StackRadar

CVE-2026-102268

Critical

Advisory

Published 28 Sept 2026In the index since 30 Sept 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
0.002
8th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
379
of 17,957 indexed, latest versions
Container images
377
deployed by those charts
Fix available
1 of 2
affected packages

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

Carried by container images the latest versions of 379 of 17,957 indexed charts deploy, on 377 images.

Affected packageAffected versionsFixed inImages
pyjwtpypi1.4.2, 1.5.3, 1.6.1, 1.6.4+17 more2.14.0377
pyjwtdeb1.7.1-2ubuntu2.1, 2.3.0-1, 2.3.0-1ubuntu0.2, 2.3.0-1ubuntu0.3+6 moreno fix listed39
OSV records
DEBIAN-CVE-2026-102268GHSA-ffc3-869f-jxw9UBUNTU-CVE-2026-102268
Trending
Rank 45 in indexed charts, since 30 Sept 2026. See the ranking →

Charts affected

379 by stars
ChartLatestAffected imagesRadar Score
authentikgoauthentikOfficialVerified publisher2026.8.31 of 1See more

authentik goauthentik 2026.8.3

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.8.3ab9b4e8cc4ab
pyjwt@2.13.0
2.14.0

Open the chart page →

1,214
jupyterhubjupyterhubOfficialVerified publisher4.4.21 of 7See more

jupyterhub jupyterhub 4.4.2

1 of the 7 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
pyjwt@2.13.0
2.14.0

Open the chart page →

8,785
uptime-kumauptime-kumaVerified publisher4.2.01 of 1See more

uptime-kuma uptime-kuma 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
pyjwt@2.6.0-1+deb12u1
pyjwt@2.6.0
no fix listed
2.14.0

Open the chart page →

32,872
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
pyjwt@2.8.0
2.14.0

Open the chart page →

11,951
home-assistanthelm-hassVerified publisher0.3.831 of 1See more

home-assistant helm-hass 0.3.83

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.43e6710a7ab2a
pyjwt@2.13.0
2.14.0

Open the chart page →

2,478
mlflowcommunity-chartsVerified publisher1.11.71 of 1See more

mlflow community-charts 1.11.7

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
burakince/mlflow:3.16.0ab4b566644b9
pyjwt@2.13.0
2.14.0

Open the chart page →

856
maildocker-postfixVerified publisher5.1.01 of 1See more

mail docker-postfix 5.1.0

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
boky/postfix:v5.1.0aafc77238423
pyjwt@2.10.1
2.14.0

Open the chart page →

6,129
datahubdatahubVerified publisher1.1.51 of 4See more

datahub datahub 1.1.5

1 of the 4 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
acryldata/datahub-actions:v1.7.0.1c5fd70130157
pyjwt@2.13.0
2.14.0

Open the chart page →

1,091
netboxbootcVerified publisher4.1.11 of 4See more

netbox bootc 4.1.1

1 of the 4 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.2.83d652dca5351
pyjwt@2.4.0
2.14.0

Open the chart page →

9,606
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
allegroai/clearml:2.0.0-613713ae38f7daf
pyjwt@2.8.0
2.14.0

Open the chart page →

11,045
weblateweblateOfficialVerified publisher0.5.381 of 3See more

weblate weblate 0.5.38

1 of the 3 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
weblate/weblate:2026.9.1.2f0be5b122b38
pyjwt@2.13.0
2.14.0

Open the chart page →

7,119
stackgres-operatorstackgres-chartsOfficialVerified publisher1.19.21 of 2See more

stackgres-operator stackgres-charts 1.19.2

1 of the 2 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
quay.io/stackgres/operator:1.19.282f33ab3fb1e
pyjwt@2.13.0
2.14.0

Open the chart page →

2,310
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
langgenius/dify-api:1.16.1dcefa5f7c47c
pyjwt@2.13.0
2.14.0

Open the chart page →

71,885
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
grafana/oncall:v1.16.5499851658393
pyjwt@2.10.1
2.14.0

Open the chart page →

16,723
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.14.3f09282d281f6
pyjwt@2.10.1
2.14.0

Open the chart page →

12,133
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
pyjwt@2.3.0
2.14.0

Open the chart page →

7,970
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
pyjwt@2.4.0
2.14.0

Open the chart page →

6,478
litellm-helmlitellm1.103.11 of 2See more

litellm-helm litellm 1.103.1

1 of the 2 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm:1.103.1df15400b5b80
pyjwt@2.13.0
2.14.0

Open the chart page →

5,387
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
pyjwt@2.8.0
2.14.0

Open the chart page →

6,304
supersetcloudposse1.2.01 of 1See more

superset cloudposse 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
amancevice/superset:0.35.212a0a9e66550
pyjwt@1.7.1
2.14.0

Open the chart page →

6,246
memgraphmemgraphVerified publisher1.0.71 of 2See more

memgraph memgraph 1.0.7

1 of the 2 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
memgraph/memgraph:3.13.1bd3fe13228f4
pyjwt@2.13.0
2.14.0

