StackRadar

CVE-2026-103001

Medium

Advisory

Published 30 Sept 2026In the index since 1 Oct 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
119
of 17,966 indexed, latest versions
Container images
126
deployed by those charts
Fix available
None
affected package

PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

Carried by container images the latest versions of 119 of 17,966 indexed charts deploy, on 126 images.

Affected packageAffected versionsFixed inImages
pyjwtpypi2.11.0, 2.12.0, 2.12.1, 2.13.0no fix listed126
OSV records
GHSA-gvp8-978c-rx2q

Charts affected

119 by stars
ChartLatestAffected imagesRadar Score
authentikgoauthentikOfficialVerified publisher2026.8.31 of 1See more

authentik goauthentik 2026.8.3

1 of the 1 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.8.3ab9b4e8cc4ab
pyjwt@2.13.0
no fix listed

Open the chart page →

1,322
jupyterhubjupyterhubOfficialVerified publisher4.4.21 of 7See more

jupyterhub jupyterhub 4.4.2

1 of the 7 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
pyjwt@2.13.0
no fix listed

Open the chart page →

8,992
home-assistanthelm-hassVerified publisher0.3.831 of 1See more

home-assistant helm-hass 0.3.83

1 of the 1 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.43e6710a7ab2a
pyjwt@2.13.0
no fix listed

Open the chart page →

2,513
mlflowcommunity-chartsVerified publisher1.11.71 of 1See more

mlflow community-charts 1.11.7

1 of the 1 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
burakince/mlflow:3.16.0ab4b566644b9
pyjwt@2.13.0
no fix listed

Open the chart page →

973
datahubdatahubVerified publisher1.1.51 of 4See more

datahub datahub 1.1.5

1 of the 4 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
acryldata/datahub-actions:v1.7.0.1c5fd70130157
pyjwt@2.13.0
no fix listed

Open the chart page →

1,247
weblateweblateOfficialVerified publisher0.5.381 of 3See more

weblate weblate 0.5.38

1 of the 3 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
weblate/weblate:2026.9.1.2f0be5b122b38
pyjwt@2.13.0
no fix listed

Open the chart page →

7,338
stackgres-operatorstackgres-chartsOfficialVerified publisher1.19.21 of 2See more

stackgres-operator stackgres-charts 1.19.2

1 of the 2 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
quay.io/stackgres/operator:1.19.282f33ab3fb1e
pyjwt@2.13.0
no fix listed

Open the chart page →

2,370
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
langgenius/dify-api:1.16.1dcefa5f7c47c
pyjwt@2.13.0
no fix listed

Open the chart page →

71,370
litellm-helmlitellm1.103.11 of 2See more

litellm-helm litellm 1.103.1

1 of the 2 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm:1.103.1df15400b5b80
pyjwt@2.13.0
no fix listed

Open the chart page →

5,520
memgraphmemgraphVerified publisher1.0.71 of 2See more

memgraph memgraph 1.0.7

1 of the 2 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
memgraph/memgraph:3.13.1bd3fe13228f4
pyjwt@2.13.0
no fix listed

Open the chart page →

1,547
ilumilumOfficialVerified publisher6.7.31 of 19See more

ilum ilum 6.7.3

1 of the 19 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
ilum/api:6.7.3624fd09528c8
pyjwt@2.13.0
no fix listed

Open the chart page →

23,962
nautobotnautobotOfficialVerified publisher3.1.21 of 1See more

nautobot nautobot 3.1.2

1 of the 1 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
networktocode/nautobot:3.0-py3.13ed484336b1ad
pyjwt@2.12.1
no fix listed

Open the chart page →

5,094
paperless-ngxpaperless-ngxVerified publisher0.3.231 of 3See more

paperless-ngx paperless-ngx 0.3.23

1 of the 3 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.2.15fa76604a81d
pyjwt@2.13.0
no fix listed

Open the chart page →

8,612
home-assistantalekcVerified publisher2.11.41 of 1See more

home-assistant alekc 2.11.4

1 of the 1 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.43e6710a7ab2a
pyjwt@2.13.0
no fix listed

