StackRadar

CVE-2026-102598

Medium

Advisory

Published 29 Sept 2026In the index since 1 Oct 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.004
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
422
of 18,026 indexed, latest versions
Container images
406
deployed by those charts
Fix available
1 of 2
affected packages

Werkzeug safe_join() allows Windows special device names

Carried by container images the latest versions of 422 of 18,026 indexed charts deploy, on 406 images.

Affected packageAffected versionsFixed inImages
werkzeugpypi0.9.1, 0.11.15, 0.12.2, 0.13+37 more3.1.9406
python-werkzeugdeb0.16.1+dfsg1-2no fix listed1
OSV records
GHSA-g6x2-hccm-hh4mUBUNTU-CVE-2026-102598

Charts affected

422 by stars
ChartLatestAffected imagesRadar Score
pgadmin4runixVerified publisher1.70.41 of 1See more

pgadmin4 runix 1.70.4

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
dpage/pgadmin4:9.18c332c5f6dfba
werkzeug@3.1.8
3.1.9

Open the chart page →

93
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
werkzeug@2.2.3
3.1.9

Open the chart page →

12,488
rook-cephrookOfficialVerified publisher1.20.81 of 2See more

rook-ceph rook 1.20.8

1 of the 2 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
rook/ceph:v1.20.8d47a748c058a
werkzeug@2.0.3
3.1.9

Open the chart page →

1,904
home-assistanthelm-hassVerified publisher0.3.831 of 1See more

home-assistant helm-hass 0.3.83

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.43e6710a7ab2a
werkzeug@3.1.8
3.1.9

Open the chart page →

2,940
mlflowcommunity-chartsVerified publisher1.11.71 of 1See more

mlflow community-charts 1.11.7

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
burakince/mlflow:3.16.0ab4b566644b9
werkzeug@3.1.8
3.1.9

Open the chart page →

1,044
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
allegroai/clearml:2.0.0-613713ae38f7daf
werkzeug@3.1.3
3.1.9

Open the chart page →

12,012
locustdeliveryheroVerified publisher0.35.01 of 1See more

locust deliveryhero 0.35.0

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
locustio/locust:2.32.2a0d4b88e42c1
werkzeug@3.1.2
3.1.9

Open the chart page →

3,080
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
werkzeug@3.1.4
3.1.9

Open the chart page →

82,191
difydify-helmVerified publisher0.38.02 of 11See more

dify dify-helm 0.38.0

2 of the 11 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
langgenius/dify-api:1.16.1dcefa5f7c47c
werkzeug@3.1.6
3.1.9
langgenius/dify-plugin-daemon:0.6.3-local3c694329357b
werkzeug@3.1.8
3.1.9

Open the chart page →

72,642
ambassadordatawire6.9.51 of 2See more

ambassador datawire 6.9.5

1 of the 2 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
werkzeug@1.0.1
3.1.9

Open the chart page →

5,454
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
grafana/oncall:v1.16.5499851658393
werkzeug@3.1.3
3.1.9

Open the chart page →

22,398
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.14.3f09282d281f6
werkzeug@3.1.4
3.1.9

Open the chart page →

13,536
emissary-ingressdatawire7.1.8-ea1 of 1See more

emissary-ingress datawire 7.1.8-ea

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
datawire/emissary:2.0.2-ea9716efbdd24b
werkzeug@1.0.1
3.1.9

Open the chart page →

6,119
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
werkzeug@2.1.2
3.1.9

Open the chart page →

8,930
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
werkzeug@2.3.8
3.1.9

Open the chart page →

6,700
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
werkzeug@3.0.1
3.1.9

Open the chart page →

7,256
edge-stackdatawire7.1.8-ea1 of 2See more

edge-stack datawire 7.1.8-ea

1 of the 2 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
datawire/aes:2.0.3-ea07f8fe4f4f8e
werkzeug@1.0.1
3.1.9

Open the chart page →

6,549
supersetcloudposse1.2.01 of 1See more

superset cloudposse 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
amancevice/superset:0.35.212a0a9e66550
werkzeug@0.15.5
3.1.9

Open the chart page →

7,585
frigateblakeblackshear7.8.01 of 1See more

frigate blakeblackshear 7.8.0

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
ghcr.io/blakeblackshear/frigate:0.14.122e3d0b486df
werkzeug@3.0.3
3.1.9

