more

uptime-kuma ncsa 1.7.3

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.5c74379ac4509
axios@0.32.0
0.34.0

Open the chart page →

33,235
papergirlneoskop3.2.61 of 5See more

papergirl neoskop 3.2.6

1 of the 5 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
neoskop/papergirl:3.2.67f52b5949f03
axios@1.6.6
1.20.0

Open the chart page →

2,831
bluesky-pdsnerkho-helm-charts0.4.21 of 1See more

bluesky-pds nerkho-helm-charts 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
axios@1.13.2
1.20.0

Open the chart page →

2,649
nostreamnostream0.1.01 of 1See more

nostream nostream 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
ghcr.io/cameri/nostream:mainc134ac2fa289
axios@1.18.0
1.20.0

Open the chart page →

717
nocodbone-acre-fundVerified publisher0.4.61 of 3See more

nocodb one-acre-fund 0.4.6

1 of the 3 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
nocodb/nocodb:0.258.06779a4ddedf2
axios@1.7.7
1.20.0

Open the chart page →

4,200
praecoone-acre-fundVerified publisher0.2.02 of 3See more

praeco one-acre-fund 0.2.0

2 of the 3 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
praecoapp/elastalert-server:202302195a0d8715e8b1
axios@1.3.3
1.20.0
praecoapp/praeco:1.8.1322be3218d7df
axios@1.3.3
1.20.0

Open the chart page →

9,287
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
axios@1.18.0
1.20.0

Open the chart page →

1,595
console-apiovrclk-20.1.11 of 1See more

console-api ovrclk-2 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
ghcr.io/akash-network/console-api:2.64.0ba359097329d
axios@1.7.7
1.20.0

Open the chart page →

3,954
console-webovrclk-20.1.11 of 1See more

console-web ovrclk-2 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
ghcr.io/akash-network/deploy-web:2.46.0ac540172c120
axios@1.7.7
1.20.0

Open the chart page →

3,032
provider-consoleovrclk-20.1.01 of 1See more

provider-console ovrclk-2 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
ghcr.io/akash-network/provider-console:1.0.04d4c19a8d3ff
axios@1.7.7
1.20.0

Open the chart page →

2,561
provider-console-securityovrclk-20.1.01 of 1See more

provider-console-security ovrclk-2 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
ghcr.io/akash-network/provider-console-security:1.0.0b87a48ec51dd
axios@0.27.2
0.34.0

Open the chart page →

1,605
mishtip2p-avs0.1.01 of 2See more

mishti p2p-avs 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
mishtinetwork/operator:latestbb3fe67a5f7c
axios@1.7.2
1.20.0

Open the chart page →

4,465
ungatep2p-avs0.1.02 of 3See more

ungate p2p-avs 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
xom4ekp2p/infini-route-attestators-public-mainnet-attester:latestd0e0aa238b02
axios@1.7.2
1.20.0
xom4ekp2p/infini-route-attestators-public-mainnet-avs-webapi:latest2745b5fd8785
axios@1.6.7
1.20.0

Open the chart page →

29,482
portalplatform-mesh-portal0.21.11 of 1See more

portal platform-mesh-portal 0.21.1

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
ghcr.io/platform-mesh/portal:v0.27.16a7ecd5a0dc2
axios@1.18.0
1.20.0

Open the chart page →

330
prismeai-coreprismeai1.12.31 of 7See more

prismeai-core prismeai 1.12.3

1 of the 7 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-api-gateway:prodf8474a665b11
axios@1.19.0
1.20.0

Open the chart page →

4,859
coolifyquench-coolifyVerified publisher0.0.291 of 4See more

coolify quench-coolify 0.0.29

1 of the 4 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/coolify-realtimedigest-pinned242ff4c98c00
axios@0.33.0
0.34.0

Open the chart page →

460
coolify-realtimequench-coolify-realtimeVerified publisher0.0.111 of 1See more

coolify-realtime quench-coolify-realtime 0.0.11

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/coolify-realtimedigest-pinned242ff4c98c00
axios@0.33.0
0.34.0

