StackRadar

CVE-2026-102991

Medium

Advisory

Published 2 Oct 2026In the index since 3 Oct 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.004
27th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
169
of 18,026 indexed, latest versions
Container images
169
deployed by those charts
Fix available
1 of 2
affected packages

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Carried by container images the latest versions of 169 of 18,026 indexed charts deploy, on 169 images.

Affected packageAffected versionsFixed inImages
makopypi0.8.1, 1.0.2, 1.0.6.dev0, 1.0.7+28 more1.4.2169
makodeb1.0.7+ds1-1, 1.1.0+ds1-1ubuntu2.1, 1.3.2-1no fix listed4
OSV records
GHSA-5639-2j2p-m4mxUBUNTU-CVE-2026-102991

Charts affected

169 by stars
ChartLatestAffected imagesRadar Score
medikeephelmforgeVerified publisher2.0.21 of 3See more

medikeep helmforge 2.0.2

1 of the 3 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/afairgiant/medikeep:v0.71.0086579173033
mako@1.4.1
1.4.2

Open the chart page →

6,249
supersethelmforgeVerified publisher1.3.71 of 5See more

superset helmforge 1.3.7

1 of the 5 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
apache/superset:6.1.016b50bbef664
mako@1.3.10
1.4.2

Open the chart page →

6,197
ikigaiikigai-chartVerified publisher0.0.91 of 58See more

ikigai ikigai-chart 0.0.9

1 of the 58 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
jupyterhub/k8s-hub:1.2.0e4770285aaf7
mako@1.1.4
1.4.2

Open the chart page →

117,295
pgadmininseefrlab3.2.01 of 1See more

pgadmin inseefrlab 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
dpage/pgadmin4:latestc332c5f6dfba
mako@1.4.1
1.4.2

Open the chart page →

93
redashinseefrlab2.1.01 of 3See more

redash inseefrlab 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
redash/redash:10.0.0.b503639392753c0376
mako@1.1.5
1.4.2

Open the chart page →

4,452
guestbookjakuboskera0.2.01 of 3See more

guestbook jakuboskera 0.2.0

1 of the 3 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
jakuboskera/guestbook:v0.3.04989afa06e74
mako@1.1.6
1.4.2

Open the chart page →

1,516
todojakuboskera0.1.11 of 1See more

todo jakuboskera 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
jakuboskera/todo:v0.2.3714b1adbbc2d
mako@1.3.10
1.4.2

Open the chart page →

829
bazarrk8s-home-lab-repo11.3.21 of 1See more

bazarr k8s-home-lab-repo 11.3.2

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
mako@1.3.8
1.4.2

Open the chart page →

1,989
beetsk8s-home-lab-repo3.1.11 of 1See more

beets k8s-home-lab-repo 3.1.1

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/home-operations/beets:2.3.1cc4975f1a0be
mako@1.3.10
1.4.2

Open the chart page →

3,026
jupyterhub-chartk8s-jupyterhub0.1.01 of 1See more

jupyterhub-chart k8s-jupyterhub 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
truebyteinnovationllp/jupyterhub-k8s:5.5.06bf978b96279
mako@1.3.12
1.4.2

Open the chart page →

1,896
huekatool1.0.81 of 1See more

hue katool 1.0.8

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
gethue/hue:4.11.011b649636e68
mako@1.2.3
1.4.2

Open the chart page →

84,883
mlflowkelvins0.4.01 of 3See more

mlflow kelvins 0.4.0

1 of the 3 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
kelvinsp/mlflow:1.26.1cd33e6db2a59
mako@1.2.0
1.4.2

Open the chart page →

5,205
kitarukitaru0.27.11 of 1See more

kitaru kitaru 0.27.1

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
zenmldocker/kitaru-server:0.27.1f1c4675a188b
mako@1.3.12
1.4.2

Open the chart page →

1,337
mindsdbkronkltdVerified publisher0.1.01 of 1See more

mindsdb kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
mindsdb/mindsdb:latest163011c09299
mako@1.3.11
1.4.2

Open the chart page →

11,283
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
mako@1.3.10
1.4.2

Open the chart page →

9,493
jupyterhubkubeblocksVerified publisher0.1.02 of 7See more

jupyterhub kubeblocks 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
jupyterhub/k8s-hub:3.0.1-0.dev.git.6287.hbfb05cd65a0ceed1300a
mako@1.2.4
1.4.2
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
mako@1.2.4
1.4.2

