StackRadar

CVE-2026-111748

Medium

Advisory

Published 20 Oct 2026In the index since 21 Oct 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.004
29th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
247
of 18,208 indexed, latest versions
Container images
241
deployed by those charts
Fix available
1 of 2
affected packages

AIOHTTP: Absolute-form request targets can spoof Request.scheme

Carried by container images the latest versions of 247 of 18,208 indexed charts deploy, on 241 images.

Affected packageAffected versionsFixed inImages
aiohttppypi3.4.4, 3.5.1, 3.5.4, 3.6.2+37 more3.14.4241
python-aiohttpdeb3.8.4-1, 3.11.16-1+deb13u1no fix listed2
OSV records
DEBIAN-CVE-2026-111748GHSA-f9xw-jh8m-3mwq

Charts affected

247 by stars
ChartLatestAffected imagesRadar Score
authentikgoauthentikOfficialVerified publisher2026.8.41 of 1See more

authentik goauthentik 2026.8.4

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.8.4e7226ae116da
aiohttp@3.14.3
3.14.4

Open the chart page →

1,374
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
aiohttp@3.9.3
3.14.4

Open the chart page →

13,033
mlflowcommunity-chartsVerified publisher1.11.71 of 1See more

mlflow community-charts 1.11.7

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
burakince/mlflow:3.16.0ab4b566644b9
aiohttp@3.14.3
3.14.4

Open the chart page →

1,190
datahubdatahubVerified publisher1.1.71 of 4See more

datahub datahub 1.1.7

1 of the 4 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
acryldata/datahub-actions:v1.7.0.1c5fd70130157
aiohttp@3.14.3
3.14.4

Open the chart page →

1,747
stackgres-operatorstackgres-chartsOfficialVerified publisher1.19.31 of 2See more

stackgres-operator stackgres-charts 1.19.3

1 of the 2 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
quay.io/stackgres/operator:1.19.37fdfd631a281
aiohttp@3.14.1
3.14.4

Open the chart page →

3,317
difydify-helmVerified publisher0.39.01 of 11See more

dify dify-helm 0.39.0

1 of the 11 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
langgenius/dify-api:1.17.052be6088dd84
aiohttp@3.14.3
3.14.4

Open the chart page →

63,506
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
aiohttp@3.8.1
3.14.4

Open the chart page →

9,331
daskdask2024.1.11 of 2See more

dask dask 2024.1.1

1 of the 2 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
aiohttp@3.9.1
3.14.4

Open the chart page →

14,949
litellm-helmlitellm1.106.11 of 2See more

litellm-helm litellm 1.106.1

1 of the 2 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm:1.106.11acf80698f7e
aiohttp@3.14.3
3.14.4

Open the chart page →

5,360
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
aiohttp@3.9.1
3.14.4

Open the chart page →

7,629
ilumilumOfficialVerified publisher6.7.31 of 19See more

ilum ilum 6.7.3

1 of the 19 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
ilum/api:6.7.3624fd09528c8
aiohttp@3.14.1
3.14.4

Open the chart page →

28,438
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
aiohttp@3.11.12
3.14.4

Open the chart page →

21,802
paperless-ngxpaperless-ngxVerified publisher0.3.251 of 3See more

paperless-ngx paperless-ngx 0.3.25

1 of the 3 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.3dba0242c1df1
aiohttp@3.14.3
3.14.4

Open the chart page →

9,536
home-assistantandrenarchyVerified publisher14.104.01 of 1See more

home-assistant andrenarchy 14.104.0

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
aiohttp@3.14.3
3.14.4

Open the chart page →

3,705
cluster-secretclutersecretVerified publisher0.7.01 of 1See more

cluster-secret clutersecret 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
quay.io/clustersecret/clustersecret:0.0.14a9f835d1b241
aiohttp@3.11.11
3.14.4

Open the chart page →

3,426
daskhubdask2024.1.13 of 9See more

daskhub dask 2024.1.1

3 of the 9 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
aiohttp@3.9.1
3.14.4
ghcr.io/dask/dask-gateway-server:2024.1.0881e7acfc5a0
aiohttp@3.9.1
3.14.4
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
aiohttp@3.9.1
3.14.4

Open the chart page →

18,133
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
datamate/seafile-professional:11.0.202dd66b722464
aiohttp@3.12.15
3.14.4

