StackRadar

CVE-2026-109461

High

Advisory

Published 23 Oct 2026In the index since 24 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.003
27th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
46
of 18,232 indexed, latest versions
Container images
39
deployed by those charts
Fix available
1 of 1
affected package

MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

Carried by container images the latest versions of 46 of 18,232 indexed charts deploy, on 39 images.

Affected packageAffected versionsFixed inImages
@azure/msal-nodenpm5.0.2, 5.1.1, 5.1.3, 5.1.5+10 more7.1.039
OSV records
GHSA-xcx6-jx8p-x3h5

Charts affected

46 by stars
ChartLatestAffected imagesRadar Score
n8ncommunity-chartsVerified publisher1.24.431 of 1See more

n8n community-charts 1.24.43

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
n8nio/n8n:2.41.687e0bab2c931
@azure/msal-node@5.1.5
7.1.0

Open the chart page →

1,888
n8nopen-8gears2.1.11 of 1See more

n8n open-8gears 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.8cfe2704ff858
@azure/msal-node@5.1.5
7.1.0

Open the chart page →

2,762
uptime-kumauptime-kumaVerified publisher4.2.01 of 1See more

uptime-kuma uptime-kuma 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
@azure/msal-node@5.4.0
7.1.0

Open the chart page →

42,586
backstagebackstageOfficialVerified publisher2.10.21 of 1See more

backstage backstage 2.10.2

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
ghcr.io/backstage/backstage:latest68f2025a3f27
@azure/msal-node@6.0.1
7.1.0

Open the chart page →

1,490
oneuptimeoneuptimeOfficialVerified publisher14.0.873 of 7See more

oneuptime oneuptime 14.0.87

3 of the 7 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
oneuptime/nginx:release64cc9c60a76a
@azure/msal-node@5.5.0
7.1.0
oneuptime/probe:releasedd75b4631455
@azure/msal-node@5.5.0
7.1.0
oneuptime/runner:releasea99da95a0490
@azure/msal-node@5.5.0
7.1.0

Open the chart page →

9,838
wekanwekanVerified publisher12.63.01 of 3See more

wekan wekan 12.63.0

1 of the 3 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
ghcr.io/wekan/wekan:v12.635a9fc6933d5a
@azure/msal-node@6.0.1
7.1.0

Open the chart page →

1,469
budibasebudibase0.0.0-master1 of 7See more

budibase budibase 0.0.0-master

1 of the 7 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
budibase/apps:3.41.344fe6feab985
@azure/msal-node@5.4.3
7.1.0

Open the chart page →

12,484
n8nhelmforgeVerified publisher2.1.81 of 2See more

n8n helmforge 2.1.8

1 of the 2 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
n8nio/n8n:2.44.4c72fa9f1bd9b
@azure/msal-node@5.1.5
7.1.0

Open the chart page →

1,358
redisinsightredisinsight-guiVerified publisher1.3.51 of 1See more

redisinsight redisinsight-gui 1.3.5

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
redis/redisinsight:3.8b5e19ee240ab
@azure/msal-node@5.0.2
7.1.0

Open the chart page →

1,434
wgerwgerOfficialVerified publisher2.0.01 of 7See more

wger wger 2.0.0

1 of the 7 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
journeyapps/powersync-service:latest15b8e4dbbab1
@azure/msal-node@5.1.1
7.1.0

Open the chart page →

9,774
dbgateappscodeVerified publisher2026.3.301 of 1See more

dbgate appscode 2026.3.30

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
dbgate/dbgate:7.2.0-alpine287077002446
@azure/msal-node@5.2.3
7.1.0

Open the chart page →

958
uptime-kumahelmforgeVerified publisher1.5.171 of 1See more

uptime-kuma helmforge 1.5.17

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.69912da7d7d9b
@azure/msal-node@5.6.0
7.1.0

Open the chart page →

42,372
n8nklicktippVerified publisher1.12.01 of 1See more

n8n klicktipp 1.12.0

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
n8nio/n8n:2.45.3bf88c3783fc4
@azure/msal-node@5.1.5
7.1.0

