StackRadar

CVE-2026-102268

Critical

Advisory

Published 28 Sept 2026In the index since 30 Sept 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
0.002
8th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
379
of 17,957 indexed, latest versions
Container images
377
deployed by those charts
Fix available
1 of 2
affected packages

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

Carried by container images the latest versions of 379 of 17,957 indexed charts deploy, on 377 images.

Affected packageAffected versionsFixed inImages
pyjwtpypi1.4.2, 1.5.3, 1.6.1, 1.6.4+17 more2.14.0377
pyjwtdeb1.7.1-2ubuntu2.1, 2.3.0-1, 2.3.0-1ubuntu0.2, 2.3.0-1ubuntu0.3+6 moreno fix listed39
OSV records
DEBIAN-CVE-2026-102268GHSA-ffc3-869f-jxw9UBUNTU-CVE-2026-102268
Trending
Rank 45 in indexed charts, since 30 Sept 2026. See the ranking →

Charts affected

379 by stars
ChartLatestAffected imagesRadar Score
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
pyjwt@2.10.1
2.14.0

Open the chart page →

5,131
memgraph-high-availabilitymemgraphVerified publisher1.4.11 of 2See more

memgraph-high-availability memgraph 1.4.1

1 of the 2 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
memgraph/memgraph:3.13.1bd3fe13228f4
pyjwt@2.13.0
2.14.0

Open the chart page →

1,425
observalobservalVerified publisher1.13.11 of 8See more

observal observal 1.13.1

1 of the 8 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/observal/observal-api:1.13.1153b8b893232
pyjwt@2.13.0
2.14.0

Open the chart page →

6,109
flagsmithone-acre-fundVerified publisher0.1.51 of 6See more

flagsmith one-acre-fund 0.1.5

1 of the 6 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
flagsmith/flagsmith-api:v2.6.0fd58556339a4
pyjwt@1.7.1
2.14.0

Open the chart page →

7,009
kobotoolboxone-acre-fundVerified publisher0.7.41 of 9See more

kobotoolbox one-acre-fund 0.7.4

1 of the 9 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
kobotoolbox/kpi:2.022.24dbcacc01bccd4
pyjwt@2.3.0
2.14.0

Open the chart page →

19,988
open-zaakopen-zaak0.8.01 of 3See more

open-zaak open-zaak 0.8.0

1 of the 3 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
openzaak/open-zaak:1.6.02ca2ea6e0ae9
pyjwt@2.3.0
2.14.0

Open the chart page →

4,624
skypilotskypilotOfficialVerified publisher0.13.01 of 3See more

skypilot skypilot 0.13.0

1 of the 3 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot:0.13.03bc8bf8f4d83
pyjwt@2.13.0
2.14.0

Open the chart page →

6,470
pretixtechwolf12Verified publisher2026.7.01 of 3See more

pretix techwolf12 2026.7.0

1 of the 3 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
pretix/standalone:2026.7.05df3b7aa852e
pyjwt@2.13.0
2.14.0

Open the chart page →

11,021
mealieth-chartsVerified publisher0.5.11 of 1See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
pyjwt@2.10.1
2.14.0

Open the chart page →

4,249
wgerwgerOfficialVerified publisher2.0.01 of 7See more

wger wger 2.0.0

1 of the 7 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
wger/server:2.71c5789b93bfe
pyjwt@2.13.0
2.14.0

Open the chart page →

8,041
paperlesszekker6Verified publisher11.10.01 of 1See more

paperless zekker6 11.10.0

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.2.15fa76604a81d
pyjwt@2.13.0
2.14.0

Open the chart page →

4,370
paperless-ngxadnoctemVerified publisher0.4.21 of 5See more

paperless-ngx adnoctem 0.4.2

1 of the 5 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
pyjwt@2.13.0
2.14.0

Open the chart page →

22,973
agentareaagentareaVerified publisher0.0.252 of 17See more

agentarea agentarea 0.0.25

2 of the 17 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
agentarea/agentarea-api:latest38fcf6657f5f
pyjwt@2.13.0
2.14.0
agentarea/agentarea-worker:latest06a5ef356770
pyjwt@2.13.0
2.14.0

Open the chart page →

12,181
akeyless-api-gatewayakeyless-services-helmVerified publisher1.62.261 of 1See more

akeyless-api-gateway akeyless-services-helm 1.62.26

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
akeyless/base:latest759e4289fae8
pyjwt@2.12.0
2.14.0

Open the chart page →

2,752
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
pyjwt@2.10.1
2.14.0

Open the chart page →

13,291
clearml-agentallegroaiVerified publisher5.3.31 of 1See more

clearml-agent allegroai 5.3.3

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
allegroai/clearml-agent-k8s-base:1.24-21772827a01bb5
pyjwt@2.0.1
2.14.0

Open the chart page →

75,565
clearml-servingallegroaiVerified publisher1.6.22 of 9See more

clearml-serving allegroai 1.6.2

2 of the 9 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
allegroai/clearml-serving-inference:1.3.0fca885e8cfc6
pyjwt@2.4.0
2.14.0
allegroai/clearml-serving-statistics:1.3.0c58d9da7bdf8
pyjwt@2.4.0
2.14.0

