StackRadar

CVE-2026-101916

High

Advisory

Published 30 Sept 2026In the index since 1 Oct 2026
Severity
High
worst across findings
CVSS
7.4
base score, highest
EPSS
0.002
10th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
134
of 17,966 indexed, latest versions
Container images
133
deployed by those charts
Fix available
1 of 1
affected package

@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

Carried by container images the latest versions of 134 of 17,966 indexed charts deploy, on 133 images.

Affected packageAffected versionsFixed inImages
@grpc/grpc-jsnpm1.1.8, 1.3.2, 1.3.3, 1.4.2+34 more1.13.6, 1.14.5133
OSV records
GHSA-m9gg-hp2v-232j

Charts affected

134 by stars
ChartLatestAffected imagesRadar Score
cortezacorteza1.1.01 of 3See more

corteza corteza 1.1.0

1 of the 3 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
cortezaproject/corteza-server-corredor:2024.9.44ea78dfe5364
@grpc/grpc-js@1.12.6
1.13.6

Open the chart page →

9,116
authfcryptexlabsVerified publisher0.12.131 of 4See more

authf cryptexlabs 0.12.13

1 of the 4 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
cryptexlabs/authf:0.12.11189c07411d7c
@grpc/grpc-js@1.11.2
1.13.6

Open the chart page →

4,038
decisionrules-aksdecisionrules-aksVerified publisher0.2.01 of 2See more

decisionrules-aks decisionrules-aks 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

584
decisionrules-eksdecisionrules-eksVerified publisher0.3.01 of 2See more

decisionrules-eks decisionrules-eks 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

584
decisionrules-ingressdecisionrules-ingressVerified publisher0.2.01 of 2See more

decisionrules-ingress decisionrules-ingress 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

584
decisionrules-ocpdecisionrules-ocpVerified publisher0.1.01 of 4See more

decisionrules-ocp decisionrules-ocp 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

2,136
desishowbiz-frontenddesishowbiz1.0.01 of 1See more

desishowbiz-frontend desishowbiz 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
rahulbhiwagade122/desishowbiz:latest08490b70998c
@grpc/grpc-js@1.12.6
1.13.6

Open the chart page →

2,650
devtron-enterprisedevtron48.0.01 of 28See more

devtron-enterprise devtron 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
@grpc/grpc-js@1.13.4
1.13.6

Open the chart page →

72,366
devtron-enterprisedevtron-labs48.0.01 of 28See more

devtron-enterprise devtron-labs 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
@grpc/grpc-js@1.13.4
1.13.6

Open the chart page →

72,366
dial-admindialVerified publisher0.19.01 of 3See more

dial-admin dial 0.19.0

1 of the 3 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
epam/ai-dial-admin-frontend:0.21.01ecee9f1aa09
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

4,032
uptime-kumadjjudas21Verified publisher1.5.181 of 1See more

uptime-kuma djjudas21 1.5.18

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.12bc6f244ecf27
@grpc/grpc-js@1.7.3
1.13.6

Open the chart page →

4,542
uptime-kumaegebackVerified publisher2.0.121 of 1See more

uptime-kuma egeback 2.0.12

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
@grpc/grpc-js@1.8.22
1.13.6

Open the chart page →

33,386
azuriteemberstackVerified publisher1.0.221 of 1See more

azurite emberstack 1.0.22

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

626
eolo-plannereolo-planner-repo0.1.01 of 7See more

eolo-planner eolo-planner-repo 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
arturisimo/server-urjc:v1.0d8dc4430531e
@grpc/grpc-js@1.4.4
1.13.6

Open the chart page →

28,542
uptime-kumafluent-operatorVerified publisher0.1.01 of 1See more

uptime-kuma fluent-operator 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
louislam/uptime-kuma:170233f4acb51
@grpc/grpc-js@1.8.22
1.13.6

Open the chart page →

3,806
uptime-kumafmjstudios0.2.21 of 1See more

uptime-kuma fmjstudios 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.1396510915e6be
@grpc/grpc-js@1.7.3
1.13.6

Open the chart page →

4,521
uptime-kumafossa1.0.11 of 1See more

uptime-kuma fossa 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
quay.io/k3rnel-pan1c/uptime-kuma:1.19.3f975fde9329b
@grpc/grpc-js@1.7.3
1.13.6

Open the chart page →

5,467
galoy-paygaloymoney0.11.481 of 2See more

galoy-pay galoymoney 0.11.48

1 of the 2 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
krtk6160/galoy-nostrdigest-pinnedcc82a694f818
@grpc/grpc-js@1.8.8
1.13.6

Open the chart page →

2,610
galoy-paygaloymoney20.11.481 of 2See more

galoy-pay galoymoney2 0.11.48

1 of the 2 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
krtk6160/galoy-nostrdigest-pinnedcc82a694f818
@grpc/grpc-js@1.8.8
1.13.6