Open the chart page →

266
uptime-kumaquench-uptime-kumaVerified publisher0.0.51 of 1See more

uptime-kuma quench-uptime-kuma 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/uptime-kumadigest-pinned78489f7e8402
axios@0.33.0
0.34.0

Open the chart page →

87
kratos-selfservice-ui-noderadar-baseVerified publisher0.43.11 of 1See more

kratos-selfservice-ui-node radar-base 0.43.1

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
oryd/kratos-selfservice-ui-node:v0.13.0-20d454c21c11bc
axios@1.2.6
1.20.0

Open the chart page →

3,025
readability-js-serverreadability-js-server0.1.01 of 1See more

readability-js-server readability-js-server 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
phpdockerio/readability-js-server:1.8.0ea8354b42600
axios@1.13.2
1.20.0

Open the chart page →

2,085
recipe-apprecipe-app0.1.01 of 2See more

recipe-app recipe-app 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
anamskenneth/recipe_frontend:2025-06-079ecf04f42cc3
axios@1.7.7
1.20.0

Open the chart page →

4,013
helm-redchefredchef0.1.01 of 3See more

helm-redchef redchef 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
sharanalwar/redchef-frontend:latest5e82950b16b7
axios@1.8.4
1.20.0

Open the chart page →

5,273
redisinsightredisinsightVerified publisher0.1.01 of 1See more

redisinsight redisinsight 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
redis/redisinsight:latestb5e19ee240ab
axios@1.16.0
1.20.0

Open the chart page →

1,337
redisinsightredisinsight-helmVerified publisher0.1.11 of 1See more

redisinsight redisinsight-helm 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
redis/redisinsight:2.46699d341bd329
axios@1.6.7
1.20.0

Open the chart page →

2,070
claude-relayrevolution10.1.371 of 4See more

claude-relay revolution1 0.1.37

1 of the 4 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
axios@1.11.0
1.20.0

Open the chart page →

5,320
mastodonrivals-spaceVerified publisher3.1.21 of 3See more

mastodon rivals-space 3.1.2

1 of the 3 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
axios@1.3.2
1.20.0

Open the chart page →

6,148
devtron-enterpriseromholdings48.0.01 of 28See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
axios@1.13.6
1.20.0

Open the chart page →

72,366
audiobookshelfrubxkubeVerified publisher0.1.31 of 1See more

audiobookshelf rubxkube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.36.0180acad33d69
axios@0.27.2
0.34.0

Open the chart page →

1,919
uptime-kumarubxkubeVerified publisher1.2.11 of 1See more

uptime-kuma rubxkube 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-101902.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.4.091e963bfda56
axios@0.32.0
0.34.0