Open the chart page →

19,147
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
pyjwt@2.13.0
2.14.0

Open the chart page →

6,793
anteonanteonVerified publisher2.6.42 of 13See more

anteon anteon 2.6.4

2 of the 13 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:2.3.11e5be48b37348
pyjwt@2.9.0
2.14.0
ddosify/selfhosted_backend:3.2.93c11e3182652
pyjwt@2.8.0
2.14.0

Open the chart page →

23,430
tikaapache-tika3.2.21 of 1See more

tika apache-tika 3.2.2

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
apache/tika:3.2.2.0-fullffab324253ed
pyjwt@2.10.1
2.14.0

Open the chart page →

564
pysequilabiodatageeks0.1.31 of 7See more

pysequila biodatageeks 0.1.3

1 of the 7 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
jupyterhub/k8s-hub:0.9.1ec78bdae0fed
pyjwt@1.7.1
2.14.0

Open the chart page →

90,841
squestchristianhuthVerified publisher6.6.81 of 4See more

squest christianhuth 6.6.8

1 of the 4 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
pyjwt@2.10.1
2.14.0

Open the chart page →

10,858
syncstorage-rschristianhuthVerified publisher6.1.11 of 2See more

syncstorage-rs christianhuth 6.1.1

1 of the 2 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/porelli/firefox-sync:syncstorage-rs-mysql-0.18.27d244e514216
pyjwt@2.10.1
2.14.0

Open the chart page →

897
clamav-restclamav-restVerified publisher1.0.71 of 2See more

clamav-rest clamav-rest 1.0.7

1 of the 2 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
rtlabsio/clamav-rest:1.0.7be3e45ab4edd
pyjwt@2.13.0
2.14.0

Open the chart page →

567
pgbenchcloudnative-pgVerified publisher0.1.01 of 1See more

pgbench cloudnative-pg 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/cloudnative-pg/postgresql:14.5b3b30d04b362
pyjwt@2.6.0
2.14.0

Open the chart page →

2,792
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
pyjwt@2.8.0
2.14.0

Open the chart page →

12,374
paperless-ngxcrystalnetVerified publisher0.2.221 of 3See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
pyjwt@2.9.0
2.14.0

Open the chart page →

14,734
dagster-cloud-agentdagster-cloudVerified publisher1.13.241 of 1See more

dagster-cloud-agent dagster-cloud 1.13.24

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
dagster/dagster-cloud-agent:1.13.24e29285673c2c
pyjwt@2.13.0
2.14.0

Open the chart page →

1,057
aibrixdanchevVerified publisher0.7.01 of 5See more

aibrix danchev 0.7.0

1 of the 5 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
aibrix/metadata-service:v0.7.063fb81a64377
pyjwt@2.13.0
2.14.0

Open the chart page →

5,877
datadogdatadog-test2.4.231 of 2See more

datadog datadog-test 2.4.23

1 of the 2 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
datadog/agent:7.22.08f20e56b5311
pyjwt@1.7.1
2.14.0

Open the chart page →

4,623
weblatedeliveryheroVerified publisher0.3.21 of 3See more

weblate deliveryhero 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
weblate/weblate:4.2.2-169c160d37a3c
pyjwt@1.7.1
2.14.0

Open the chart page →

8,477
dominodominoVerified publisher0.1.111 of 3See more

domino domino 0.1.11

1 of the 3 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
pyjwt@2.4.0
2.14.0

Open the chart page →

9,453
archerydoubanVerified publisher0.4.31 of 6See more

archery douban 0.4.3

1 of the 6 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
hhyo/archery:v1.9.11aa41843419e
pyjwt@2.5.0
2.14.0

Open the chart page →

6,008
seafiledr300481Verified publisher0.12.11 of 1See more

seafile dr300481 0.12.1

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:11.0.12d0c66e4621bd
pyjwt@2.3.0-1ubuntu0.2
pyjwt@2.6.0
no fix listed
2.14.0

Open the chart page →

78,638
craftycontrollerdrewburr-labs-helm-chartsVerified publisher0.3.01 of 1See more

craftycontroller drewburr-labs-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
registry.gitlab.com/crafty-controller/crafty-4:latest7b6e87514259
pyjwt@2.8.0
2.14.0

Open the chart page →

39,642
elastalert2elastalert22.31.01 of 1See more

elastalert2 elastalert2 2.31.0

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
jertel/elastalert2:2.31.03cbf63f9b7dc
pyjwt@2.13.0
2.14.0

Open the chart page →

2,086
taigafermosit0.0.111 of 7See more

taiga fermosit 0.0.11

1 of the 7 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
taigaio/taiga-back:latest4beed8f62c9f
pyjwt@2.10.1
2.14.0

Open the chart page →

9,119
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latestd89226851697
pyjwt@2.13.0
2.14.0

Open the chart page →

2,478
obicogabe565Verified publisher0.6.01 of 3See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/gabe565/obico/web:latest122456be28c9
pyjwt@2.10.1
2.14.0

