StackRadar

CVE-2026-102271

High

Advisory

Published 28 Sept 2026In the index since 30 Sept 2026
Severity
High
worst across findings
CVSS
7.4
base score, highest
EPSS
0.002
6th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
299
of 17,957 indexed, latest versions
Container images
310
deployed by those charts
Fix available
1 of 2
affected packages

PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

Carried by container images the latest versions of 299 of 17,957 indexed charts deploy, on 310 images.

Affected packageAffected versionsFixed inImages
pyjwtpypi2.4.0, 2.5.0, 2.6.0, 2.7.0+7 more2.14.0303
pyjwtdeb1.7.1-2ubuntu2.1, 2.3.0-1, 2.3.0-1ubuntu0.2, 2.3.0-1ubuntu0.3+6 moreno fix listed39
OSV records
DEBIAN-CVE-2026-102271GHSA-p4g4-x82p-q773UBUNTU-CVE-2026-102271

Charts affected

299 by stars
ChartLatestAffected imagesRadar Score
csghubcsghubVerified publisher2.5.03 of 34See more

csghub csghub 2.5.0

3 of the 34 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
pyjwt@2.10.1
2.14.0
opencsghq/csgbot:v0.6.9-ee7d0271e26521
pyjwt@2.10.1
2.14.0
opencsghq/label-studio:v2.5.047e22aa71870
pyjwt@2.10.1
2.14.0

Open the chart page →

52,989
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
pyjwt@2.8.0
2.14.0

Open the chart page →

12,572
dataflowcsghubVerified publisher2.5.01 of 7See more

dataflow csghub 2.5.0

1 of the 7 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
opencsghq/label-studio:v2.5.047e22aa71870
pyjwt@2.10.1
2.14.0

Open the chart page →

7,586
jupyterhubd4nVerified publisher3.3.71 of 7See more

jupyterhub d4n 3.3.7

1 of the 7 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
aristidetm/k8s-hub:3.3.7ccb516cb8474
pyjwt@2.8.0
2.14.0

Open the chart page →

17,520
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
pyjwt@2.8.0
2.14.0

Open the chart page →

6,443
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
pyjwt@2.4.0
2.14.0

Open the chart page →

5,533
decisionrules-ocpdecisionrules-ocpVerified publisher0.1.01 of 4See more

decisionrules-ocp decisionrules-ocp 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
decisionrules/ai-engine:latest557dea1373aa
pyjwt@2.13.0
2.14.0

Open the chart page →

1,881
supersetdeliveryheroVerified publisher1.1.31 of 1See more

superset deliveryhero 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
apache/superset:latest16b50bbef664
pyjwt@2.10.1
2.14.0

Open the chart page →

2,550
deployhubdeployhubVerified publisher10.0.4151 of 11See more

deployhub deployhub 10.0.415

1 of the 11 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
pyjwt@2.10.1
2.14.0

Open the chart page →

11,964
seafilederp3.2.01 of 1See more

seafile derp 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:10.0.170628f29c663
pyjwt@2.6.0
2.14.0

Open the chart page →

80,522
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
pyjwt@2.8.0
2.14.0

Open the chart page →

56,519
wizarrdjjudas21Verified publisher0.1.51 of 1See more

wizarr djjudas21 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
pyjwt@2.8.0
2.14.0

Open the chart page →

15,295
dominodomino-iisasVerified publisher0.3.11 of 3See more

domino domino-iisas 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
ghcr.io/iisas/domino-rest:latest3009350bfc11
pyjwt@2.10.1
2.14.0

Open the chart page →

11,245
codecovdoubanVerified publisher0.2.43 of 8See more

codecov douban 0.2.4

3 of the 8 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
codecov/self-hosted-api:24.4.10475cb1c3136
pyjwt@2.8.0
2.14.0
codecov/self-hosted-worker:24.4.1837f546b479b
pyjwt@2.4.0
2.14.0
timescale/timescaledb-ha:pg14.6-ts2.9.1-p1cdb9ae118899
pyjwt@2.3.0-1ubuntu0.2
no fix listed

Open the chart page →

25,854
healthchecksdoubanVerified publisher1.0.101 of 2See more

healthchecks douban 1.0.10

1 of the 2 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
healthchecks/healthchecks:latestaa08a61b0dcf
pyjwt@2.13.0
2.14.0