Open the chart page →

2,610
ghostghostVerified publisher0.1.01 of 4See more

ghost ghost 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
library/ghost:5.79.083f7bf209844
@grpc/grpc-js@1.9.7
1.13.6

Open the chart page →

9,364
qryn-helmgigapipeVerified publisher0.1.91 of 1See more

qryn-helm gigapipe 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
qxip/qryn:3.2.3977acc9c7a9fd
@grpc/grpc-js@1.11.1
1.13.6

Open the chart page →

3,368
opentelemetry-demogpg-dev0.33.82 of 27See more

opentelemetry-demo gpg-dev 0.33.8

2 of the 27 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
@grpc/grpc-js@1.10.11
1.13.6
ghcr.io/open-telemetry/demo:1.12.0-paymentserviceb0f13eef3abf
@grpc/grpc-js@1.10.8
1.13.6

Open the chart page →

52,945
librechathajowielandVerified publisher1.1.01 of 1See more

librechat hajowieland 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
@grpc/grpc-js@1.9.15
1.13.6

Open the chart page →

3,492
affinehelmforgeVerified publisher1.0.11 of 3See more

affine helmforge 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
ghcr.io/toeverything/affine:0.27.4b649f5ce2384
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

4,372
countlyhelmforgeVerified publisher1.2.81 of 3See more

countly helmforge 1.2.8

1 of the 3 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
countly/countly-server:25.05.4e3c238248f99
@grpc/grpc-js@1.10.9
1.13.6

Open the chart page →

75,569
hermes-agenthelmforgeVerified publisher1.0.11 of 1See more

hermes-agent helmforge 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.9.24fca358f12efd
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

6,235
homarrhelmforgeVerified publisher1.2.111 of 1See more

homarr helmforge 1.2.11

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v1.77.2f0fb462299af
@grpc/grpc-js@1.12.5
1.13.6

Open the chart page →

634
immichhelmforgeVerified publisher1.2.91 of 5See more

immich helmforge 1.2.9

1 of the 5 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

12,121
bluesky-pdsijmacd1.0.01 of 2See more

bluesky-pds ijmacd 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.405e164855fa1
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

9,614
infisicalinfisical-charts0.4.21 of 3See more

infisical infisical-charts 0.4.2

1 of the 3 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
infisical/infisical:latest3365445909be
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

3,223
dtlinfradao0.0.11 of 1See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
@grpc/grpc-js@1.8.0
1.13.6

Open the chart page →

5,141
nocodbinseefrlab0.2.01 of 1See more

nocodb inseefrlab 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
nocodb/nocodb:latest4ccfc5114506
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

743
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
@grpc/grpc-js@1.3.2
1.13.6

Open the chart page →

7,675
n8njanip81-helm-chartsVerified publisher0.1.41 of 1See more

n8n janip81-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
n8nio/n8n:1.86.08b39ed5a2de9
@grpc/grpc-js@1.13.2
1.13.6

Open the chart page →

6,583
kubeflowkromanow94-kubeflow0.5.11 of 30See more

kubeflow kromanow94-kubeflow 0.5.1

1 of the 30 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
kubeflownotebookswg/centraldashboard:v1.9.2af55c22ef5de
@grpc/grpc-js@1.10.8
1.13.6

Open the chart page →

74,698
tooljetkrzwiatrzyk1.1.11 of 2See more

tooljet krzwiatrzyk 1.1.1

1 of the 2 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
tooljet/tooljet-ce:v1.18.0c85a4720e42e
@grpc/grpc-js@1.4.6
1.13.6

Open the chart page →

5,865
homepagekubernetes-homelab-helm-chartsVerified publisher0.1.01 of 1See more

homepage kubernetes-homelab-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
@grpc/grpc-js@1.14.3
1.14.5

Open the chart page →

1,467
uptime-kumakubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

uptime-kuma kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.2.1-slim059b49d64739
@grpc/grpc-js@1.8.22
1.13.6

Open the chart page →

7,121
uptime-kumalbenicio-communityVerified publisher0.1.11 of 1See more

uptime-kuma lbenicio-community 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
@grpc/grpc-js@1.8.22
1.13.6

Open the chart page →

36,677
uptime-kumaloeken-at-homeVerified publisher2.3.21 of 1See more

uptime-kuma loeken-at-home 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
@grpc/grpc-js@1.8.22
1.13.6

Open the chart page →

36,677
homepagem0sh1-helm-charts0.3.11 of 1See more

homepage m0sh1-helm-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v1.11.0b129cb0f674b
@grpc/grpc-js@1.13.4
1.13.6

Open the chart page →

1,936
eoloplantmca-eoloplaner0.1.01 of 7See more

eoloplant mca-eoloplaner 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
hugohg34/server:0.0.2503e5d8960ff
@grpc/grpc-js@1.4.4
1.13.6