Open the chart page →

84,871
glpiglpi-conteiner0.1.01 of 3See more

glpi glpi-conteiner 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
vdiogov/glpi-conteiner:latest6945f84f0058
aiohttp@3.8.4
python-aiohttp@3.8.4-1
3.14.4
no fix listed

Open the chart page →

13,090
clustersecretpatrungel0.2.01 of 1See more

clustersecret patrungel 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
flag5/clustersecret:0.0.94ad5748bfcc6
aiohttp@3.8.1
3.14.4

Open the chart page →

2,431
alerta-webalerta-webVerified publisher0.1.121 of 2See more

alerta-web alerta-web 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
hayk96/alerta-web:9.0.486377705e9e3
aiohttp@3.10.5
3.14.4

Open the chart page →

4,900
convertigoconvertigoOfficialVerified publisher8.4.61 of 5See more

convertigo convertigo 8.4.6

1 of the 5 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
aiohttp@3.9.5
3.14.4

Open the chart page →

17,635
dask-kubernetes-operatordask2026.3.01 of 1See more

dask-kubernetes-operator dask 2026.3.0

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
aiohttp@3.13.3
3.14.4

Open the chart page →

11,126
deepflowdeepflow6.2.2011 of 8See more

deepflow deepflow 6.2.201

1 of the 8 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
deepflowce/deepflow-app:v6.2.2aa9468ad4d96
aiohttp@3.4.4
3.14.4

Open the chart page →

21,564
flyte-binaryflyte2.0.521 of 4See more

flyte-binary flyte 2.0.52

1 of the 4 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
aiohttp@3.13.5
3.14.4

Open the chart page →

5,118
nacosgujunxiang0.1.51 of 1See more

nacos gujunxiang 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
nacos/nacos-server:latest1c191c30c8cd
aiohttp@3.14.3
3.14.4

Open the chart page →

2,909
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
aiohttp@3.13.3
3.14.4

Open the chart page →

6,252
mlflow-tracking-servermlflow-tracking-serverVerified publisher4.1.01 of 1See more

mlflow-tracking-server mlflow-tracking-server 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
ghcr.io/mlflow-oidc/mlflow-tracking-server:3.16.1-9.0.2-20261001970ba1cc1e69
aiohttp@3.14.3
3.14.4

Open the chart page →

789
observalobservalVerified publisher1.15.11 of 8See more

observal observal 1.15.1

1 of the 8 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
ghcr.io/observal/observal-api:1.15.1e40d18a3a739
aiohttp@3.14.3
3.14.4

Open the chart page →

6,702
skypilotskypilotOfficialVerified publisher0.14.11 of 3See more

skypilot skypilot 0.14.1

1 of the 3 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot:0.14.125577df35586
aiohttp@3.14.3
3.14.4

Open the chart page →

6,484
pretixtechwolf12Verified publisher2026.8.01 of 3See more

pretix techwolf12 2026.8.0

1 of the 3 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
pretix/standalone:2026.8.0ec17c2f761f7
aiohttp@3.14.3
3.14.4

Open the chart page →

10,080
paperlesszekker6Verified publisher11.13.01 of 1See more

paperless zekker6 11.13.0

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
aiohttp@3.14.3
3.14.4

Open the chart page →

5,509
paperless-ngxadnoctemVerified publisher0.5.11 of 5See more

paperless-ngx adnoctem 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
aiohttp@3.14.3
3.14.4

Open the chart page →

27,329
agentareaagentareaVerified publisher0.0.282 of 17See more

agentarea agentarea 0.0.28

2 of the 17 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
agentarea/agentarea-api:0.1.1de166c910ef9
aiohttp@3.14.3
3.14.4
agentarea/agentarea-worker:0.1.1adb761a4d103
aiohttp@3.14.3
3.14.4

Open the chart page →

12,172
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
aiohttp@3.14.3
3.14.4

Open the chart page →

7,885
siemassist-iot-cybersecurity-monitroting-siem0.1.01 of 3See more

siem assist-iot-cybersecurity-monitroting-siem 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_id-wzh:latest0aacefac9677
aiohttp@3.7.4
3.14.4