Open the chart page →

2,513
home-assistantandrenarchyVerified publisher14.104.01 of 1See more

home-assistant andrenarchy 14.104.0

1 of the 1 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
pyjwt@2.13.0
no fix listed

Open the chart page →

2,575
gluugluuOfficialVerified publisher1.8.521 of 5See more

gluu gluu 1.8.52

1 of the 5 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
gluufederation/cloudtools:4.5.17-1fe944d2e5d0f
pyjwt@2.13.0
no fix listed

Open the chart page →

376
abcdesktopabcdesktopOfficialVerified publisher4.4.131 of 9See more

abcdesktop abcdesktop 4.4.13

1 of the 9 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
ghcr.io/abcdesktopio/pyos:4.4.alpine_latest5c43e3d66d2e
pyjwt@2.13.0
no fix listed

Open the chart page →

1,067
baserowbaserow-chartVerified publisher1.0.561 of 6See more

baserow baserow-chart 1.0.56

1 of the 6 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
baserow/backend:2.3.37c00549b3a6f
pyjwt@2.13.0
no fix listed

Open the chart page →

19,214
zenmlzenml0.97.01 of 1See more

zenml zenml 0.97.0

1 of the 1 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
zenmldocker/zenml-server:0.97.0aaa74934d606
pyjwt@2.13.0
no fix listed

Open the chart page →

1,555
defectdojodefectdojo1.9.541 of 4See more

defectdojo defectdojo 1.9.54

1 of the 4 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
defectdojo/defectdojo-django:3.3.3006516f0f62086
pyjwt@2.13.0
no fix listed

Open the chart page →

2,171
flyte-binaryflyte2.0.501 of 4See more

flyte-binary flyte 2.0.50

1 of the 4 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
pyjwt@2.13.0
no fix listed

Open the chart page →

4,566
hermes-agenthermes-agentVerified publisher1.16.01 of 1See more

hermes-agent hermes-agent 1.16.0

1 of the 1 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.9.24fca358f12efd
pyjwt@2.13.0
no fix listed

Open the chart page →

6,235
home-assistanthome-assistantVerified publisher0.5.111 of 3See more

home-assistant home-assistant 0.5.11

1 of the 3 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.3d89226851697
pyjwt@2.13.0
no fix listed

Open the chart page →

2,764
memgraph-high-availabilitymemgraphVerified publisher1.4.11 of 2See more

memgraph-high-availability memgraph 1.4.1

1 of the 2 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
memgraph/memgraph:3.13.1bd3fe13228f4
pyjwt@2.13.0
no fix listed

Open the chart page →

1,547
observalobservalVerified publisher1.13.11 of 8See more

observal observal 1.13.1

1 of the 8 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
ghcr.io/observal/observal-api:1.13.1153b8b893232
pyjwt@2.13.0
no fix listed

Open the chart page →

6,417
skypilotskypilotOfficialVerified publisher0.13.01 of 3See more

skypilot skypilot 0.13.0

1 of the 3 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot:0.13.03bc8bf8f4d83
pyjwt@2.13.0
no fix listed

Open the chart page →

6,621
pretixtechwolf12Verified publisher2026.7.01 of 3See more

pretix techwolf12 2026.7.0

1 of the 3 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
pretix/standalone:2026.7.05df3b7aa852e
pyjwt@2.13.0
no fix listed

Open the chart page →

11,305
wgerwgerOfficialVerified publisher2.0.01 of 7See more

wger wger 2.0.0

1 of the 7 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
wger/server:2.71c5789b93bfe
pyjwt@2.13.0
no fix listed

Open the chart page →

8,458
paperlesszekker6Verified publisher11.10.01 of 1See more

paperless zekker6 11.10.0

1 of the 1 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.2.15fa76604a81d
pyjwt@2.13.0
no fix listed

Open the chart page →

4,533
paperless-ngxadnoctemVerified publisher0.4.21 of 5See more

paperless-ngx adnoctem 0.4.2

1 of the 5 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
pyjwt@2.13.0
no fix listed

