StackRadar

CVE-2026-102278

High

Advisory

Published 29 Sept 2026In the index since 30 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
26th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,091
of 17,957 indexed, latest versions
Container images
1,126
deployed by those charts
Fix available
1 of 2
affected packages

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

Carried by container images the latest versions of 1,091 of 17,957 indexed charts deploy, on 1,126 images.

Affected packageAffected versionsFixed inImages
brace-expansionnpm1.1.1, 1.1.2, 1.1.4, 1.1.6+23 more1.1.20, 2.1.6, 5.0.111,126
node-brace-expansiondeb1.1.8-1, 1.1.11-1, 2.0.1+~1.1.0-1no fix listed6
OSV records
GHSA-qhr7-859c-m2p7UBUNTU-CVE-2026-102278
Trending
Rank 14 in indexed charts, since 30 Sept 2026. See the ranking →

Charts affected

1,091 by stars
ChartLatestAffected imagesRadar Score
youtubedl-materialk8s-home-lab-repo5.1.11 of 1See more

youtubedl-material k8s-home-lab-repo 5.1.1

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:4.3.22f943d584711
brace-expansion@1.1.11
1.1.20

Open the chart page →

10,289
k8s-jacoco-operatork8s-jacoco-operator0.4.02 of 4See more

k8s-jacoco-operator k8s-jacoco-operator 0.4.0

2 of the 4 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
library/node:lts-alpineebfe2f904627
brace-expansion@5.0.7
5.0.11
ghcr.io/curium-rocks/k8s-jacoco-operator:maina558ceae6cdb
brace-expansion@2.0.2
2.1.6

Open the chart page →

2,547
k8s-mutating-webhookk8s-mutating-webhook0.3.01 of 2See more

k8s-mutating-webhook k8s-mutating-webhook 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/curium-rocks/k8s-mutating-webhook:mainaaab005242ae
brace-expansion@2.0.1
2.1.6

Open the chart page →

2,101
zwave-js-uik8sonlabVerified publisher0.7.121 of 1See more

zwave-js-ui k8sonlab 0.7.12

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
zwavejs/zwave-js-ui:11.22.314d018bb689e
brace-expansion@2.0.2
2.1.6

Open the chart page →

1,115
k8s-validating-webhookk8s-validating-webhook0.4.01 of 2See more

k8s-validating-webhook k8s-validating-webhook 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/curium-rocks/k8s-validating-webhook:main8344061b2f22
brace-expansion@2.0.1
2.1.6

Open the chart page →

2,101
kube-admission-controller-starterk8s-validating-webhook0.2.01 of 2See more

kube-admission-controller-starter k8s-validating-webhook 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/curium-rocks/kube-admission-controller-starter:maine9716966f30b
brace-expansion@2.0.1
2.1.6

Open the chart page →

2,260
huekatool1.0.81 of 1See more

hue katool 1.0.8

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
gethue/hue:4.11.011b649636e68
brace-expansion@1.1.11
1.1.20

Open the chart page →

87,459
kenerkener-chart0.0.71 of 1See more

kener kener-chart 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
brace-expansion@2.0.1
2.1.6

Open the chart page →

5,605
keycloak-multi-client-notifierkeycloak-multi-client-notifier2.1.21 of 2See more

keycloak-multi-client-notifier keycloak-multi-client-notifier 2.1.2

1 of the 2 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/blessingnator/keycloak-mcn-backend:2.0.5967470f05472
brace-expansion@1.1.12
1.1.20

Open the chart page →

1,823
statsdkeyporttech0.1.191 of 1See more

statsd keyporttech 0.1.19

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
statsd/statsd:v0.8.6dab129e74c25
brace-expansion@1.1.11
1.1.20

Open the chart page →

4,562
allurekfirfer0.1.81 of 2See more

allure kfirfer 0.1.8

1 of the 2 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
frankescobar/allure-docker-service-ui:7.0.34ebd8b4ef340
brace-expansion@1.1.11
1.1.20

Open the chart page →

71,975
skoonerkfirfer0.0.61 of 1See more

skooner kfirfer 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
brace-expansion@1.1.11
1.1.20

Open the chart page →

1,391
cdashkitwareVerified publisher0.20.01 of 3See more

cdash kitware 0.20.0

1 of the 3 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
kitware/cdash:v5.4.0da5abe941506
brace-expansion@5.0.7
5.0.11

Open the chart page →

12,207
redisinsightklicktippVerified publisher0.5.01 of 1See more

redisinsight klicktipp 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
redis/redisinsight:3.2.055542a762210
brace-expansion@1.1.12
1.1.20