Open the chart page →

577
plane-enterprisemakeplaneOfficialVerified publisher3.10.121 of 13See more

plane-enterprise makeplane 3.10.12

1 of the 13 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
makeplane/silo-commercial:v3.3.312c33418c1ec
@azure/msal-node@5.5.0
7.1.0

Open the chart page →

7,782
rocketadminrocketadminOfficialVerified publisher1.0.431 of 1See more

rocketadmin rocketadmin 1.0.43

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.23.70bd1abb0bfd1
@azure/msal-node@5.1.3
7.1.0

Open the chart page →

27,427
uptime-kumaadnoctemVerified publisher0.4.31 of 1See more

uptime-kuma adnoctem 0.4.3

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.69912da7d7d9b
@azure/msal-node@5.6.0
7.1.0

Open the chart page →

42,372
dapr-agentsdapr-agents-devVerified publisher0.1.51 of 31See more

dapr-agents dapr-agents-dev 0.1.5

1 of the 31 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
redis/redisinsight:latestb5e19ee240ab
@azure/msal-node@5.0.2
7.1.0

Open the chart page →

33,648
dbgatedbgate-helm-chartVerified publisher0.1.81 of 1See more

dbgate dbgate-helm-chart 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
dbgate/dbgate:7.2.3f2dc7423ea88
@azure/msal-node@5.4.1
7.1.0

Open the chart page →

1,955
decisionrules-aksdecisionrules-aksOfficialVerified publisher0.3.01 of 2See more

decisionrules-aks decisionrules-aks 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
decisionrules/server:latest6f6d024a87b8
@azure/msal-node@5.5.0
7.1.0

Open the chart page →

606
decisionrules-eksdecisionrules-eksOfficialVerified publisher0.4.01 of 2See more

decisionrules-eks decisionrules-eks 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
decisionrules/server:latest6f6d024a87b8
@azure/msal-node@5.5.0
7.1.0

Open the chart page →

606
decisionrules-ingressdecisionrules-ingressOfficialVerified publisher0.3.01 of 2See more

decisionrules-ingress decisionrules-ingress 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
decisionrules/server:latest6f6d024a87b8
@azure/msal-node@5.5.0
7.1.0

Open the chart page →

606
decisionrules-ocpdecisionrules-ocpOfficialVerified publisher0.2.11 of 4See more

decisionrules-ocp decisionrules-ocp 0.2.1

1 of the 4 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
decisionrules/server:latestbb3a93224b5a
@azure/msal-node@5.5.0
7.1.0

Open the chart page →

2,201
uptime-kumaegebackVerified publisher2.0.131 of 1See more

uptime-kuma egeback 2.0.13

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.1ecd5b8c8b49f
@azure/msal-node@5.5.0
7.1.0

Open the chart page →

42,524
azuriteemberstackVerified publisher1.0.221 of 1See more

azurite emberstack 1.0.22

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
@azure/msal-node@5.5.0
7.1.0

Open the chart page →

742
twentyhelmforgeVerified publisher1.0.91 of 5See more

twenty helmforge 1.0.9

1 of the 5 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.49.080e1b33b0b4b
@azure/msal-node@5.2.4
7.1.0

Open the chart page →

3,146
infisicalinfisical-charts0.4.21 of 3See more

infisical infisical-charts 0.4.2

1 of the 3 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
infisical/infisical:latestdbc5be2079b6
@azure/msal-node@6.0.1
7.1.0

Open the chart page →

2,830
infisical-standaloneinfisical-charts1.11.11 of 5See more

infisical-standalone infisical-charts 1.11.1

1 of the 5 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
infisical/infisical:v0.167.0dbc5be2079b6
@azure/msal-node@6.0.1
7.1.0

Open the chart page →

2,830
redisinsightklicktippVerified publisher0.5.01 of 1See more

redisinsight klicktipp 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
redis/redisinsight:3.2.055542a762210
@azure/msal-node@5.0.2
7.1.0

Open the chart page →

1,784
uptime-kumakubernetes-homelab-helm-chartsVerified publisher0.3.01 of 1See more

uptime-kuma kubernetes-homelab-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.6-slim5db97dbbef61
@azure/msal-node@5.6.0
7.1.0