Open the chart page →

33,449

Container images carrying it

283 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
nightscout/cgm-remote-monitor:15.0.2ad29ca7a4de6
axios@1.5.1
1.20.0
1
nightscout/cgm-remote-monitor:15.0.3f604dc4c03ca
axios@1.5.1
1.20.0
1
nocodb/nocodb:0.258.06779a4ddedf2
axios@1.7.7
1.20.0
1
nocodb/nocodb:0.301.5d9516f0bf546
axios@1.13.6
1.20.0
1
nodered/node-red:5.0.410f40d0a83e7
axios@1.19.0
1.20.0
1
nodered/node-red:4.1.2216e7403aab9
axios@1.12.2
1.20.0
1
nodered/node-red:4.1.10-minimald73ae167cb9b
axios@1.16.0
1.20.0
1
nodered/node-red:3.0.2-18e2632a7a35dd
axios@1.6.5
1.20.0
1
nshou/elasticsearch-kibana:kibana7a1d1e36814d1
axios@0.27.2
0.34.0
1
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
axios@0.28.1
0.34.0
1
opensearchproject/opensearch-dashboards:2.10.0485a0019e5d6
axios@0.27.2
0.34.0
1
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
axios@0.28.0
0.34.0
1
oryd/kratos-selfservice-ui-node:v26.2.046a7bac1ad0c
axios@1.13.6
1.20.0
1
oryd/kratos-selfservice-ui-node:v0.13.0-20d454c21c11bc
axios@1.2.6
1.20.0
1
otwld/velero-ui:0.10.31c228d9ef71b
axios@1.18.1
1.20.0
1
outlinewiki/outline:0.82.0494dfb9249a6
axios@1.7.9
1.20.0
1
outlinewiki/outline:1.10.1832051f039b4
axios@1.18.1
1.20.0
1
phpdockerio/readability-js-server:1.8.0ea8354b42600
axios@1.13.2
1.20.0
1
polonel/trudesk:1.2.60cf6513f6fe3
axios@0.27.2
0.34.0
1
praecoapp/elastalert-server:202302195a0d8715e8b1
axios@1.3.3
1.20.0
1
praecoapp/praeco:1.8.1322be3218d7df
axios@1.3.3
1.20.0
1
qxip/qryn:3.2.3977acc9c7a9fd
axios@1.7.7
1.20.0
1
redis/redisinsight:2.68019fcf774631
axios@1.7.7
1.20.0
1
redis/redisinsight:3.2.055542a762210
axios@1.12.2
1.20.0
1
redis/redisinsight:2.46699d341bd329
axios@1.6.7
1.20.0
1
redis/redisinsight:3.485562d67a912
axios@1.15.0
1.20.0
1
rocketadmin/rocketadmin:1.17.710955ef540b9
axios@1.15.1
1.20.0
1
sharanalwar/redchef-frontend:latest5e82950b16b7
axios@1.8.4
1.20.0
1
shyamkrishna21/shopsync:latest3998b83def53
axios@1.13.5
1.20.0
1
sigp/siren:v3.0.42c219b04758e
axios@1.9.0
1.20.0
1
speckle/speckle-frontend-2:2.20.6-branch.testing1.154030-9b0911432fc940d9b4c
axios@1.7.2
1.20.0
1
speckle/speckle-frontend-2:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbfdc008effc7a
axios@1.7.2
1.20.0
1
speckle/speckle-preview-service:2.21.3-branch.testing5.219631-2153bef52cad5e3293e
axios@1.7.7
1.20.0
1
supabase/storage-api:v1.12.0f983fb50bd95
axios@1.7.4
1.20.0
1
supporttools/uptime-kuma:v2.6f8a49ed65809
axios@0.28.1
0.34.0
1
th0th/node-red:4.0.3-debiand06fa39f7406
axios@1.7.7
1.20.0
1
thecodingmachine/workadventure-back:helm-chart53a30c962ce9
axios@1.6.6
1.20.0
1
thecodingmachine/workadventure-back:v1.17.764001369dad5
axios@1.3.5
1.20.0
1
thecodingmachine/workadventure-map-storage:helm-chart519c31c6e7ec
axios@1.6.6
1.20.0
1
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
axios@1.3.5
1.20.0
1
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
axios@1.3.5
1.20.0
1
thecodingmachine/workadventure-play:helm-chartdf31006cc4ce
axios@1.6.6
1.20.0
1
thecodingmachine/workadventure-uploader:v1.17.73ccd467543b3
axios@1.3.5
1.20.0
1
thecodingmachine/workadventure-uploader:helm-chart962e98843fb2
axios@1.6.6
1.20.0
1
treskon/portrait-ui:DEV-lateste7970783bc8d
axios@1.15.2
1.20.0
1
twentycrm/twenty:latest:v2.41.047bcefe4e497
axios@1.19.0
1.20.0
1
twentycrm/twenty:v2.43.0b2b662b1bef1
axios@1.19.0
1.20.0
1
twentycrm/twenty:v2.22.0e7d9948bf284
axios@1.17.0
1.20.0
1
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
axios@1.7.5
1.20.0
1
unleashorg/unleash-enterprise:7.5.0245aeba40053
axios@1.13.6
1.20.0
1

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.