Open the chart page →

9,490
cephfs-csikubegems1.0.81 of 6See more

cephfs-csi kubegems 1.0.8

1 of the 6 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.5.128a674af1df2
mako@1.0.6.dev0
1.4.2

Open the chart page →

5,544
kubevoipkubevoipOfficialVerified publisher0.6.81 of 1See more

kubevoip kubevoip 0.6.8

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/kubevoip/kubevoip:v0.6.841c603a93642
mako@1.3.12
1.4.2

Open the chart page →

1,425
delugelib42Verified publisher1.3.01 of 1See more

deluge lib42 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
lib42/deluge:20c4d1d326f95
mako@1.2.4
1.4.2

Open the chart page →

1,053
delugelinkding0.2.31 of 1See more

deluge linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
linuxserver/deluge:libtorrentv1-2.2.0-ls40052eac68ccc0
mako@1.3.10
1.4.2

Open the chart page →

1,813
nubladolsst-sqre0.9.233 of 5See more

nublado lsst-sqre 0.9.23

3 of the 5 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
lsstsqre/prepuller:latest19c2dfc4e4ff
mako@1.1.4
1.4.2
lsstsqre/sciplat-hub:latest5e0ade6bed1c
mako@0.8.1
1.4.2
lsstsqre/wfdispatcher:lateste9feb99f524d
mako@1.1.4
1.4.2

Open the chart page →

6,459
nublado2lsst-sqre0.8.51 of 2See more

nublado2 lsst-sqre 0.8.5

1 of the 2 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
lsstsqre/nublado2:2.0.1b75bf8aaafa4
mako@1.1.6
1.4.2

Open the chart page →

92,814
bazarrm0nsterrr-bazarrVerified publisher2.3.21 of 1See more

bazarr m0nsterrr-bazarr 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/home-operations/bazarr:1.6.217dc1cff22e9
mako@1.3.12
1.4.2

Open the chart page →

180
servicesmicroslacVerified publisher0.4.01 of 8See more

services microslac 0.4.0

1 of the 8 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
microslac/chat:latest417317e4e4e8
mako@1.3.3
1.4.2

Open the chart page →

34,113
parent-chartmid-proje0.1.01 of 3See more

parent-chart mid-proje 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
youssef11gaber10/flask-service:latest9c727fcfde76
mako@1.3.12
1.4.2

Open the chart page →

2,134
python-api-postgresmiltex0.0.11 of 2See more

python-api-postgres miltex 0.0.1

1 of the 2 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
miltex/python-api:1.0.0dab12a7748d5
mako@1.1.4
1.4.2

Open the chart page →

3,784
aws-api-gateway-operatormintel0.1.21 of 11See more

aws-api-gateway-operator mintel 0.1.2

1 of the 11 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
localstack/localstack:latest4abc29e923e5
mako@1.4.1
1.4.2

Open the chart page →

12,077
standard-application-stackmintel11.5.01 of 12See more

standard-application-stack mintel 11.5.0

1 of the 12 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
localstack/localstack:latestdf6b89814326
mako@1.4.1
1.4.2

Open the chart page →

11,596
mlflow-servermlflow-server0.3.01 of 1See more

mlflow-server mlflow-server 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/mlops-for-all/mlflow-tracking-server:3.8-1.30.1-v1.0.0d30e631684c3
mako@1.2.4
1.4.2

Open the chart page →

3,529
mlflowmondata-helm-chartsVerified publisher0.2.31 of 1See more

mlflow mondata-helm-charts 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
mondata/mlflow:v2.3.0.s3.gc6f94c6caf8bf
mako@1.2.4
1.4.2

Open the chart page →

4,152
szurubooru-servermy0nVerified publisher0.2.51 of 3See more

szurubooru-server my0n 0.2.5

1 of the 3 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
szurubooru/server:2.5accf2ad9fbc3
mako@1.3.12
1.4.2

Open the chart page →

1,236
my-fastapi-chartmy-fastapi-template0.1.01 of 1See more

my-fastapi-chart my-fastapi-template 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
john19968010/fastapi-template:latest31a90f6bd69c
mako@1.2.4
1.4.2

Open the chart page →

1,206
elasticsearch2ncsaVerified publisher0.2.21 of 2See more

elasticsearch2 ncsa 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
elastichq/elasticsearch-hq:latestbb3bd22c2b87
mako@1.1.0
1.4.2

Open the chart page →

5,938
mlflowncsaVerified publisher1.2.11 of 4See more

mlflow ncsa 1.2.1

1 of the 4 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
evk02/mlflow:2.2.1ef6ff257ef35
mako@1.2.4
1.4.2