Open the chart page →

12,617
music-assistantbdclark-helm-chartsVerified publisher0.4.151 of 1See more

music-assistant bdclark-helm-charts 0.4.15

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
aiohttp@3.14.3
3.14.4

Open the chart page →

5,023
easyhaproxybyjgVerified publisher2.0.41 of 1See more

easyhaproxy byjg 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
byjg/easy-haproxy:6.1.1230fdb7b00ae
aiohttp@3.14.1
3.14.4

Open the chart page →

1,283
nacosbytectl0.1.61 of 1See more

nacos bytectl 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
nacos/nacos-server:latest1c191c30c8cd
aiohttp@3.14.3
3.14.4

Open the chart page →

2,909
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
aiohttp@3.8.5
3.14.4

Open the chart page →

13,290
dagster-cloud-agentdagster-cloudVerified publisher1.13.261 of 1See more

dagster-cloud-agent dagster-cloud 1.13.26

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
dagster/dagster-cloud-agent:1.13.26c9320c34f7ed
aiohttp@3.14.3
3.14.4

Open the chart page →

1,334
trivy-operatordevopstalesVerified publisher2.5.01 of 1See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
devopstales/trivy-operator:2.575136aa7a26e
aiohttp@3.8.3
3.14.4

Open the chart page →

6,754
dominodominoVerified publisher0.1.111 of 3See more

domino domino 0.1.11

1 of the 3 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
aiohttp@3.8.3
3.14.4

Open the chart page →

10,138
archerydoubanVerified publisher0.4.31 of 6See more

archery douban 0.4.3

1 of the 6 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
hhyo/archery:v1.9.11aa41843419e
aiohttp@3.8.3
3.14.4

Open the chart page →

8,226
elastalert2elastalert22.31.01 of 1See more

elastalert2 elastalert2 2.31.0

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
jertel/elastalert2:2.31.03cbf63f9b7dc
aiohttp@3.14.2
3.14.4

Open the chart page →

2,402
genesis-generatorethereum-helm-chartsVerified publisher0.2.31 of 2See more

genesis-generator ethereum-helm-charts 0.2.3

1 of the 2 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
skylenet/ethereum-genesis-generator:latest210353ce7c89
aiohttp@3.8.3
3.14.4

Open the chart page →

4,673
obicogabe565Verified publisher0.6.01 of 3See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
ghcr.io/gabe565/obico/web:latest6acb4a5903eb
aiohttp@3.9.1
3.14.4

Open the chart page →

2,399
appdaemongeek-cookbookVerified publisher8.4.21 of 1See more

appdaemon geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
acockburn/appdaemon:4.0.83a93281d7e94
aiohttp@3.7.4
3.14.4

Open the chart page →

3,715
greenkubegreenkubeVerified publisher0.3.01 of 3See more

greenkube greenkube 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
greenkube/greenkube:0.3.00c01932282a4
aiohttp@3.14.3
3.14.4

Open the chart page →

2,201
harp-proxyharp0.8.11 of 1See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
makersquad/harp-proxy:0.8.1a40dd258c527
aiohttp@3.11.18
3.14.4

Open the chart page →

7,017
supersetinseefrlab1.4.01 of 4See more

superset inseefrlab 1.4.0

1 of the 4 container images this version deploys carry CVE-2026-111748.

Container imageDigestPackageFixed in
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
aiohttp@3.7.4
3.14.4

