CVE-2026-110306
MediumAdvisory
Published 23 Oct 2026In the index since 24 Oct 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.1
- base score, highest
- EPSS
- 0.002
- 10th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 201
- of 18,232 indexed, latest versions
- Container images
- 196
- deployed by those charts
- Fix available
- 1 of 1
- affected package
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
Carried by container images the latest versions of 201 of 18,232 indexed charts deploy, on 196 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| fast-urinpm | 2.1.0, 2.2.0, 2.3.0, 2.4.0+15 more | 2.4.8, 3.1.9, 4.2.3 | 196 |
- OSV records
- GHSA-w74x-v6f9-j3xg
Charts affected
201 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| immichimmich-helmVerified publisher | 0.5.1 | 1 of 4See more | 10,531 |
| keycloak-reporterkeycloak-reporterVerified publisher | 1.4.17 | 1 of 1See more | 1,114 |
| n8nklicktippVerified publisher | 1.12.0 | 1 of 1See more | 577 |
| chibisafel4gVerified publisher | 0.1.1 | 1 of 3See more | 4,094 |
| stackradarlockdepVerified publisher | 0.2.0 | 1 of 4See more | 6,001 |
| plane-enterprisemakeplaneOfficialVerified publisher | 3.10.12 | 3 of 13See more | 7,782 |
| n8nn8n-helm | 2.25.7 | 1 of 1See more | 4,424 |
| observability-mcpobservability-mcpOfficialVerified publisher | 2.9.15 | 1 of 2See more | 68 |
| growthbookone-acre-fundVerified publisher | 0.3.0 | 1 of 3See more | 1,642 |
| openclawopenclaw-helm-chartVerified publisher | 1.0.70 | 1 of 3See more | 2,448 |
| portraitportraitVerified publisher | 0.2.13 | 1 of 8See more | 96,248 |
| psa-restricted-patcherpsa-restricted-patcherVerified publisher | 0.10.1 | 1 of 1See more | 1,652 |
| rocketadminrocketadminOfficialVerified publisher | 1.0.43 | 1 of 1See more | 27,427 |
| immichsecustorVerified publisher | 2.0.12 | 1 of 1See more | 3,170 |
| karakeepself-hosters-by-nightVerified publisher | 2.5.1 | 1 of 1See more | 6,484 |
| vuiseriohub | 1.0.6 | 1 of 3See more | 14,037 |
| supabasesupabse | 0.8.0 | 3 of 11See more | 56,496 |
| tenuretenureVerified publisher | 1.0.6 | 1 of 2See more | 3,740 |
| unitycatalogunitycatalogVerified publisher | 0.0.2 | 1 of 4See more | 73,241 |
| wraftwraft | 0.1.12 | 1 of 9See more | 6,239 |
| trifidzazukoOfficialVerified publisher | 0.2.1 | 1 of 1See more | 681 |
| adeptia-automate-mcpadeptia-automate-mcp | 1.0.0 | 2 of 2See more | 4,558 |
| activepiecesadnoctemVerified publisher | 0.7.2 | 1 of 1See more | 2,151 |
| outlineadnoctemVerified publisher | 0.1.3 | 1 of 1See more | 1,757 |
| turborepo-remote-cacheadriantr | 1.1.1 | 1 of 1See more | 894 |
| akeyless-gatewayakeyless-services-helmVerified publisher | 3.8.5 | 1 of 2See more | 1,589 |
| browserlessalekcVerified publisher | 1.3.3 | 1 of 1See more | 1,348 |
| zigbee2mqttalekcVerified publisher | 1.0.2 | 1 of 2See more | 108 |
| lametric-nightscout-proxyaolde | 0.1.0 | 1 of 1See more | 1,438 |
| arith-tsarith-tsVerified publisher | 1.1.0 | 1 of 1See more | 29 |
| immichbear | 0.1.1 | 1 of 2See more | 8,756 |
| bluerange-mosquittobluerangeOfficialVerified publisher | 1.1.0 | 1 of 1See more | 354 |
| colosseumbook-k8sinfra-v2 | 1.0.18 | 2 of 5See more | 141,199 |
| openmctbryopsida | 0.1.1 | 1 of 1See more | 1,500 |
| openclawcabrera-evil-chartsVerified publisher | 0.1.1 | 1 of 1See more | 2,496 |
| dv-podcharonOfficialVerified publisher | 0.20.0 | 1 of 5See more | 5,068 |
| ghostchart-ghost | 0.1.7 | 1 of 2See more | 1,377 |
| mcp-for-argocdchristianhuthVerified publisher | 2.0.0 | 1 of 1See more | 2,375 |