Open the chart page →

1,639
visual-regression-trackerkokuwa5.1.02 of 4See more

visual-regression-tracker kokuwa 5.1.0

2 of the 4 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
visualregressiontracker/api:5.0.11941aeb8c8bf9
brace-expansion@2.0.1
2.1.6
visualregressiontracker/migration:5.0.1f983a1d4306e
brace-expansion@1.1.11
1.1.20

Open the chart page →

9,708
apikrateo1.0.31 of 1See more

api krateo 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/api:1.0.3edbaa031754d
brace-expansion@1.1.11
1.1.20

Open the chart page →

4,877
argocd-servicekrateo1.0.71 of 1See more

argocd-service krateo 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/argocd-service:1.0.749b727854938
brace-expansion@1.1.11
1.1.20

Open the chart page →

4,905
auth-servicekrateo1.2.361 of 1See more

auth-service krateo 1.2.36

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/auth-service:1.2.36794bc5877f76
brace-expansion@1.1.11
1.1.20

Open the chart page →

5,355
capi-servicekrateo1.1.91 of 1See more

capi-service krateo 1.1.9

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/capi-service:1.1.92eee721260eb
brace-expansion@1.1.11
1.1.20

Open the chart page →

4,632
codequality-servicekrateo1.1.11 of 1See more

codequality-service krateo 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/codequality-service:1.1.19a9a77b01eb1
brace-expansion@2.0.1
2.1.6

Open the chart page →

4,488
component-servicekrateo0.2.11 of 1See more

component-service krateo 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/component-service:0.2.14a5f506c0560
brace-expansion@1.1.11
1.1.20

Open the chart page →

4,823
deployment-servicekrateo1.2.591 of 1See more

deployment-service krateo 1.2.59

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/deployment-service:1.2.59da9f93f2f731
brace-expansion@1.1.11
1.1.20

Open the chart page →

10,081
endpoint-servicekrateo1.0.11 of 1See more

endpoint-service krateo 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/endpoint-service:1.0.16c3777c042f7
brace-expansion@2.0.1
2.1.6

Open the chart page →

5,467
event-servicekrateo1.1.61 of 1See more

event-service krateo 1.1.6

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/event-service:1.1.671fd074020f4
brace-expansion@1.1.11
1.1.20

Open the chart page →

4,920
git-servicekrateo1.0.131 of 1See more

git-service krateo 1.0.13

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/git-service:1.0.13c22f183fedf0
brace-expansion@1.1.11
1.1.20

Open the chart page →

5,914
keptn-servicekrateo1.0.121 of 1See more

keptn-service krateo 1.0.12

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/keptn-service:1.0.12f9fef2435636
brace-expansion@2.0.1
2.1.6

Open the chart page →

5,067
keptn-service-insielkrateo0.1.31 of 1See more

keptn-service-insiel krateo 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/keptn-service-insiel:0.1.3c1d475bb7f06
brace-expansion@1.1.11
1.1.20

Open the chart page →

4,802
krateo-remote-clientkrateo0.4.161 of 1See more

krateo-remote-client krateo 0.4.16

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/krateo-remote-client:0.4.167ccd4382f3fa
brace-expansion@2.0.1
2.1.6

Open the chart page →

5,131
krateo-remote-serverkrateo0.2.41 of 1See more

krateo-remote-server krateo 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/krateo-remote-server:0.2.40df58c99cc6f
brace-expansion@2.0.1
2.1.6

Open the chart page →

5,264
kubernetes-servicekrateo1.1.11 of 1See more

kubernetes-service krateo 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/kubernetes-service:1.1.1974fbc0d93ed
brace-expansion@2.0.1
2.1.6

Open the chart page →

4,880
log-servicekrateo1.0.01 of 1See more

log-service krateo 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/log-service:1.0.0b431a8154be0
brace-expansion@1.1.11
1.1.20

Open the chart page →

5,166
notification-servicekrateo1.1.61 of 1See more

notification-service krateo 1.1.6

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/notification-service:1.1.6f9eeac1d7e47
brace-expansion@1.1.11
1.1.20

Open the chart page →

4,972
pipeline-servicekrateo1.1.21 of 1See more

pipeline-service krateo 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/pipeline-service:1.1.25e6ad7395921
brace-expansion@1.1.11
1.1.20

Open the chart page →

4,371
provider-servicekrateo1.0.81 of 1See more

provider-service krateo 1.0.8

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/provider-service:1.0.8014ed41cb6e5
brace-expansion@1.1.11
1.1.20

Open the chart page →

4,823
secret-servicekrateo1.1.41 of 1See more

secret-service krateo 1.1.4

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/secret-service:1.1.4292bd05fb781
brace-expansion@1.1.11
1.1.20