Open the chart page →

2,000
drogue-cloud-examplesdrogue-iotVerified publisher0.7.111 of 6See more

drogue-cloud-examples drogue-iot 0.7.11

1 of the 6 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg14-ts2.6-latested719c0cd19d
pyjwt@2.3.0-1
no fix listed

Open the chart page →

31,633
home-assistantegebackVerified publisher2.0.351 of 1See more

home-assistant egeback 2.0.35

1 of the 1 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
pyjwt@2.13.0
2.14.0

Open the chart page →

2,521
uptime-kumaegebackVerified publisher2.0.121 of 1See more

uptime-kuma egeback 2.0.12

1 of the 1 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
pyjwt@2.6.0-1+deb12u1
pyjwt@2.6.0
no fix listed
2.14.0

Open the chart page →

32,872
seafileeleksbai0.1.11 of 3See more

seafile eleksbai 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:9.0.106693911bcc40
pyjwt@2.6.0
2.14.0

Open the chart page →

95,989
datadog-apmfairwinds-incubator2.0.11 of 1See more

datadog-apm fairwinds-incubator 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
public.ecr.aws/datadog/agent:7.73.0f4925b15ce94
pyjwt@2.10.1
2.14.0

Open the chart page →

3,126
infrafibonacci-cluster-infraVerified publisher1.0.01 of 4See more

infra fibonacci-cluster-infra 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
dpage/pgadmin4:8.418cd5711fc9a
pyjwt@2.8.0
2.14.0

Open the chart page →

13,227
business-api-ecosystemfiware1.1.01 of 4See more

business-api-ecosystem fiware 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
pyjwt@1.7.1-2ubuntu2.1
pyjwt@2.9.0
no fix listed
2.14.0

Open the chart page →

118,495
ishare-satellitefiware1.3.21 of 1See more

ishare-satellite fiware 1.3.2

1 of the 1 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
fiware/ishare-satellite:1.2.0c3c1c8ccfb45
pyjwt@2.4.0
2.14.0

Open the chart page →

1,830
batchrunnerflanksourceVerified publisher1.0.441 of 1See more

batchrunner flanksource 1.0.44

1 of the 1 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
flanksource/batch-runner:v1.0.44689687a7cf95
pyjwt@2.10.1
2.14.0

Open the chart page →

5,862
fluxcd-helm-upgraderfluxcd-helm-upgraderVerified publisher0.7.71 of 1See more

fluxcd-helm-upgrader fluxcd-helm-upgrader 0.7.7

1 of the 1 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
kenchrcum/fluxcd-helm-upgrader:0.7.7c326e28a8f5f
pyjwt@2.12.1
2.14.0

Open the chart page →

2,575
flyteconnectorflyte2.0.01 of 1See more

flyteconnector flyte 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
pyjwt@2.13.0
2.14.0

Open the chart page →

3,987
flyte-devboxflyte0.1.01 of 14See more

flyte-devbox flyte 0.1.0

1 of the 14 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
pyjwt@2.13.0
2.14.0

Open the chart page →

8,733
forgejoforgejo-captnbp-helm1.2.61 of 2See more

forgejo forgejo-captnbp-helm 1.2.6

1 of the 2 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
ghcr.io/cloudnative-pg/postgresql:18.4-system-trixie42708a75345b
pyjwt@2.13.0
2.14.0

Open the chart page →

2,045
frinx-machinefrinx-helm-charts11.0.01 of 26See more

frinx-machine frinx-helm-charts 11.0.0

1 of the 26 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
frinx/topology-discovery:7.0.37832e3589dba
pyjwt@2.9.0
2.14.0

Open the chart page →

44,552
topology-discoveryfrinx-helm-charts4.0.01 of 2See more

topology-discovery frinx-helm-charts 4.0.0

1 of the 2 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
frinx/topology-discovery:7.0.37832e3589dba
pyjwt@2.9.0
2.14.0

Open the chart page →

6,326
tandoorgabe565Verified publisher0.9.91 of 2See more

tandoor gabe565 0.9.9

1 of the 2 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
pyjwt@2.10.1
2.14.0

Open the chart page →

2,344
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
pyjwt@2.10.1
2.14.0

Open the chart page →

9,690
geomapfishgeomapfish0.8.01 of 3See more

geomapfish geomapfish 0.8.0

1 of the 3 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
camptocamp/geomapfishapp-geoportal:latestae874f70cc16
pyjwt@2.7.0-1ubuntu0.1
pyjwt@2.7.0
no fix listed
2.14.0