Open the chart page →

23,678
agentareaagentareaVerified publisher0.0.252 of 17See more

agentarea agentarea 0.0.25

2 of the 17 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
agentarea/agentarea-api:latest38fcf6657f5f
pyjwt@2.13.0
no fix listed
agentarea/agentarea-worker:latest06a5ef356770
pyjwt@2.13.0
no fix listed

Open the chart page →

12,510
akeyless-api-gatewayakeyless-services-helmVerified publisher1.62.261 of 1See more

akeyless-api-gateway akeyless-services-helm 1.62.26

1 of the 1 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
akeyless/base:latest759e4289fae8
pyjwt@2.12.0
no fix listed

Open the chart page →

2,856
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
pyjwt@2.13.0
no fix listed

Open the chart page →

6,947
clamav-restclamav-restVerified publisher1.0.71 of 2See more

clamav-rest clamav-rest 1.0.7

1 of the 2 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
rtlabsio/clamav-rest:1.0.7be3e45ab4edd
pyjwt@2.13.0
no fix listed

Open the chart page →

587
dagster-cloud-agentdagster-cloudVerified publisher1.13.241 of 1See more

dagster-cloud-agent dagster-cloud 1.13.24

1 of the 1 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
dagster/dagster-cloud-agent:1.13.24e29285673c2c
pyjwt@2.13.0
no fix listed

Open the chart page →

1,165
aibrixdanchevVerified publisher0.7.01 of 5See more

aibrix danchev 0.7.0

1 of the 5 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
aibrix/metadata-service:v0.7.063fb81a64377
pyjwt@2.13.0
no fix listed

Open the chart page →

6,029
elastalert2elastalert22.31.01 of 1See more

elastalert2 elastalert2 2.31.0

1 of the 1 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
jertel/elastalert2:2.31.03cbf63f9b7dc
pyjwt@2.13.0
no fix listed

Open the chart page →

2,182
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latestd89226851697
pyjwt@2.13.0
no fix listed

Open the chart page →

2,513
langflow-idelangflow0.1.21 of 2See more

langflow-ide langflow 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
langflowai/langflow:latest79c02794adeb
pyjwt@2.13.0
no fix listed

Open the chart page →

4,585
langflow-runtimelangflow0.1.11 of 1See more

langflow-runtime langflow 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
langflowai/langflow:latest79c02794adeb
pyjwt@2.13.0
no fix listed

Open the chart page →

399
home-assistantloeken-at-homeVerified publisher2026.5.11 of 1See more

home-assistant loeken-at-home 2026.5.1

1 of the 1 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
loeken/home-assistant:2026.5.14ce6abc553b3
pyjwt@2.12.1
no fix listed

Open the chart page →

3,562
plane-enterprisemakeplaneOfficialVerified publisher3.10.21 of 13See more

plane-enterprise makeplane 3.10.2

1 of the 13 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
makeplane/backend-commercial:v3.3.0f587597c46b5
pyjwt@2.13.0
no fix listed

Open the chart page →

4,608
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.12 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.1

2 of the 34 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.1.0-mcp81db69cdd0b6
pyjwt@2.13.0
no fix listed
ghcr.io/open-telemetry/demo:3.1.0-agentd0f4ae0b32a8
pyjwt@2.13.0
no fix listed

Open the chart page →

23,320
paperless-ngxpaperlessVerified publisher0.4.01 of 3See more

paperless-ngx paperless 0.4.0

1 of the 3 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngxdigest-pinnedaa810a36942c
pyjwt@2.13.0
no fix listed

Open the chart page →

9,844
home-assistantpree-helm-chartsVerified publisher1.82.01 of 1See more

home-assistant pree-helm-charts 1.82.0

1 of the 1 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.43e6710a7ab2a
pyjwt@2.13.0
no fix listed

Open the chart page →

2,513
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
pyjwt@2.13.0
no fix listed

Open the chart page →

9,505
securosecuroVerified publisher0.16.21 of 4See more

securo securo 0.16.2

1 of the 4 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
ghcr.io/securo-finance/securo-backend:0.16.2b1cd83ff7828
pyjwt@2.13.0
no fix listed