Open the chart page →

9,536

Container images carrying it

241 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
makersquad/harp-proxy:0.8.1a40dd258c527
aiohttp@3.11.18
3.14.4
1
maponyacharles/sceptreai:mlflow-0.1.1242d418654ebd
aiohttp@3.14.3
3.14.4
1
maponyacharles/sceptreai:api-0.1.127b37b092130a
aiohttp@3.14.3
3.14.4
1
mathesar/mathesar:0.12.0091757cb01fe
aiohttp@3.14.1
3.14.4
1
microslac/chat:latest417317e4e4e8
aiohttp@3.9.3
3.14.4
1
milesmcc/shynet:v0.13.1ba54f7797a6b
aiohttp@3.8.1
3.14.4
1
milesmcc/shynet:v0.12.0e821e31140f7
aiohttp@3.8.1
3.14.4
1
mindsdb/mindsdb:latest163011c09299
aiohttp@3.13.5
3.14.4
1
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
aiohttp@3.14.3
3.14.4
1
nousresearch/hermes-agent:v2026.9.24fca358f12efd
aiohttp@3.14.3
3.14.4
1
onyxdotapp/onyx-backend:latest92b8fab500f9
aiohttp@3.14.3
3.14.4
1
opea/asr:1.025dd26d9cd09
aiohttp@3.10.5
3.14.4
1
opea/chatqna:1.038c51b791efa
aiohttp@3.10.5
3.14.4
1
opea/codegen:1.058f91683892d
aiohttp@3.10.5
3.14.4
1
opea/codetrans:1.0e2436483b73d
aiohttp@3.10.5
3.14.4
1
opea/docsum:1.03eaa91849512
aiohttp@3.10.5
3.14.4
1
opea/guardrails-tgi:1.0262c6048aab8
aiohttp@3.10.5
3.14.4
1
opea/guardrails-tgi:latestf68bec6a1271
aiohttp@3.11.11
3.14.4
1
opea/llm-docsum-tgi:1.002f9e8fa5d71
aiohttp@3.10.5
3.14.4
1
opea/speecht5:1.0249afad3d268
aiohttp@3.10.5
3.14.4
1
opea/tts:1.0257ae94709e9
aiohttp@3.10.5
3.14.4
1
opea/web-retriever-chroma:1.0fe08165d7770
aiohttp@3.10.5
3.14.4
1
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
aiohttp@3.12.13
3.14.4
1
opencsghq/csgbot:v0.6.9-ee7d0271e26521
aiohttp@3.10.11
3.14.4
1
opencsghq/csgship-agentic:v0.4.02cd29671a03e
aiohttp@3.12.15
3.14.4
1
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
aiohttp@3.12.15
3.14.4
1
opendatacube/restcube:latest91870111837c
aiohttp@3.6.2
3.14.4
1
opendatacube/wms:latest1b90cdf68831
aiohttp@3.6.2
3.14.4
1
openebs/rawfile-localpv:v0.15.396fd7987ea79
aiohttp@3.14.3
3.14.4
1
openmined/syft-backend:0.9.5b72f74a68b32
aiohttp@3.11.12
3.14.4
1
opennode/waldur-mastermind:8.1.382e8f276c5ed
aiohttp@3.14.3
3.14.4
1
pangeo/base-notebook:2024.01.155fbe688a4f80
aiohttp@3.9.1
3.14.4
1
phntom/email-manager:0.1.22d8e2a9f2f085
aiohttp@3.8.4
3.14.4
1
polyaxon/polyaxon-api:2.17.0163707082036
aiohttp@3.14.3
3.14.4
1
polyaxon/polyaxon-streams:2.17.0a5fec70e757b
aiohttp@3.14.3
3.14.4
1
pretix/standalone:2026.8.0ec17c2f761f7
aiohttp@3.14.3
3.14.4
1
prowlercloud/prowler-api:5.31.14f252d579be2
aiohttp@3.14.0
3.14.4
1
rhasspy/wyoming-speech-to-phrase:1.4.3e532f0dbc6b2
aiohttp@3.13.5
3.14.4
1
rommapp/romm:5.2.03512f2ca4557
aiohttp@3.14.3
3.14.4
1
rommapp/romm:4.4.1b909e95d1aab
aiohttp@3.12.14
3.14.4
1
runx1/opta-agent:latest0ca3867d3200
aiohttp@3.8.1
3.14.4
1
saidsef/scapy-containerised:v2025.02f17f7c435891
aiohttp@3.11.12
3.14.4
1
salehmir/jesse:1.10.101afa95f979e9
aiohttp@3.12.12
3.14.4
1
schmitzis/monorepo:seafile-13.0-latestc583f1be2af2
aiohttp@3.14.3
3.14.4
1
semaphoreui/semaphore:v2.9.645b50bc11833f
aiohttp@3.8.5
3.14.4
1
skylenet/ethereum-genesis-generator:latest210353ce7c89
aiohttp@3.8.3
3.14.4
1
sruthitanneru/pi-sample:ui-lateste565ea454ffd
aiohttp@3.11.8
3.14.4
1
sslhep/servicex-did-finder:v1.8.6e15e68307d33
aiohttp@3.14.3
3.14.4
1
stratospire/activityrelay:0.2.3a4c34cb01117
aiohttp@3.8.3
3.14.4
1
substratusai/verba:v0.4.0-baseURL261695be635eb
aiohttp@3.9.5
3.14.4
1

syft 1.42.1 · advisories as of 21 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.