Open the chart page →

4,798
service-deploymentkrateo0.1.61 of 1See more

service-deployment krateo 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/service-deployment:0.1.541fb833f36ee
brace-expansion@1.1.11
1.1.20

Open the chart page →

4,684
template-servicekrateo1.2.131 of 1See more

template-service krateo 1.2.13

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/template-service:1.2.139f82e7cb2348
brace-expansion@1.1.11
1.1.20

Open the chart page →

6,231
terminal-clientkrateo0.1.31 of 1See more

terminal-client krateo 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/terminal-client:0.1.36c7c965e739c
brace-expansion@2.0.1
2.1.6

Open the chart page →

7,159
terminal-serverkrateo0.1.61 of 1See more

terminal-server krateo 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/terminal-server:0.1.3f5fd8ba6fea3
brace-expansion@2.0.1
2.1.6

Open the chart page →

7,112
kubeflowkromanow94-kubeflow0.5.11 of 30See more

kubeflow kromanow94-kubeflow 0.5.1

1 of the 30 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
kubeflownotebookswg/centraldashboard:v1.9.2af55c22ef5de
brace-expansion@1.1.11
1.1.20

Open the chart page →

74,154
rtlkronkltdVerified publisher0.1.01 of 2See more

rtl kronkltd 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
shahanafarooqui/rtl:0.11.0d0cd3d868aca
brace-expansion@1.1.11
1.1.20

Open the chart page →

5,869
sqlpadkronkltdVerified publisher0.1.01 of 1See more

sqlpad kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
sqlpad/sqlpad:6.7d3d2f430dffd
brace-expansion@1.1.11
1.1.20

Open the chart page →

3,556
ohmyformkrzwiatrzyk0.0.11 of 1See more

ohmyform krzwiatrzyk 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
ohmyform/ohmyform:1.0.3afe53f4acdb1
brace-expansion@1.1.11
1.1.20

Open the chart page →

4,395
pangolinkrzwiatrzyk0.11.01 of 1See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
fosrl/pangolin:1.13.0c32ad797ab96
brace-expansion@2.0.2
2.1.6

Open the chart page →

3,642
tooljetkrzwiatrzyk1.1.11 of 2See more

tooljet krzwiatrzyk 1.1.1

1 of the 2 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
tooljet/tooljet-ce:v1.18.0c85a4720e42e
brace-expansion@1.1.11
1.1.20

Open the chart page →

5,849
component-storekubebb0.0.231 of 1See more

component-store kubebb 0.0.23

1 of the 1 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
kubebb/component-store:latestfd8ecbd73213
brace-expansion@1.1.11
1.1.20

Open the chart page →

2,264
tampkubebb5.6.01 of 2See more

tamp kubebb 5.6.0

1 of the 2 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
kubebb/tamp-portal:v5.6.0fadac6d52470
brace-expansion@1.1.11
1.1.20

Open the chart page →

4,721
tapm-componentkubebb5.7.11 of 3See more

tapm-component kubebb 5.7.1

1 of the 3 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
refar/apm-portal:v5.7.1dcca8e4477a6
brace-expansion@1.1.11
1.1.20

Open the chart page →

10,354
tdsfkubebb5.7.01 of 3See more

tdsf kubebb 5.7.0

1 of the 3 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
kubebb/tdsf-portal:v5.7.0258458311bc9
brace-expansion@1.1.11
1.1.20

Open the chart page →

6,546
u4a-componentkubebb0.2.101 of 8See more

u4a-component kubebb 0.2.10

1 of the 8 container images this version deploys carry CVE-2026-102278.

Container imageDigestPackageFixed in
kubebb/bff-server:v0.2.0-202312040fbb732379bc
brace-expansion@2.0.1
2.1.6