Open the chart page →

6,833
uptime-kumalbenicio-communityVerified publisher0.1.11 of 1See more

uptime-kuma lbenicio-community 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
@azure/msal-node@5.1.5
7.1.0

Open the chart page →

45,925
uptime-kumaloeken-at-homeVerified publisher2.3.21 of 1See more

uptime-kuma loeken-at-home 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
@azure/msal-node@5.1.5
7.1.0

Open the chart page →

45,925
redisinsightlogic3579Verified publisher3.4.01 of 1See more

redisinsight logic3579 3.4.0

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
redis/redisinsight:3.485562d67a912
@azure/msal-node@5.0.2
7.1.0

Open the chart page →

1,849
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
@azure/msal-node@5.1.5
7.1.0

Open the chart page →

2,762
uptime-kumancsaVerified publisher1.7.31 of 1See more

uptime-kuma ncsa 1.7.3

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.5c74379ac4509
@azure/msal-node@5.6.0
7.1.0

Open the chart page →

42,437
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
@azure/msal-node@5.1.5
7.1.0

Open the chart page →

2,762
uptime-kumaquench-uptime-kumaVerified publisher0.0.101 of 1See more

uptime-kuma quench-uptime-kuma 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/uptime-kumadigest-pinned76bb9db001b0
@azure/msal-node@5.6.0
7.1.0

Open the chart page →

113
etherpadredhat-cop0.0.81 of 1See more

etherpad redhat-cop 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
etherpad/etherpad:latest3d59d633d285
@azure/msal-node@6.0.1
7.1.0

Open the chart page →

301
redisinsightredisinsightVerified publisher0.1.01 of 1See more

redisinsight redisinsight 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
redis/redisinsight:latestb5e19ee240ab
@azure/msal-node@5.0.2
7.1.0

Open the chart page →

1,434
uptime-kumarubxkubeVerified publisher1.2.11 of 1See more

uptime-kuma rubxkube 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.4.091e963bfda56
@azure/msal-node@5.2.2
7.1.0

Open the chart page →

42,648
etherpadschoenwald0.4.11 of 1See more

etherpad schoenwald 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
etherpad/etherpad:3.3.698d395769b3b
@azure/msal-node@6.0.1
7.1.0

Open the chart page →

459
uptime-kumaschoenwald1.0.101 of 1See more

uptime-kuma schoenwald 1.0.10

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
@azure/msal-node@5.6.0
7.1.0

Open the chart page →

42,448
infisicalsinextraVerified publisher0.7.21 of 1See more

infisical sinextra 0.7.2

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
infisical/infisical:v0.166.8bb8352b71cea
@azure/msal-node@6.0.1
7.1.0

Open the chart page →

3,458
thanhvt27-lab-k8sthanh-vtVerified publisher0.1.41 of 5See more

thanhvt27-lab-k8s thanh-vt 0.1.4

1 of the 5 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
redis/redisinsight:latestb5e19ee240ab
@azure/msal-node@5.0.2
7.1.0

Open the chart page →

6,202
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
@azure/msal-node@5.2.4
7.1.0

Open the chart page →

7,005
devportalveecode-platform-nextVerified publisher1.1.21 of 1See more

devportal veecode-platform-next 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinned726cc70543dd
@azure/msal-node@5.2.5
7.1.0

Open the chart page →

1,769
twenty-crmvictorlane0.0.11 of 3See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-109461.

Container imageDigestPackageFixed in
twentycrm/twenty:latest91793759486e
@azure/msal-node@5.2.4
7.1.0