Open the chart page →

4,115
home-assistantalekcVerified publisher2.11.41 of 1See more

home-assistant alekc 2.11.4

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.43e6710a7ab2a
werkzeug@3.1.8
3.1.9

Open the chart page →

2,940
home-assistantandrenarchyVerified publisher14.104.01 of 1See more

home-assistant andrenarchy 14.104.0

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
werkzeug@3.1.8
3.1.9

Open the chart page →

3,013
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.11.11da5c38c6a78
werkzeug@3.0.3
3.1.9

Open the chart page →

7,861
fadicetic0.3.11 of 25See more

fadi cetic 0.3.1

1 of the 25 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
amancevice/superset:0.35.212a0a9e66550
werkzeug@0.15.5
3.1.9

Open the chart page →

141,242
pgadmincetic0.1.121 of 1See more

pgadmin cetic 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
dpage/pgadmin4:latestc332c5f6dfba
werkzeug@3.1.8
3.1.9

Open the chart page →

93
geonode-k8sgeonode-k8sVerified publisher2.0.01 of 10See more

geonode-k8s geonode-k8s 2.0.0

1 of the 10 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
geopython/pycsw:3.0.0-beta284662ea6b78b
werkzeug@3.1.4
3.1.9

Open the chart page →

61,395
kubeflowkubeflow1.6.24 of 45See more

kubeflow kubeflow 1.6.2

4 of the 45 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
kserve/models-web-app:v0.8.063ea05e73842
werkzeug@2.1.2
3.1.9
kubeflownotebookswg/jupyter-web-app:v1.6.1d762690e21c1
werkzeug@2.2.2
3.1.9
kubeflownotebookswg/tensorboards-web-app:v1.6.10876fef1973b
werkzeug@2.2.2
3.1.9
kubeflownotebookswg/volumes-web-app:v1.6.17299fa94db15
werkzeug@2.2.2
3.1.9

Open the chart page →

186,888
postgres-operator-uipostgres-operator-ui2.0.31 of 1See more

postgres-operator-ui postgres-operator-ui 2.0.3

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
ghcr.io/zalando/postgres-operator-ui:v2.0.355077d32f7e4
werkzeug@3.1.6
3.1.9

Open the chart page →

1,721
taigarc-helm-charts0.1.01 of 7See more

taiga rc-helm-charts 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
taigaio/taiga-protected:6.4.036318831b3e7
werkzeug@0.15.6
3.1.9

Open the chart page →

8,349
k8s-telegram-sendertelegram-senderVerified publisher0.0.11 of 1See more

k8s-telegram-sender telegram-sender 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
danuk/telegram-sender:0.0.1026560388070
werkzeug@2.2.2
3.1.9

Open the chart page →

4,070
changedetectionalekcVerified publisher0.14.61 of 1See more

changedetection alekc 0.14.6

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.834df3680db1c
werkzeug@3.1.6
3.1.9

Open the chart page →

2,932
alerta-webalerta-webVerified publisher0.1.121 of 2See more

alerta-web alerta-web 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
hayk96/alerta-web:9.0.486377705e9e3
werkzeug@3.0.4
3.1.9

Open the chart page →

4,667
deepflowdeepflow6.2.2011 of 8See more

deepflow deepflow 6.2.201

1 of the 8 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
deepflowce/deepflow-app:v6.2.2aa9468ad4d96
werkzeug@1.0.1
3.1.9

Open the chart page →

20,189
openshift-secured-pgadmineximiaitVerified publisher0.2.01 of 2See more

openshift-secured-pgadmin eximiait 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
dpage/pgadmin4:7.537946e4f3e7b
werkzeug@2.2.3
3.1.9

Open the chart page →

15,398
openshift-secured-redisInsighteximiaitVerified publisher0.9.21 of 2See more

openshift-secured-redisInsight eximiait 0.9.2

1 of the 2 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
redislabs/redisinsight:1.14.0b03ab1426d0d
werkzeug@2.2.3
3.1.9

Open the chart page →

14,853
frigategeek-cookbookVerified publisher8.2.21 of 1See more

frigate geek-cookbook 8.2.2

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
blakeblackshear/frigate:0.10.0-amd64ae269270ad9e
werkzeug@1.0.1
3.1.9

Open the chart page →

11,172
mlflowgetindataVerified publisher0.1.21 of 1See more

mlflow getindata 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
gcr.io/getindata-images-public/mlflow:latest25d6975951f1
werkzeug@3.0.2
3.1.9