Open the chart page →

1,425
paperless-ngxfmjstudios0.2.81 of 5See more

paperless-ngx fmjstudios 0.2.8

1 of the 5 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.10.1a132c2ac7c57
pyjwt@2.8.0
2.14.0

Open the chart page →

32,695
openclawopenclawVerified publisher1.94.01 of 2See more

openclaw openclaw 1.94.0

1 of the 2 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.56.7b1ba7b054af2
pyjwt@2.7.0-1ubuntu0.1
pyjwt@2.7.0
no fix listed
2.14.0

Open the chart page →

3,842
dependabot-gitlabdependabot-gitlabVerified publisher6.3.01 of 3See more

dependabot-gitlab dependabot-gitlab 6.3.0

1 of the 3 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
andrcuns/dependabot-gitlab:7.7.0-alpha.143060f159f4c
pyjwt@2.7.0-1ubuntu0.1
pyjwt@2.7.0
no fix listed
2.14.0

Open the chart page →

41,587
ilumilumOfficialVerified publisher6.7.31 of 19See more

ilum ilum 6.7.3

1 of the 19 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ilum/api:6.7.3624fd09528c8
pyjwt@2.13.0
2.14.0

Open the chart page →

23,726
nautobotnautobotOfficialVerified publisher3.1.21 of 1See more

nautobot nautobot 3.1.2

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
networktocode/nautobot:3.0-py3.13ed484336b1ad
pyjwt@2.12.1
2.14.0

Open the chart page →

4,957
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
pyjwt@2.10.1
2.14.0

Open the chart page →

18,071
paperless-ngxpaperless-ngxVerified publisher0.3.231 of 3See more

paperless-ngx paperless-ngx 0.3.23

1 of the 3 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.2.15fa76604a81d
pyjwt@2.13.0
2.14.0

Open the chart page →

8,353
home-assistantalekcVerified publisher2.11.41 of 1See more

home-assistant alekc 2.11.4

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.43e6710a7ab2a
pyjwt@2.13.0
2.14.0

Open the chart page →

2,478
home-assistantandrenarchyVerified publisher14.104.01 of 1See more

home-assistant andrenarchy 14.104.0

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
pyjwt@2.13.0
2.14.0

Open the chart page →

2,478
uptime-kumaduyet0.1.81 of 1See more

uptime-kuma duyet 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.18.5a84767d7934f
pyjwt@1.7.0
2.14.0

Open the chart page →

4,708
gluugluuOfficialVerified publisher1.8.521 of 5See more

gluu gluu 1.8.52

1 of the 5 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
gluufederation/cloudtools:4.5.17-1fe944d2e5d0f
pyjwt@2.13.0
2.14.0

Open the chart page →

323
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.11.11da5c38c6a78
pyjwt@2.8.0
2.14.0

Open the chart page →

6,599
abcdesktopabcdesktopOfficialVerified publisher4.4.131 of 9See more

abcdesktop abcdesktop 4.4.13

1 of the 9 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/abcdesktopio/pyos:4.4.alpine_latest5c43e3d66d2e
pyjwt@2.13.0
2.14.0

Open the chart page →

970
baserowbaserow-chartVerified publisher1.0.561 of 6See more

baserow baserow-chart 1.0.56

1 of the 6 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
baserow/backend:2.3.37c00549b3a6f
pyjwt@2.13.0
2.14.0

Open the chart page →

18,749
fadicetic0.3.13 of 25See more

fadi cetic 0.3.1

3 of the 25 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
amancevice/superset:0.35.212a0a9e66550
pyjwt@1.7.1
2.14.0
jupyterhub/k8s-hub:0.11.1b6b4a1a34bf0
pyjwt@1.7.1
2.14.0
jupyterhub/k8s-singleuser-sample:0.11.1e3e6f3051df8
pyjwt@1.7.1
2.14.0

Open the chart page →

137,043
daskhubdask2024.1.12 of 9See more

daskhub dask 2024.1.1

2 of the 9 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
pyjwt@2.8.0
2.14.0
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
pyjwt@2.8.0
2.14.0

Open the chart page →

14,861
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
datamate/seafile-professional:11.0.202dd66b722464
pyjwt@2.3.0-1ubuntu0.2
pyjwt@2.6.0
no fix listed
2.14.0

Open the chart page →

83,881
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.55.42ed0183564d7
pyjwt@2.7.0-1ubuntu0.1
pyjwt@2.7.0
no fix listed
2.14.0

Open the chart page →

10,952
hertzbeathertzbeatOfficialVerified publisher1.8.12 of 4See more

hertzbeat hertzbeat 1.8.1

2 of the 4 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
apache/hertzbeat:1.8.075d48a62748f
pyjwt@2.7.0-1
pyjwt@2.7.0
no fix listed
2.14.0
apache/hertzbeat-collector:1.8.0a2bab1be574c
pyjwt@2.7.0-1
pyjwt@2.7.0
no fix listed
2.14.0