Open the chart page →

3,613
sentry-k8ssentry-k8sVerified publisher1.4.12 of 11See more

sentry-k8s sentry-k8s 1.4.1

2 of the 11 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
pyjwt@2.13.0
no fix listed
ghcr.io/getsentry/snuba:26.7.210f8d164109b
pyjwt@2.13.0
no fix listed

Open the chart page →

18,612
waldurwaldur-chartsVerified publisher8.1.21 of 3See more

waldur waldur-charts 8.1.2

1 of the 3 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
opennode/waldur-mastermind:8.1.24c82b15d9042
pyjwt@2.13.0
no fix listed

Open the chart page →

5,429
healthcheckszekker6Verified publisher1.20.01 of 1See more

healthchecks zekker6 1.20.0

1 of the 1 container images this version deploys carry CVE-2026-103001.

Container imageDigestPackageFixed in
linuxserver/healthchecks:4.4.2026092108a37bd6dcf2
pyjwt@2.13.0
no fix listed

Open the chart page →

136

Container images carrying it

126 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/openrelik/openrelik-worker-cloud-logs:latesta5d7e3cf71d3
pyjwt@2.13.0
no fix listed
1
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
pyjwt@2.13.0
no fix listed
1
ghcr.io/openrelik/openrelik-worker-dfindexeddb:latest31966a825782
pyjwt@2.13.0
no fix listed
1
ghcr.io/openrelik/openrelik-worker-extraction:latestec9fc5864cd5
pyjwt@2.13.0
no fix listed
1
ghcr.io/openrelik/openrelik-worker-floss:latest7a331eb83c6a
pyjwt@2.13.0
no fix listed
1
ghcr.io/openrelik/openrelik-worker-grep:latest470ff3529746
pyjwt@2.13.0
no fix listed
1
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
pyjwt@2.13.0
no fix listed
1
ghcr.io/openrelik/openrelik-worker-plaso:latest75537ea8c851
pyjwt@2.13.0
no fix listed
1
ghcr.io/openrelik/openrelik-worker-strings:latest6e05055b701f
pyjwt@2.13.0
no fix listed
1
ghcr.io/openrelik/openrelik-worker-timesketch:latest4cb88b603cdc
pyjwt@2.13.0
no fix listed
1
ghcr.io/openrelik/openrelik-worker-yara:latestbd7fbf4505b5
pyjwt@2.13.0
no fix listed
1
ghcr.io/open-telemetry/demo:3.1.0-mcp81db69cdd0b6
pyjwt@2.13.0
no fix listed
1
ghcr.io/open-telemetry/demo:3.1.0-agentd0f4ae0b32a8
pyjwt@2.13.0
no fix listed
1
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
pyjwt@2.13.0
no fix listed
1
ghcr.io/runwhen-contrib/runwhen-local:0.12.32c1ec86675d4
pyjwt@2.13.0
no fix listed
1
ghcr.io/securo-finance/securo-backend:0.16.2b1cd83ff7828
pyjwt@2.13.0
no fix listed
1
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
pyjwt@2.11.0
no fix listed
1
ghcr.io/tarkyaio/tarka:0.4.1e8d3f1512f06
pyjwt@2.12.1
no fix listed
1
ghcr.io/unique-ag/ai/search-proxy:2026.40.02bd74586650d
pyjwt@2.13.0
no fix listed
1
ghcr.io/vinny1892/octantis:latest45459c0910fc
pyjwt@2.12.1
no fix listed
1
public.ecr.aws/aktosecurity/akto-ai-automated-testing:latest573542399fe4
pyjwt@2.13.0
no fix listed
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
pyjwt@2.12.1
no fix listed
1
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
pyjwt@2.13.0
no fix listed
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
pyjwt@2.12.1
no fix listed
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
pyjwt@2.12.1
no fix listed
1
quay.io/stackgres/operator:1.19.282f33ab3fb1e
pyjwt@2.13.0
no fix listed
1

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.