Open the chart page →

2,669
simple-krr-dashboardhelm-simple-krr-dashboardVerified publisher1.6.21 of 3See more

simple-krr-dashboard helm-simple-krr-dashboard 1.6.2

1 of the 3 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
ghcr.io/devops-ia/simple-krr-dashboard:1.6.34c625eff5410
werkzeug@3.1.6
3.1.9

Open the chart page →

2,794
home-assistanthome-assistantVerified publisher0.5.111 of 3See more

home-assistant home-assistant 0.5.11

1 of the 3 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.3d89226851697
werkzeug@3.1.8
3.1.9

Open the chart page →

3,204
calibre-webk8s-home-lab-repo9.1.11 of 1See more

calibre-web k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
werkzeug@3.1.8
3.1.9

Open the chart page →

6,103
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
werkzeug@3.1.6
3.1.9

Open the chart page →

5,609
machinarislib42Verified publisher0.2.01 of 1See more

machinaris lib42 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
ghcr.io/guydavis/machinaris:test50a71a30f18e
werkzeug@3.1.8
3.1.9

Open the chart page →

38,381
m8b-stackmetricshubVerified publisher2.1.21 of 4See more

m8b-stack metricshub 2.1.2

1 of the 4 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
searxng/searxng:2026.9.17-c497719921680ce7e8eec
werkzeug@3.1.8
3.1.9

Open the chart page →

135
kobotoolboxone-acre-fundVerified publisher0.7.42 of 9See more

kobotoolbox one-acre-fund 0.7.4

2 of the 9 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
kobotoolbox/kobocat:2.022.24ab15679454415
werkzeug@2.0.3
3.1.9
kobotoolbox/kpi:2.022.24dbcacc01bccd4
werkzeug@2.0.3
3.1.9

Open the chart page →

23,691
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/ubi8-oes-datascience:isd-spin-2025.10.01-af26a30d4-202511261054d8f66f4117fe
werkzeug@3.1.0
3.1.9

Open the chart page →

110,580
searxngself-hosters-by-nightVerified publisher1.3.11 of 2See more

searxng self-hosters-by-night 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
searxng/searxng:2026.8.22-9fea4120411a9b34cdc0b
werkzeug@3.1.8
3.1.9

Open the chart page →

10
siemassist-iot-cybersecurity-monitroting-siem0.1.01 of 3See more

siem assist-iot-cybersecurity-monitroting-siem 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_id-wzh:latest0aacefac9677
werkzeug@1.0.1
3.1.9

Open the chart page →

12,246
tensorflow-notebookcloudnativeapp0.1.21 of 1See more

tensorflow-notebook cloudnativeapp 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
tensorflow/tensorflow:1.6.0-devel1e3172090703
werkzeug@0.14.1
3.1.9

Open the chart page →

95,842
aibrixdanchevVerified publisher0.7.01 of 5See more

aibrix danchev 0.7.0

1 of the 5 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
aibrix/metadata-service:v0.7.063fb81a64377
werkzeug@3.0.6
3.1.9

Open the chart page →

6,666
datacube-explorerdatacube-charts0.5.341 of 1See more

datacube-explorer datacube-charts 0.5.34

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
ghcr.io/opendatacube/explorer:latest7c25578068cd
werkzeug@3.1.8
3.1.9

Open the chart page →

2,048
frontenddemo-application0.1.01 of 1See more

frontend demo-application 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102598.

Container imageDigestPackageFixed in
azhar008/flaskapplication:latesta1e827b0adea
werkzeug@2.0.2
3.1.9

Open the chart page →

5,187

Container images carrying it

406 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/cephcsi/cephcsi:v3.5.128a674af1df2
werkzeug@0.12.2
3.1.9
1
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
werkzeug@2.3.7
3.1.9
1
quay.io/maxiv/storageclass-router:0.4.160725dab588c
werkzeug@3.0.1
3.1.9
1
quay.io/opsmxpublic/ubi8-oes-datascience:isd-spin-2025.10.01-af26a30d4-202511261054d8f66f4117fe
werkzeug@3.1.0
3.1.9
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
werkzeug@3.0.1
3.1.9
1
registry.gitlab.com/radiology/infrastructure/study-governor:8.0.04e7faf6f8d5f
werkzeug@2.0.3
3.1.9
1

syft 1.42.1 · advisories as of 6 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.