Open the chart page →

6,409
sickchillnicholaswildeVerified publisher0.1.01 of 1See more

sickchill nicholaswilde 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/sickchill:2021.5.10-1-ls63a607452a692a
mako@1.1.4
1.4.2

Open the chart page →

1,231
automx2oleds-helm-chartsVerified publisher1.0.51 of 1See more

automx2 oleds-helm-charts 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
oled01/automx2:2025.1.105d3e398e675
mako@1.3.10
1.4.2

Open the chart page →

5,795
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
onyxdotapp/onyx-backend:latest60e83a098ae4
mako@1.3.12
1.4.2

Open the chart page →

8,959
terminalsopen-webui0.7.01 of 2See more

terminals open-webui 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/open-webui/terminals:latest6850ed976e7e
mako@1.4.1
1.4.2

Open the chart page →

2,305
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.03 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

3 of the 40 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/openrelik/openrelik-mediator:latest50ea049b2836
mako@1.4.1
1.4.2
ghcr.io/openrelik/openrelik-metrics:latest3d0f1ddeebf5
mako@1.3.10
1.4.2
ghcr.io/openrelik/openrelik-server:latestee689861c980
mako@1.4.1
1.4.2

Open the chart page →

234,921
ctfdpascaliskeVerified publisher2.0.01 of 1See more

ctfd pascaliske 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/ctfd/ctfd:3.8.2870e396fddf8
mako@1.3.10
1.4.2

Open the chart page →

2,671
prefect-agentprefectVerified publisher2024.8.301638221 of 1See more

prefect-agent prefect 2024.8.30163822

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
prefecthq/prefect:2.20.4-python3.101df4b5b6238a
mako@1.3.5
1.4.2

Open the chart page →

5,934
prompt-dbprompt-dbVerified publisher1.0.71 of 3See more

prompt-db prompt-db 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/erlkoenig91/prompt-db-backend:1.0.7ab120359810d
mako@1.3.12
1.4.2

Open the chart page →

3,994
flaskDiaryptj-miniproject2.1.21 of 2See more

flaskDiary ptj-miniproject 2.1.2

1 of the 2 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
freedom98/flask:k3.0d7ce1533f297
mako@1.3.10
1.4.2

Open the chart page →

3,614
powerdnspuckpuck2.0.01 of 4See more

powerdns puckpuck 2.0.0

1 of the 4 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
pschiffe/pdns-admin:0.4.137ebba8c2b8f
mako@1.3.12
1.4.2

Open the chart page →

5,501
python-fastapi-postgrespython-fastapi-postgres0.1.01 of 1See more

python-fastapi-postgres python-fastapi-postgres 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
archish27/python-fastapi-postgres:latest6610071a2101
mako@1.2.1
1.4.2

Open the chart page →

4,183
airflowquench-airflowVerified publisher0.1.271 of 2See more

airflow quench-airflow 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/airflowdigest-pinned9d483f01ed60
mako@1.4.1
1.4.2

Open the chart page →

167
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
mako@1.3.5
1.4.2

Open the chart page →

23,519
request-registryrequest-registry0.1.01 of 2See more

request-registry request-registry 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
registry.gitlab.com/open-forms/request-registry:latest0886cbbc5f95
mako@1.1.5
1.4.2

Open the chart page →

2,858
delugeretsamedocVerified publisher26.9.01 of 1See more

deluge retsamedoc 26.9.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
linuxserver/deluge:2.2.09505c64720af
mako@1.4.1
1.4.2

Open the chart page →

895
spoolmanretsamedocVerified publisher26.9.01 of 1See more

spoolman retsamedoc 26.9.0

1 of the 1 container images this version deploys carry CVE-2026-102991.

Container imageDigestPackageFixed in
ghcr.io/donkie/spoolman:0.26.1cf9b41e17b93
mako@1.3.12
1.4.2

