StackRadar

CVE-2026-101916

High

Advisory

Published 30 Sept 2026In the index since 1 Oct 2026
Severity
High
worst across findings
CVSS
7.4
base score, highest
EPSS
0.002
10th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
134
of 17,966 indexed, latest versions
Container images
133
deployed by those charts
Fix available
1 of 1
affected package

@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

Carried by container images the latest versions of 134 of 17,966 indexed charts deploy, on 133 images.

Affected packageAffected versionsFixed inImages
@grpc/grpc-jsnpm1.1.8, 1.3.2, 1.3.3, 1.4.2+34 more1.13.6, 1.14.5133
OSV records
GHSA-m9gg-hp2v-232j

Charts affected

134 by stars
ChartLatestAffected imagesRadar Score
reporting-hub-bop-experience-api-svcmojaloop1.0.31 of 1See more

reporting-hub-bop-experience-api-svc mojaloop 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
@grpc/grpc-js@1.13.4
1.13.6

Open the chart page →

2,839
role-assignment-servicemojaloop3.1.01 of 1See more

role-assignment-service mojaloop 3.1.0

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
mojaloop/role-assignment-service:v2.1.0def4bf273721
@grpc/grpc-js@1.9.14
1.13.6

Open the chart page →

2,473
security-role-perm-operator-svcmojaloop3.0.01 of 1See more

security-role-perm-operator-svc mojaloop 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
@grpc/grpc-js@1.14.0
1.14.5

Open the chart page →

2,818
myawesomeappmyawesomapp-mitchxxx0.1.11 of 1See more

myawesomeapp myawesomapp-mitchxxx 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
mitchxxx/amazon:214e72480ec63a
@grpc/grpc-js@1.8.14
1.13.6

Open the chart page →

2,248
myawesomeapp14myawesomeapp140.1.11 of 1See more

myawesomeapp14 myawesomeapp14 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
ccjacobs14/amazon:59a9b14a6f09e
@grpc/grpc-js@1.8.14
1.13.6

Open the chart page →

2,248
myawesomeapp-janmyawesomeapp-jan0.1.11 of 1See more

myawesomeapp-jan myawesomeapp-jan 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
ooghenekaro/amazon:latest03394ba1d6d8
@grpc/grpc-js@1.8.14
1.13.6

Open the chart page →

2,276
myawesomeapp-marmyawesomeapp-mar0.1.11 of 1See more

myawesomeapp-mar myawesomeapp-mar 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
winfred008/amazon:910a68de5b398
@grpc/grpc-js@1.8.14
1.13.6

Open the chart page →

2,248
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

1,595
uptime-kumancsaVerified publisher1.7.31 of 1See more

uptime-kuma ncsa 1.7.3

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.5c74379ac4509
@grpc/grpc-js@1.8.22
1.13.6

Open the chart page →

33,235
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

1,595
console-apiovrclk-20.1.11 of 1See more

console-api ovrclk-2 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
ghcr.io/akash-network/console-api:2.64.0ba359097329d
@grpc/grpc-js@1.10.8
1.13.6

Open the chart page →

3,954
homepagequench-homepageVerified publisher0.0.41 of 1See more

homepage quench-homepage 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/homepagedigest-pinned2044e17671b8
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

73
uptime-kumaquench-uptime-kumaVerified publisher0.0.51 of 1See more

uptime-kuma quench-uptime-kuma 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/uptime-kumadigest-pinned78489f7e8402
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

87
devtron-enterpriseromholdings48.0.01 of 28See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
@grpc/grpc-js@1.13.4
1.13.6