Open the chart page →

15,200
taigarc-helm-charts0.1.01 of 7See more

taiga rc-helm-charts 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
taigaio/taiga-back:6.4.29f97323cc150
pyjwt@2.1.0
2.14.0

Open the chart page →

7,436
netboxstartechnicaVerified publisher5.1.01 of 4See more

netbox startechnica 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
pyjwt@2.8.0
2.14.0

Open the chart page →

1,799
zenmlzenml0.97.01 of 1See more

zenml zenml 0.97.0

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
zenmldocker/zenml-server:0.97.0aaa74934d606
pyjwt@2.13.0
2.14.0

Open the chart page →

1,472
alerta-webalerta-webVerified publisher0.1.121 of 2See more

alerta-web alerta-web 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
hayk96/alerta-web:9.0.486377705e9e3
pyjwt@2.10.1
2.14.0

Open the chart page →

3,696
convertigoconvertigoOfficialVerified publisher8.4.51 of 5See more

convertigo convertigo 8.4.5

1 of the 5 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
pyjwt@2.8.0
2.14.0

Open the chart page →

15,947
defectdojodefectdojo1.9.541 of 4See more

defectdojo defectdojo 1.9.54

1 of the 4 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
defectdojo/defectdojo-django:3.3.3006516f0f62086
pyjwt@2.13.0
2.14.0

Open the chart page →

2,018
openshift-secured-pgadmineximiaitVerified publisher0.2.01 of 2See more

openshift-secured-pgadmin eximiait 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
dpage/pgadmin4:7.537946e4f3e7b
pyjwt@2.7.0
2.14.0

Open the chart page →

14,840
flyte-binaryflyte2.0.501 of 4See more

flyte-binary flyte 2.0.50

1 of the 4 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
pyjwt@2.13.0
2.14.0

Open the chart page →

4,438
hermes-agenthermes-agentVerified publisher1.16.01 of 1See more

hermes-agent hermes-agent 1.16.0

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.9.24fca358f12efd
pyjwt@2.13.0
2.14.0

Open the chart page →

6,076
home-assistanthome-assistantVerified publisher0.5.111 of 3See more

home-assistant home-assistant 0.5.11

1 of the 3 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.3d89226851697
pyjwt@2.13.0
2.14.0

Open the chart page →

2,729

Container images carrying it

377 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/substra/substra-backend:1.0.121967f54ec86
pyjwt@2.9.0
2.14.0
1
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
pyjwt@2.10.1
2.14.0
1
ghcr.io/tarkyaio/tarka:0.4.1e8d3f1512f06
pyjwt@2.12.1
2.14.0
1
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
pyjwt@2.4.0
2.14.0
1
ghcr.io/unique-ag/ai/search-proxy:2026.40.02bd74586650d
pyjwt@2.13.0
2.14.0
1
ghcr.io/vinny1892/octantis:latest45459c0910fc
pyjwt@2.12.1
2.14.0
1
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
pyjwt@2.8.0
2.14.0
1
public.ecr.aws/aktosecurity/akto-ai-automated-testing:latest573542399fe4
pyjwt@2.13.0
2.14.0
1
public.ecr.aws/datadog/agent:7.73.0f4925b15ce94
pyjwt@2.10.1
2.14.0
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
pyjwt@2.9.0
2.14.0
1
quay.io/cephcsi/cephcsi:v3.5.128a674af1df2
pyjwt@1.6.1
2.14.0
1
quay.io/cloudnativetoolkit/cli-tools:v1.1-v1.8.2d6fd2a9e3273
pyjwt@2.4.0
2.14.0
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
pyjwt@2.12.1
2.14.0
1
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
pyjwt@2.10.1
2.14.0
1
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
pyjwt@2.3.0
2.14.0
1
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
pyjwt@2.13.0
2.14.0
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
pyjwt@2.12.1
2.14.0
1
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
pyjwt@2.8.0
2.14.0
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
pyjwt@2.12.1
2.14.0
1
quay.io/k3rnel-pan1c/uptime-kuma:1.19.3f975fde9329b
pyjwt@1.7.1
2.14.0
1
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
pyjwt@2.4.0
2.14.0
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
pyjwt@2.10.1
2.14.0
1
quay.io/stackgres/operator:1.19.282f33ab3fb1e
pyjwt@2.13.0
2.14.0
1
registry.gitlab.com/crafty-controller/crafty-4:latest7b6e87514259
pyjwt@2.8.0
2.14.0
1
registry.gitlab.com/open-forms/forms-catalogue:latest4eaf9c911f33
pyjwt@1.7.1
2.14.0
1
registry.gitlab.com/open-forms/request-registry:latest0886cbbc5f95
pyjwt@1.7.1
2.14.0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
pyjwt@2.10.1
2.14.0
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.