Open the chart page →

6,992
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-loadgenerator85c9935ff31b
pyjwt@2.9.0
2.14.0

Open the chart page →

52,401
guacamoleguacamole1.0.01 of 4See more

guacamole guacamole 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
ghcr.io/cloudnative-pg/postgresql:18899d3ed526b6
pyjwt@2.13.0
2.14.0

Open the chart page →

4,361
rag-apihajowielandVerified publisher1.0.01 of 1See more

rag-api hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latest6f2ea2aae300
pyjwt@2.13.0
2.14.0

Open the chart page →

1,433
helixhelix1.4.31 of 2See more

helix helix 1.4.3

1 of the 2 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
pyjwt@2.12.1
2.14.0

Open the chart page →

6,131
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
pyjwt@2.10.1
2.14.0

Open the chart page →

5,113
supersethelm-charts-nr1.1.31 of 1See more

superset helm-charts-nr 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
apache/superset:latest16b50bbef664
pyjwt@2.10.1
2.14.0

Open the chart page →

2,550
chiefonboardinghelmforgeVerified publisher1.1.151 of 3See more

chiefonboarding helmforge 1.1.15

1 of the 3 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
chiefonboarding/chiefonboarding:v2.5.0d0964135ea82
pyjwt@2.13.0
2.14.0

Open the chart page →

8,083
ckanhelmforgeVerified publisher1.3.91 of 6See more

ckan helmforge 1.3.9

1 of the 6 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
ckan/ckan-base:2.12.087ecf3f27ad6
pyjwt@2.13.0
2.14.0

Open the chart page →

10,031
fastmcp-serverhelmforgeVerified publisher1.7.41 of 1See more

fastmcp-server helmforge 1.7.4

1 of the 1 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.11.2fcb7017327d6
pyjwt@2.12.1
2.14.0

Open the chart page →

3,654
hermes-agenthelmforgeVerified publisher1.0.11 of 1See more

hermes-agent helmforge 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.9.24fca358f12efd
pyjwt@2.13.0
2.14.0

Open the chart page →

6,076
jupyterhubhelmforgeVerified publisher1.0.61 of 3See more

jupyterhub helmforge 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
pyjwt@2.12.1
2.14.0

Open the chart page →

5,903
langflowhelmforgeVerified publisher2.0.21 of 1See more

langflow helmforge 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
langflowai/langflow:1.12.334055a07d446
pyjwt@2.13.0
2.14.0

Open the chart page →

244
mcp-serverhelmforgeVerified publisher1.0.01 of 1See more

mcp-server helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.2.061f759a1421f
pyjwt@2.12.1
2.14.0

Open the chart page →

3,821
netboxhelmforgeVerified publisher2.0.21 of 4See more

netbox helmforge 2.0.2

1 of the 4 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v4.6.10-5.0.291b823a05cb5
pyjwt@2.12.1
2.14.0

Open the chart page →

4,094
supersethelmforgeVerified publisher1.3.71 of 5See more

superset helmforge 1.3.7

1 of the 5 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
apache/superset:6.1.016b50bbef664
pyjwt@2.10.1
2.14.0

Open the chart page →

5,497
paperlesshpVerified publisher0.1.21 of 5See more

paperless hp 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
pyjwt@2.13.0
2.14.0

Open the chart page →

29,775
activation-servicei4trustVerified publisher2.3.11 of 1See more

activation-service i4trust 2.3.1

1 of the 1 container images this version deploys carry CVE-2026-102271.

Container imageDigestPackageFixed in
i4trust/activation-service:2.2.09f3719176893
pyjwt@2.7.0
2.14.0

Open the chart page →

2,106

Container images carrying it

310 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
pyjwt@2.10.1
2.14.0
1
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
pyjwt@2.13.0
2.14.0
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
pyjwt@2.12.1
2.14.0
1
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
pyjwt@2.8.0
2.14.0
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
pyjwt@2.12.1
2.14.0
1
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
pyjwt@2.4.0
2.14.0
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
pyjwt@2.10.1
2.14.0
1
quay.io/stackgres/operator:1.19.282f33ab3fb1e
pyjwt@2.13.0
2.14.0
1
registry.gitlab.com/crafty-controller/crafty-4:latest7b6e87514259
pyjwt@2.8.0
2.14.0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
pyjwt@2.10.1
2.14.0
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.