Open the chart page →

72,366
routr-connectroutr0.4.35 of 10See more

routr-connect routr 0.4.3

5 of the 10 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
fonoster/routr-connect:2.13.6e8c84b5eaa67
@grpc/grpc-js@1.10.11
1.13.6
fonoster/routr-dispatcher:2.13.65f8f380dc174
@grpc/grpc-js@1.10.11
1.13.6
fonoster/routr-location:2.13.6051ba9c34ef5
@grpc/grpc-js@1.10.11
1.13.6
fonoster/routr-pgdata:2.13.6e4d5f5ff1945
@grpc/grpc-js@1.10.11
1.13.6
fonoster/routr-registry:2.13.6e27001f2813c
@grpc/grpc-js@1.10.11
1.13.6

Open the chart page →

11,608
uptime-kumarubxkubeVerified publisher1.2.11 of 1See more

uptime-kuma rubxkube 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.4.091e963bfda56
@grpc/grpc-js@1.8.22
1.13.6

Open the chart page →

33,449
uptime-kumasarab97Verified publisher0.1.51 of 1See more

uptime-kuma sarab97 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.22.10b55bcb83a1c
@grpc/grpc-js@1.7.3
1.13.6

Open the chart page →

4,994
unifi-protectschichtelVerified publisher0.10.11 of 1See more

unifi-protect schichtel 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
@grpc/grpc-js@1.6.12
1.13.6

Open the chart page →

5,786
uptime-kumaschoenwald1.0.101 of 1See more

uptime-kuma schoenwald 1.0.10

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
@grpc/grpc-js@1.8.22
1.13.6

Open the chart page →

33,246
infisicalsinextraVerified publisher0.6.01 of 1See more

infisical sinextra 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
infisical/infisical:v0.165.602082bf13163
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

3,871
retail-store-sample-checkout-chartstacksimplifyVerified publisher1.0.01 of 1See more

retail-store-sample-checkout-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
@grpc/grpc-js@1.13.4
1.13.6

Open the chart page →

1,490
fdi-dotstatsuite-dlmstatcan0.3.11 of 1See more

fdi-dotstatsuite-dlm statcan 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
@grpc/grpc-js@1.3.3
1.13.6

Open the chart page →

4,037
fdi-dotstatsuite-sfs-solrstatcan1.0.21 of 4See more

fdi-dotstatsuite-sfs-solr statcan 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

6,417
fdi-dotstatsuite-sfs-solr-statefulstatcan1.0.21 of 2See more

fdi-dotstatsuite-sfs-solr-stateful statcan 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

1,201
uptime-kumasupporttools2.6.01 of 3See more

uptime-kuma supporttools 2.6.0

1 of the 3 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
supporttools/uptime-kuma:v2.6f8a49ed65809
@grpc/grpc-js@1.7.3
1.13.6

Open the chart page →

4,521
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
supabase/storage-api:latest5fea789899d4
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

10,026
thingsboardthingsboardVerified publisher0.1.31 of 12See more

thingsboard thingsboard 0.1.3

1 of the 12 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
thingsboard/tb-js-executor:3.4.113e1eadf8ace
@grpc/grpc-js@1.6.7
1.13.6

Open the chart page →

26,622
kubernetes-external-secretstrozz6.3.01 of 1See more

kubernetes-external-secrets trozz 6.3.0

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
@grpc/grpc-js@1.1.8
1.13.6

Open the chart page →

2,911
homepageunknowniq1.8.81 of 2See more

homepage unknowniq 1.8.8

1 of the 2 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.2.0753eeb0cc22a
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

570
devportalveecode-platform-nextVerified publisher0.1.261 of 1See more

devportal veecode-platform-next 0.1.26

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinned28d1bafed0cf
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

2,041
n8nvictorlane1.0.181 of 1See more

n8n victorlane 1.0.18

1 of the 1 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
n8nio/n8n:1.115.1ed16e560c40e
@grpc/grpc-js@1.13.2
1.13.6

Open the chart page →

7,081
kibanawiremindVerified publisher8.5.241 of 2See more

kibana wiremind 8.5.24

1 of the 2 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
library/kibana:8.19.2235544f1ff28a
@grpc/grpc-js@1.14.4
1.14.5