Open the chart page →

72,567

Container images carrying it

39 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
redis/redisinsight:3.8:latestb5e19ee240ab
@azure/msal-node@5.0.2
7.1.0
4
decisionrules/server:latest6f6d024a87b8
@azure/msal-node@5.5.0
7.1.0
3
infisical/infisical:latest:v0.167.0dbc5be2079b6
@azure/msal-node@6.0.1
7.1.0
2
louislam/uptime-kuma:2.5.69912da7d7d9b
@azure/msal-node@5.6.0
7.1.0
2
louislam/uptime-kuma:2.3.29aeb4e51d038
@azure/msal-node@5.1.5
7.1.0
2
n8nio/n8n:2.36.714c4285bc303
@azure/msal-node@5.1.5
7.1.0
2
budibase/apps:3.41.344fe6feab985
@azure/msal-node@5.4.3
7.1.0
1
dbgate/dbgate:7.2.0-alpine287077002446
@azure/msal-node@5.2.3
7.1.0
1
dbgate/dbgate:7.2.3f2dc7423ea88
@azure/msal-node@5.4.1
7.1.0
1
decisionrules/server:latestbb3a93224b5a
@azure/msal-node@5.5.0
7.1.0
1
etherpad/etherpad:latest3d59d633d285
@azure/msal-node@6.0.1
7.1.0
1
etherpad/etherpad:3.3.6:latest98d395769b3b
@azure/msal-node@6.0.1
7.1.0
1
infisical/infisical:v0.166.8bb8352b71cea
@azure/msal-node@6.0.1
7.1.0
1
journeyapps/powersync-service:latest15b8e4dbbab1
@azure/msal-node@5.1.1
7.1.0
1
louislam/uptime-kuma:2.5.6-slim5db97dbbef61
@azure/msal-node@5.6.0
7.1.0
1
louislam/uptime-kuma:2.5.4917318f9d7be
@azure/msal-node@5.6.0
7.1.0
1
louislam/uptime-kuma:2.4.091e963bfda56
@azure/msal-node@5.2.2
7.1.0
1
louislam/uptime-kuma:2.5.0a8610b3b4c38
@azure/msal-node@5.4.0
7.1.0
1
louislam/uptime-kuma:2.5.5c74379ac4509
@azure/msal-node@5.6.0
7.1.0
1
louislam/uptime-kuma:2.5.1ecd5b8c8b49f
@azure/msal-node@5.5.0
7.1.0
1
makeplane/silo-commercial:v3.3.312c33418c1ec
@azure/msal-node@5.5.0
7.1.0
1
n8nio/n8n:2.41.687e0bab2c931
@azure/msal-node@5.1.5
7.1.0
1
n8nio/n8n:2.45.3bf88c3783fc4
@azure/msal-node@5.1.5
7.1.0
1
n8nio/n8n:2.44.4c72fa9f1bd9b
@azure/msal-node@5.1.5
7.1.0
1
n8nio/n8n:2.36.8cfe2704ff858
@azure/msal-node@5.1.5
7.1.0
1
oneuptime/nginx:release64cc9c60a76a
@azure/msal-node@5.5.0
7.1.0
1
oneuptime/probe:releasedd75b4631455
@azure/msal-node@5.5.0
7.1.0
1
oneuptime/runner:releasea99da95a0490
@azure/msal-node@5.5.0
7.1.0
1
redis/redisinsight:3.2.055542a762210
@azure/msal-node@5.0.2
7.1.0
1
redis/redisinsight:3.485562d67a912
@azure/msal-node@5.0.2
7.1.0
1
rocketadmin/rocketadmin:1.23.70bd1abb0bfd1
@azure/msal-node@5.1.3
7.1.0
1
twentycrm/twenty:v2.49.080e1b33b0b4b
@azure/msal-node@5.2.4
7.1.0
1
twentycrm/twenty:latest91793759486e
@azure/msal-node@5.2.4
7.1.0
1
twentycrm/twenty:v2.22.0e7d9948bf284
@azure/msal-node@5.2.4
7.1.0
1
veecode/devportal726cc70543dd
@azure/msal-node@5.2.5
7.1.0
1
ghcr.io/backstage/backstage:latest68f2025a3f27
@azure/msal-node@6.0.1
7.1.0
1
ghcr.io/quenchworks/images/uptime-kuma76bb9db001b0
@azure/msal-node@5.6.0
7.1.0
1
ghcr.io/wekan/wekan:v12.635a9fc6933d5a
@azure/msal-node@6.0.1
7.1.0
1
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
@azure/msal-node@5.5.0
7.1.0
1

syft 1.42.1 · advisories as of 24 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.