Open the chart page →

2,143
games-on-whalesgeek-cookbookVerified publisher1.8.21 of 7See more

games-on-whales geek-cookbook 1.8.2

1 of the 7 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/games-on-whales/xorg:1.0.0305b3327ebba
pyjwt@1.7.1
2.14.0

Open the chart page →

116,072
recipesgeek-cookbookVerified publisher6.6.21 of 2See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
vabene1111/recipes:1.0.5.2ec4e9e2905b0
pyjwt@2.3.0
2.14.0

Open the chart page →

8,062
uptime-kumageek-cookbookVerified publisher1.4.21 of 1See more

uptime-kuma geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.17.1a4eab252e5a2
pyjwt@1.7.0
2.14.0

Open the chart page →

5,275
IMgrycapOfficialVerified publisher1.8.01 of 3See more

IM grycap 1.8.0

1 of the 3 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/grycap/im:latest06a16d4f279f
pyjwt@2.10.1
2.14.0

Open the chart page →

4,580
uptime-kumahelmforgeVerified publisher1.5.151 of 1See more

uptime-kuma helmforge 1.5.15

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.5c74379ac4509
pyjwt@2.6.0-1+deb12u1
pyjwt@2.6.0
no fix listed
2.14.0

Open the chart page →

32,727
uptimekumahelm-l3st86Verified publisher0.1.101 of 1See more

uptimekuma helm-l3st86 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.1396510915e6be
pyjwt@1.7.0
2.14.0

Open the chart page →

4,465
helmuphelmupVerified publisher0.1.02 of 3See more

helmup helmup 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
pyjwt@2.8.0
2.14.0
sirrend/helmup-github-scraper:0.1.47ca688c7abf5
pyjwt@2.8.0
2.14.0

Open the chart page →

17,633
huehue1.0.31 of 3See more

hue hue 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
gethue/hue:latest7d5c1b9f8a79
pyjwt@2.4.0
2.14.0

Open the chart page →

69,182
supersetinseefrlab1.4.01 of 4See more

superset inseefrlab 1.4.0

1 of the 4 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
pyjwt@2.2.0
2.14.0

Open the chart page →

7,847
iris-webappiris-webapp0.2.41 of 2See more

iris-webapp iris-webapp 0.2.4

1 of the 2 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
pyjwt@2.4.0
2.14.0

Open the chart page →

12,876
jessejesse-chartVerified publisher0.0.461 of 6See more

jesse jesse-chart 0.0.46

1 of the 6 container images this version deploys carry CVE-2026-102268.

Container imageDigestPackageFixed in
salehmir/jesse:1.10.101afa95f979e9
pyjwt@2.8.0
2.14.0

Open the chart page →

2,705

Container images carrying it

377 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/substra/substra-backend:1.0.121967f54ec86
pyjwt@2.9.0
2.14.0
1
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
pyjwt@2.10.1
2.14.0
1
ghcr.io/tarkyaio/tarka:0.4.1e8d3f1512f06
pyjwt@2.12.1
2.14.0
1
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
pyjwt@2.4.0
2.14.0
1
ghcr.io/unique-ag/ai/search-proxy:2026.40.02bd74586650d
pyjwt@2.13.0
2.14.0
1
ghcr.io/vinny1892/octantis:latest45459c0910fc
pyjwt@2.12.1
2.14.0
1
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
pyjwt@2.8.0
2.14.0
1
public.ecr.aws/aktosecurity/akto-ai-automated-testing:latest573542399fe4
pyjwt@2.13.0
2.14.0
1
public.ecr.aws/datadog/agent:7.73.0f4925b15ce94
pyjwt@2.10.1
2.14.0
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
pyjwt@2.9.0
2.14.0
1
quay.io/cephcsi/cephcsi:v3.5.128a674af1df2
pyjwt@1.6.1
2.14.0
1
quay.io/cloudnativetoolkit/cli-tools:v1.1-v1.8.2d6fd2a9e3273
pyjwt@2.4.0
2.14.0
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
pyjwt@2.12.1
2.14.0
1
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
pyjwt@2.10.1
2.14.0
1
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
pyjwt@2.3.0
2.14.0
1
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
pyjwt@2.13.0
2.14.0
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
pyjwt@2.12.1
2.14.0
1
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
pyjwt@2.8.0
2.14.0
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
pyjwt@2.12.1
2.14.0
1
quay.io/k3rnel-pan1c/uptime-kuma:1.19.3f975fde9329b
pyjwt@1.7.1
2.14.0
1
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
pyjwt@2.4.0
2.14.0
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
pyjwt@2.10.1
2.14.0
1
quay.io/stackgres/operator:1.19.282f33ab3fb1e
pyjwt@2.13.0
2.14.0
1
registry.gitlab.com/crafty-controller/crafty-4:latest7b6e87514259
pyjwt@2.8.0
2.14.0
1
registry.gitlab.com/open-forms/forms-catalogue:latest4eaf9c911f33
pyjwt@1.7.1
2.14.0
1
registry.gitlab.com/open-forms/request-registry:latest0886cbbc5f95
pyjwt@1.7.1
2.14.0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
pyjwt@2.10.1
2.14.0
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.