Open the chart page →

13,953

Container images carrying it

1,126 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
library/ghost:5.79.083f7bf209844
brace-expansion@2.0.1
2.1.6
1
library/ghost:6.65.0-alpine3.23fea3264f902e
brace-expansion@5.0.9
5.0.11
1
library/kibana:7.17.150172f1c538e7
brace-expansion@2.0.1
2.1.6
1
library/kibana:8.19.2235544f1ff28a
brace-expansion@5.0.9
5.0.11
1
library/kibana:7.9.1b1bbcaa57738
brace-expansion@1.1.8
1.1.20
1
library/kibana:7.17.8c5781ba340ef
brace-expansion@1.1.11
1.1.20
1
library/kibana:7.17.3e2e2031c15be
brace-expansion@1.1.8
1.1.20
1
library/mongo-express:1.0.2-20-alpine3.191aae00775251
brace-expansion@2.0.1
2.1.6
1
library/node:22-bookworm-slim48e4b67d85f8
brace-expansion@2.0.2
2.1.6
1
library/node:16.13.0-alpine60ef0bed1dc2
brace-expansion@1.1.11
1.1.20
1
library/node:18-alpine8d6421d663b4
brace-expansion@2.0.1
2.1.6
1
library/node:208f693eaa7e0a
brace-expansion@2.0.1
2.1.6
1
library/node:16.20f77a1aef2da8
brace-expansion@2.0.1
2.1.6
1
library/node:latestfa271c47a5d8
brace-expansion@5.0.9
5.0.11
1
linuxserver/calibre:version-v5.21.0a847b5b2d860
brace-expansion@1.1.11
1.1.20
1
linuxserver/code-server:4.10.1a5e43a05ae79
brace-expansion@1.1.11
1.1.20
1
linuxserver/codimd:latestb801bbcf6386
brace-expansion@1.1.11
1.1.20
1
linuxserver/overseerr:1.35.06108ed066d4a
brace-expansion@2.0.1
2.1.6
1
lissy93/dashy:2.0.51991f7be5ed0
brace-expansion@1.1.11
1.1.20
1
lissy93/domain-locker:latest58a903b2cdd9
brace-expansion@2.1.0
2.1.6
1
lissy93/networking-toolbox:latest700862839553
brace-expansion@2.0.2
2.1.6
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
brace-expansion@5.0.4
5.0.11
1
litlyx/litlyx-consumer:latest02225e77d316
brace-expansion@2.0.2
2.1.6
1
litlyx/litlyx-dashboard:lateste64ff2d52385
brace-expansion@2.0.2
2.1.6
1
litlyx/litlyx-producer:latest10407f36613f
brace-expansion@2.0.2
2.1.6
1
localstack/localstack:3.19d278167f2b7
brace-expansion@2.0.1
2.1.6
1
loftsh/jspolicy:0.2.225deb9bd2683
brace-expansion@1.1.11
1.1.20
1
logentries/docker-logentries:0.2.1f1f90a236998
brace-expansion@1.1.6
1.1.20
1
louislam/uptime-kuma:2.2.1-slim059b49d64739
brace-expansion@2.0.2
2.1.6
1
louislam/uptime-kuma:1.22.10b55bcb83a1c
brace-expansion@1.1.11
1.1.20
1
louislam/uptime-kuma:2.0.24c364ef96aad
brace-expansion@2.0.1
2.1.6
1
louislam/uptime-kuma:170233f4acb51
brace-expansion@2.0.2
2.1.6
1
louislam/uptime-kuma:2.4.091e963bfda56
brace-expansion@1.1.15
1.1.20
1
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
brace-expansion@2.0.2
2.1.6
1
louislam/uptime-kuma:1.17.1a4eab252e5a2
brace-expansion@1.1.11
1.1.20
1
louislam/uptime-kuma:1.18.5a84767d7934f
brace-expansion@2.0.1
2.1.6
1
louislam/uptime-kuma:1.23.12bc6f244ecf27
brace-expansion@2.0.1
2.1.6
1
lsstsqre/nublado2:2.0.1b75bf8aaafa4
brace-expansion@1.1.11
node-brace-expansion@1.1.11-1
1.1.20
no fix listed
1
lsstsqre/sciplat-hub:latest5e0ade6bed1c
brace-expansion@1.1.6
1.1.20
1
lsstsqre/squareone:0.4.09ded78e7fe03
brace-expansion@1.1.11
1.1.20
1
ltdstudio/terraforming-mars:latest0e76c6f4eac0
brace-expansion@1.1.11
1.1.20
1
lucassandin/welcome-client:latest48468b1ccd16
brace-expansion@2.0.1
2.1.6
1
lukasreining/open-api-schema-collector:0.1.050e021c42e33
brace-expansion@2.0.1
2.1.6
1
luligu/matterbridge:3.0.28f97884bebc2
brace-expansion@2.0.1
2.1.6
1
luligu/matterbridge:3.10.11e278cf685f91
brace-expansion@5.0.7
5.0.11
1
lyzhang1999/frontend:latest4b25cf264fd7
brace-expansion@1.1.11
1.1.20
1
maildev/maildev:2.2.1180ef51f65ee
brace-expansion@2.0.1
2.1.6
1
maissacrement/pock8snodejs:0.0.16da0db1159da
brace-expansion@2.0.1
2.1.6
1
makeplane/live-commercial:v3.3.0488a6684637c
brace-expansion@5.0.9
5.0.11
1
makeplane/silo-commercial:v3.3.027bf6bbf59bd
brace-expansion@5.0.9
5.0.11
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.