| kamaji-consoleclastixVerified publisher | 0.1.3 | 1 of 1See more | 3,514 |
| cortezacorteza | 1.1.0 | 1 of 3See more | 10,587 |
| authfcryptexlabsVerified publisher | 0.12.13 | 1 of 4See more | 4,186 |
| decisionrules-aksdecisionrules-aksOfficialVerified publisher | 0.3.0 | 1 of 2See more | 606 |
| decisionrules-eksdecisionrules-eksOfficialVerified publisher | 0.4.0 | 1 of 2See more | 606 |
| decisionrules-ingressdecisionrules-ingressOfficialVerified publisher | 0.3.0 | 1 of 2See more | 606 |
| decisionrules-ocpdecisionrules-ocpOfficialVerified publisher | 0.2.1 | 1 of 4See more | 2,201 |
| dial-admindialVerified publisher | 0.20.0 | 1 of 3See more | 3,857 |
| node-reddjdl-charts | 0.33.0 | 1 of 1See more | 342 |
| dyff-frontenddyff-frontendVerified publisher | 0.21.3 | 1 of 1See more | 1,364 |
| openclaweasy-openclaw | 0.1.0 | 1 of 1See more | 2,448 |
| node-redegebackVerified publisher | 2.0.13 | 1 of 1See more | 1,658 |
Container images carrying it
196 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| flanksource/ | 2bb089c79fc0 | fast-uri | 3.1.9 | 1 |
| flanksource/ | 8d17f0c08b20 | fast-uri | 3.1.9 | 1 |
| ghostfolio/ | 256c524a6116 | fast-uri | 3.1.9 | 1 |
| ghostfolio/ | e3c6ab53e49b | fast-uri | 3.1.9 | 1 |
| gorules/ | 23b5efdea938 | fast-uri | 3.1.9 | 1 |
| growthbook/ | c8a124f55dca | fast-uri | 3.1.9 | 1 |
| growthbook/ | dca716a7bf47 | fast-uri | 3.1.9 | 1 |
| haohanyang/ | 54f2112602ee | fast-uri | 3.1.9 | 1 |
| haohanyang/ | f4f8fe4e21f1 | fast-uri | 3.1.9 | 1 |
| hecrom/ | 5454b54d5b28 | fast-uri | 3.1.9 | 1 |
| helmforge/ | 5a6c2c449840 | fast-uri | 3.1.9 | 1 |
| hirosystems/ | 9c98b23c1515 | fast-uri | 2.4.8 | 1 |
| hoppscotch/ | 3160f5b3acf4 | fast-uri | 3.1.9 | 1 |
| infisical/ | bb8352b71cea | fast-uri | 3.1.9 | 1 |
| journeyapps/ | 15b8e4dbbab1 | fast-uri | 3.1.9 | 1 |
| kitware/ | 6fab5f5ec6f2 | fast-uri | 3.1.9 | 1 |
| koenkk/ | 60a295b40f4e | fast-uri | 3.1.9 | 1 |
| langgenius/ | c306ac577912 | fast-uri | 3.1.9 | 1 |
| leonardomulticloud/ | e42a341e0299 | fast-uri | 3.1.9 | 1 |
| library/ | 1ef2e532ca4d | fast-uri | 3.1.9 | 1 |
| library/ | 29773d6be407 | fast-uri | 3.1.9 | 1 |
| library/ | 8e07c5ec63d9 | fast-uri | 3.1.9 | 1 |
| library/ | c0d83a8d4522 | fast-uri | 3.1.9 | 1 |
| library/ | db4c56c196d6 | fast-uri | 3.1.9 | 1 |
| library/ | 4116dd6a5838 | fast-uri | 3.1.9 | 1 |
| lissy93/ | 5e4feb4acbd5 | fast-uri | 3.1.9 | 1 |
| makeplane/ | fab034a2be8c | fast-uri | 3.1.9 | 1 |
| makeplane/ | 12c33418c1ec | fast-uri | 3.1.9 | 1 |
| makeplane/ | c4a6236c4080 | fast-uri | 3.1.9 | 1 |
| mautic/ | eb8cc73d97e1 | fast-uri | 3.1.9 | 1 |
| mcp/ | 5ffbf7f0a8aa | fast-uri | 3.1.9 | 1 |
| mintproject/ | 222e3b941a36 | fast-uri | 3.1.9 | 1 |
| mitre/ | 06f6e72d416a | fast-uri | 3.1.9 | 1 |
| n8nio/ | 761374d4eb84 | fast-uri | 3.1.9 | 1 |
| n8nio/ | 87e0bab2c931 | fast-uri | 3.1.9 | 1 |
| n8nio/ | 8b39ed5a2de9 | fast-uri | 3.1.9 | 1 |
| n8nio/ | bf88c3783fc4 | fast-uri | 3.1.9 | 1 |
| n8nio/ | c72fa9f1bd9b | fast-uri | 3.1.9 | 1 |
| n8nio/ | cfe2704ff858 | fast-uri | 3.1.9 | 1 |
| n8nio/ | ed16e560c40e | fast-uri | 3.1.9 | 1 |
| neoskop/ | 326a4d2db1c9 | fast-uri | 3.1.9 | 1 |
| netrisai/ | 6e865080e86c | fast-uri | 3.1.9 | 1 |
| nocodb/ | 6779a4ddedf2 | fast-uri | 3.1.9 | 1 |
| nocodb/ | d9516f0bf546 | fast-uri | 3.1.9 | 1 |
| nocodb/ | e8fee91b205b | fast-uri | 3.1.9 | 1 |
| nodered/ | 10f40d0a83e7 | fast-uri | 3.1.9 | 1 |
| nodered/ | 216e7403aab9 | fast-uri | 3.1.9 | 1 |
| nodered/ | b5adb6c9dd29 | fast-uri | 3.1.9 | 1 |
| nodered/ | d73ae167cb9b | fast-uri | 3.1.9 | 1 |
| obolnetwork/ | 87902178f0e7 | fast-uri | 3.1.9 | 1 |