Open the chart page →

2,470

Container images carrying it

169 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
dpage/pgadmin4:9.17:9.18:latestc332c5f6dfba
mako@1.4.1
1.4.2
5
apache/superset:6.1.0:latest16b50bbef664
mako@1.3.10
1.4.2
3
dpage/pgadmin4:6.12781369df9994
mako@1.2.1
1.4.2
3
amancevice/superset:0.35.212a0a9e66550
mako@1.0.14
1.4.2
2
gradiant/srsran-5g:23_10_19061b1bf0f36
mako@1.1.0+ds1-1ubuntu2.1
mako@1.1.0
no fix listed
1.4.2
2
langflowai/langflow:latest4304bd9e67db
mako@1.3.12
1.4.2
2
larribas/mlflow:1.9.105ccb0b46bfb
mako@1.1.3
1.4.2
2
ngoduykhanh/powerdns-admin:v0.2.4ba36ab196d3d
mako@1.1.5
1.4.2
2
ghcr.io/donkie/spoolman:0.27.07aba565eff77
mako@1.3.12
1.4.2
2
quay.io/cephcsi/cephcsi:v3.14.2dc4bbac6efe1
mako@1.1.4.dev0
1.4.2
2
agentarea/agentarea-api:latestf9033ebe2e00
mako@1.3.12
1.4.2
1
agentarea/agentarea-worker:latestf4745afdace1
mako@1.3.12
1.4.2
1
amancevice/superset:0.28.1c8c04bfe3d66
mako@1.0.7
1.4.2
1
apache/airflow:2.8.4-python3.964e58748b6b9
mako@1.3.2
1.4.2
1
apache/airflow:2.10.2-python3.9ce90bdc3d2af
mako@1.3.5
1.4.2
1
apache/airflow:2.8.1e5560ad0b86e
mako@1.3.0
1.4.2
1
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
mako@1.1.4
1.4.2
1
apache/superset:4.0.1ab9467fd712c
mako@1.2.4
1.4.2
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
mako@1.3.10
1.4.2
1
archish27/python-fastapi-postgres:latest6610071a2101
mako@1.2.1
1.4.2
1
aristidetm/basic-notebook:3.6.5469dbc951224
mako@1.3.5
1.4.2
1
aristidetm/k8s-hub:3.3.7ccb516cb8474
mako@1.3.2
1.4.2
1
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
mako@1.3.10
1.4.2
1
buntha/mlflow:2.1.1154542cc3083
mako@1.2.4
1.4.2
1
burakince/mlflow:3.16.0ab4b566644b9
mako@1.4.1
1.4.2
1
camptocamp/geomapfishapp-geoportal:latestae874f70cc16
mako@1.3.12
1.4.2
1
ceph/daemon:latest-nautilus90f30824a96e
mako@0.8.1
1.4.2
1
chorss/docker-pgadmin4:4.115c549cacb8ab
mako@1.1.0
1.4.2
1
ckan/ckan-base:2.12.087ecf3f27ad6
mako@1.3.12
1.4.2
1
cleveritcz/opencve:1.5.0c75c1636e0b7
mako@1.3.3
1.4.2
1
dagster/dagster-cloud-agent:1.13.257c13aa1c9a7a
mako@1.4.1
1.4.2
1
dalibo/explain.dalibo.com:2.20.12a0b749c2f7f
mako@1.3.10
1.4.2
1
daskdev/dask-notebook:1.1.0052630f5ca04
mako@1.0.7
1.4.2
1
datagrok/grok_spawner:latest8c2d48c1545c
mako@1.3.12
1.4.2
1
devopstales/kubedash:3.1.08bb837da5aec
mako@1.3.10
1.4.2
1
dpage/pgadmin4:8.418cd5711fc9a
mako@1.3.2
1.4.2
1
dpage/pgadmin4:7.537946e4f3e7b
mako@1.2.4
1.4.2
1
dpage/pgadmin4:9.11.050700ac17936
mako@1.3.10
1.4.2
1
dpage/pgadmin4:9.252cb72a9e3da
mako@1.3.9
1.4.2
1
dpage/pgadmin4:8.13561c1f8f99f2
mako@1.3.6
1.4.2
1
dpage/pgadmin4:4.5a5a656e1d5fd
mako@1.0.8
1.4.2
1
dpage/pgadmin4:4.22b1f00b8163cf
mako@1.1.2
1.4.2
1
elastichq/elasticsearch-hq:latestbb3bd22c2b87
mako@1.1.0
1.4.2
1
evk02/mlflow:2.2.1ef6ff257ef35
mako@1.2.4
1.4.2
1
freedom98/flask:k3.0d7ce1533f297
mako@1.3.10
1.4.2
1
galaxy/galaxy-init:v18.010267bad550e6
mako@1.0.2
1.4.2
1
gethue/hue:4.11.011b649636e68
mako@1.2.3
1.4.2
1
gethue/hue:4.10.05702b2c37ff9
mako@1.1.4
1.4.2
1
gethue/hue:latest7d5c1b9f8a79
mako@1.2.3
1.4.2
1
gpappsoft/privacyidea-docker:3.12.2af7841adad26
mako@1.3.9
1.4.2
1

syft 1.42.1 · advisories as of 6 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.