Open the chart page →

1,611
workadventure-adminwork-adventure1.0.0-21-33 of 14See more

workadventure-admin work-adventure 1.0.0-21-3

3 of the 14 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-back:helm-chart53a30c962ce9
@grpc/grpc-js@1.8.13
1.13.6
thecodingmachine/workadventure-map-storage:helm-chart519c31c6e7ec
@grpc/grpc-js@1.8.13
1.13.6
thecodingmachine/workadventure-play:helm-chartdf31006cc4ce
@grpc/grpc-js@1.8.13
1.13.6

Open the chart page →

16,316
workadventureworkadventure1.1.03 of 9See more

workadventure workadventure 1.1.0

3 of the 9 container images this version deploys carry CVE-2026-101916.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-back:v1.17.764001369dad5
@grpc/grpc-js@1.8.13
1.13.6
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
@grpc/grpc-js@1.8.13
1.13.6
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
@grpc/grpc-js@1.8.13
1.13.6

Open the chart page →

16,609

Container images carrying it

133 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/bluesky-social/pds:0.405e164855fa1
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/bryopsida/patchwork:mainc01e018bced4
@grpc/grpc-js@1.13.3
1.13.6
1
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
@grpc/grpc-js@1.9.15
1.13.6
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
@grpc/grpc-js@1.9.15
1.13.6
1
ghcr.io/data-fair/notify:3c739b74dabb0
@grpc/grpc-js@1.13.1
1.13.6
1
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
@grpc/grpc-js@1.1.8
1.13.6
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
@grpc/grpc-js@1.12.2
1.13.6
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
@grpc/grpc-js@1.13.4
1.13.6
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
@grpc/grpc-js@1.13.4
1.13.6
1
ghcr.io/gethomepage/homepage:latest:v2.2.0753eeb0cc22a
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/gethomepage/homepage:v1.11.0b129cb0f674b
@grpc/grpc-js@1.13.4
1.13.6
1
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
@grpc/grpc-js@1.14.3
1.14.5
1
ghcr.io/immich-app/immich-server:v3.2.4d317916b2809
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
@grpc/grpc-js@1.14.0
1.14.5
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
@grpc/grpc-js@1.10.9
1.13.6
1
ghcr.io/mend/renovate-ee-server:15.6.087b77989f48d
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/middleware-labs/odigos-odiglet:middleware-test-0.0.103c8c835ecee
@grpc/grpc-js@1.8.11
1.13.6
1
ghcr.io/middleware-labs/vision-odiglet:middleware-test-0.0.3bce34c98668e
@grpc/grpc-js@1.8.12
1.13.6
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/open-telemetry/demo:3.1.0-payment10d6bd20d8a0
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/open-telemetry/demo:3.1.0-frontend28358db46206
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
@grpc/grpc-js@1.10.11
1.13.6
1
ghcr.io/open-telemetry/demo:1.12.0-paymentserviceb0f13eef3abf
@grpc/grpc-js@1.10.8
1.13.6
1
ghcr.io/quenchworks/images/homepage2044e17671b8
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/quenchworks/images/uptime-kuma78489f7e8402
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/thotischner/observability-mcp:3.9.11775e1e84d5d1
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/toeverything/affine:0.27.4b649f5ce2384
@grpc/grpc-js@1.14.4
1.14.5
1
ghcr.io/zazuko/trifid:v6.0.159bda2bf65d4
@grpc/grpc-js@1.14.4
1.14.5
1
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
@grpc/grpc-js@1.14.4
1.14.5
1
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
@grpc/grpc-js@1.13.4
1.13.6
1
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
@grpc/grpc-js@1.11.3
1.13.6
1
quay.io/k3rnel-pan1c/uptime-kuma:1.19.3f975fde9329b
@grpc/grpc-js@1.7.3
1.13.6
1
quay.io/rhdh/rhdh-hub-rhel9:latest4f8c0f8a8ee0
@grpc/grpc-js@1.14.4
1.14.5
1

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.