Open the chart page →

30,932
mcp-kubernetesmcp-helmVerified publisher0.2.71 of 1See more

mcp-kubernetes mcp-helm 0.2.7

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
mcp/kubernetes:latest5ffbf7f0a8aa
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

6,233
backstagemcwarmanVerified publisher0.10.101 of 2See more

backstage mcwarman 0.10.10

1 of the 2 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
@grpc/grpc-js@1.10.9
1.13.6

Open the chart page →

10,709
homarrmedia-servarrVerified publisher0.55.31 of 1See more

homarr media-servarr 0.55.3

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v1.77.2f0fb462299af
@grpc/grpc-js@1.12.5
1.13.6

Open the chart page →

634
middleware-odigosmiddleware-labsVerified publisher0.2.411 of 6See more

middleware-odigos middleware-labs 0.2.41

1 of the 6 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/odigos-odiglet:middleware-test-0.0.103c8c835ecee
@grpc/grpc-js@1.8.11
1.13.6

Open the chart page →

8,526
middleware-visionmiddleware-labsVerified publisher0.2.651 of 6See more

middleware-vision middleware-labs 0.2.65

1 of the 6 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/vision-odiglet:middleware-test-0.0.3bce34c98668e
@grpc/grpc-js@1.8.12
1.13.6

Open the chart page →

8,518
bofmojaloop5.1.61 of 1See more

bof mojaloop 5.1.6

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
@grpc/grpc-js@1.14.0
1.14.5

Open the chart page →

2,818
finance-portalmojaloop5.1.43 of 11See more

finance-portal mojaloop 5.1.4

3 of the 11 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
@grpc/grpc-js@1.13.4
1.13.6
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
@grpc/grpc-js@1.13.4
1.13.6
mojaloop/role-assignment-service:v2.1.0def4bf273721
@grpc/grpc-js@1.9.14
1.13.6

Open the chart page →

16,603
reporting-events-processor-svcmojaloop3.5.31 of 1See more

reporting-events-processor-svc mojaloop 3.5.3

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
@grpc/grpc-js@1.13.4
1.13.6

Open the chart page →

2,943

Container images carrying it

133 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/bluesky-social/pds:0.405e164855fa1
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/bryopsida/patchwork:mainc01e018bced4
@grpc/grpc-js@1.13.3
1.13.6
1
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
@grpc/grpc-js@1.9.15
1.13.6
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
@grpc/grpc-js@1.9.15
1.13.6
1
ghcr.io/data-fair/notify:3c739b74dabb0
@grpc/grpc-js@1.13.1
1.13.6
1
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
@grpc/grpc-js@1.1.8
1.13.6
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
@grpc/grpc-js@1.12.2
1.13.6
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
@grpc/grpc-js@1.13.4
1.13.6
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
@grpc/grpc-js@1.13.4
1.13.6
1
ghcr.io/gethomepage/homepage:latest:v2.2.0753eeb0cc22a
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/gethomepage/homepage:v1.11.0b129cb0f674b
@grpc/grpc-js@1.13.4
1.13.6
1
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
@grpc/grpc-js@1.14.3
1.14.5
1
ghcr.io/immich-app/immich-server:v3.2.4d317916b2809
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
@grpc/grpc-js@1.14.0
1.14.5
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
@grpc/grpc-js@1.10.9
1.13.6
1
ghcr.io/mend/renovate-ee-server:15.6.087b77989f48d
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/middleware-labs/odigos-odiglet:middleware-test-0.0.103c8c835ecee
@grpc/grpc-js@1.8.11
1.13.6
1
ghcr.io/middleware-labs/vision-odiglet:middleware-test-0.0.3bce34c98668e
@grpc/grpc-js@1.8.12
1.13.6
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/open-telemetry/demo:3.1.0-payment10d6bd20d8a0
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/open-telemetry/demo:3.1.0-frontend28358db46206
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
@grpc/grpc-js@1.10.11
1.13.6
1
ghcr.io/open-telemetry/demo:1.12.0-paymentserviceb0f13eef3abf
@grpc/grpc-js@1.10.8
1.13.6
1
ghcr.io/quenchworks/images/homepage2044e17671b8
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/quenchworks/images/uptime-kuma78489f7e8402
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/thotischner/observability-mcp:3.9.11775e1e84d5d1
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/toeverything/affine:0.27.4b649f5ce2384
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/zazuko/trifid:v6.0.159bda2bf65d4
@grpc/grpc-js@1.14.4
1.14.5
1
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
@grpc/grpc-js@1.14.4
1.14.5
1
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
@grpc/grpc-js@1.13.4
1.13.6
1
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
@grpc/grpc-js@1.11.3
1.13.6
1
quay.io/k3rnel-pan1c/uptime-kuma:1.19.3f975fde9329b
@grpc/grpc-js@1.7.3
1.13.6
1
quay.io/rhdh/rhdh-hub-rhel9:latest4f8c0f8a8ee0
@grpc/grpc-js@1.14.4
1.14.5
1

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.