StackRadar

CVE-2026-112907

Low

Advisory

Published 23 Oct 2026In the index since 24 Oct 2026
Severity
Low
worst across findings
CVSS
2.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
92
of 18,232 indexed, latest versions
Container images
90
deployed by those charts
Fix available
1 of 1
affected package

filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

Carried by container images the latest versions of 92 of 18,232 indexed charts deploy, on 90 images.

Affected packageAffected versionsFixed inImages
filelockpypi3.25.0, 3.25.1, 3.25.2, 3.29.0+19 more4.2.190
OSV records
GHSA-567q-5qvw-pf92

Charts affected

92 by stars
ChartLatestAffected imagesRadar Score
dagsterdagsterVerified publisher1.13.262 of 5See more

dagster dagster 1.13.26

2 of the 5 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
dagster/dagster-celery-k8s:1.13.26605d41ae6647
filelock@4.1.0
4.2.1
dagster/user-code-example:1.13.265c98e09b2aeb
filelock@4.1.0
4.2.1

Open the chart page →

4,324
datahubdatahubVerified publisher1.1.81 of 4See more

datahub datahub 1.1.8

1 of the 4 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
acryldata/datahub-actions:v1.8.0d9b47e8640ea
filelock@3.32.7
4.2.1

Open the chart page →

867
weblateweblateOfficialVerified publisher0.5.441 of 3See more

weblate weblate 0.5.44

1 of the 3 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
weblate/weblate:2026.10.1.26663a7c8b444
filelock@4.0.12
4.2.1

Open the chart page →

8,034
difydify-helmVerified publisher0.39.01 of 11See more

dify dify-helm 0.39.0

1 of the 11 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
langgenius/dify-agent-backend:1.17.0bdb2ed516bd3
filelock@3.29.0
4.2.1

Open the chart page →

64,891
litellm-helmlitellm1.106.21 of 2See more

litellm-helm litellm 1.106.2

1 of the 2 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm:1.106.27294b90f868c
filelock@3.32.7
4.2.1

Open the chart page →

5,544
paperless-ngxpaperless-ngxVerified publisher0.3.251 of 3See more

paperless-ngx paperless-ngx 0.3.25

1 of the 3 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.3dba0242c1df1
filelock@4.0.12
4.2.1

Open the chart page →

10,438
home-assistantandrenarchyVerified publisher14.104.01 of 1See more

home-assistant andrenarchy 14.104.0

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
filelock@3.32.6
4.2.1

Open the chart page →

4,398
dagster-user-deploymentsdagsterVerified publisher1.13.261 of 1See more

dagster-user-deployments dagster 1.13.26

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
dagster/user-code-example:1.13.265c98e09b2aeb
filelock@4.1.0
4.2.1

Open the chart page →

856
zenmlzenml0.98.01 of 1See more

zenml zenml 0.98.0

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
zenmldocker/zenml-server:0.98.06a03880ace49
filelock@4.1.1
4.2.1

Open the chart page →

1,390
changedetectionalekcVerified publisher0.14.71 of 1See more

changedetection alekc 0.14.7

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.904eaae7915ba
filelock@3.32.7
4.2.1

Open the chart page →

3,129
flyte-binaryflyte2.0.521 of 4See more

flyte-binary flyte 2.0.52

1 of the 4 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
filelock@3.29.0
4.2.1

Open the chart page →

45,483
nacosgujunxiang0.1.51 of 1See more

nacos gujunxiang 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
nacos/nacos-server:latest1c191c30c8cd
filelock@3.32.4
4.2.1

Open the chart page →

3,279
simple-krr-dashboardhelm-simple-krr-dashboardVerified publisher1.6.21 of 3See more

simple-krr-dashboard helm-simple-krr-dashboard 1.6.2

1 of the 3 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/devops-ia/simple-krr-dashboard:1.6.34c625eff5410
filelock@3.32.5
4.2.1

Open the chart page →

3,659
home-assistanthome-assistantVerified publisher0.5.141 of 3See more

home-assistant home-assistant 0.5.14

1 of the 3 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.233afb0659d78
filelock@4.2.0
4.2.1

Open the chart page →

4,129
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
filelock@3.25.0
4.2.1

Open the chart page →

6,889
machinarislib42Verified publisher0.2.01 of 1See more

machinaris lib42 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/guydavis/machinaris:testf77fa53b89cb
filelock@3.32.7
4.2.1

Open the chart page →

26,707
observalobservalVerified publisher1.15.11 of 8See more

observal observal 1.15.1

1 of the 8 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/observal/observal-api:1.15.1e40d18a3a739
filelock@3.29.0
4.2.1

Open the chart page →

6,921
skypilotskypilotOfficialVerified publisher0.14.11 of 3See more

skypilot skypilot 0.14.1

1 of the 3 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot:0.14.125577df35586
filelock@4.1.0
4.2.1

Open the chart page →

7,122
paperlesszekker6Verified publisher11.15.01 of 1See more

paperless zekker6 11.15.0

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.49bc6e8248891
filelock@4.0.12
4.2.1

Open the chart page →

5,588
paperless-ngxadnoctemVerified publisher0.5.11 of 5See more

paperless-ngx adnoctem 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
filelock@4.0.12
4.2.1

Open the chart page →

33,726
agentareaagentareaVerified publisher0.0.292 of 17See more

agentarea agentarea 0.0.29

2 of the 17 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
agentarea/agentarea-api:0.1.1de166c910ef9
filelock@3.25.1
4.2.1
agentarea/agentarea-worker:0.1.1adb761a4d103
filelock@3.25.1
4.2.1

Open the chart page →

13,394
music-assistantbdclark-helm-chartsVerified publisher0.4.151 of 1See more

music-assistant bdclark-helm-charts 0.4.15

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
filelock@4.2.0
4.2.1

Open the chart page →

5,760
nacosbytectl0.1.61 of 1See more

nacos bytectl 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
nacos/nacos-server:latest1c191c30c8cd
filelock@3.32.4
4.2.1

Open the chart page →

3,279
squestchristianhuthVerified publisher7.0.41 of 4See more

squest christianhuth 7.0.4

1 of the 4 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
filelock@3.25.2
4.2.1

Open the chart page →

5,373
dagster-cloud-agentdagster-cloudVerified publisher1.13.261 of 1See more

dagster-cloud-agent dagster-cloud 1.13.26

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
dagster/dagster-cloud-agent:1.13.26c9320c34f7ed
filelock@3.32.4
4.2.1

Open the chart page →

1,407
aibrixdanchevVerified publisher0.8.01 of 5See more

aibrix danchev 0.8.0

1 of the 5 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
aibrix/metadata-service:v0.8.058b915e3708d
filelock@3.32.7
4.2.1

Open the chart page →

7,030
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latest33afb0659d78
filelock@4.2.0
4.2.1

Open the chart page →

3,855
obicogabe565Verified publisher0.6.01 of 3See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/gabe565/obico/web:latest6acb4a5903eb
filelock@4.0.9
4.2.1

Open the chart page →

2,913
growthbookgrowthbook5.1.01 of 2See more

growthbook growthbook 5.1.0

1 of the 2 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
growthbook/growthbook:5.1.0c8a124f55dca
filelock@3.32.7
4.2.1

Open the chart page →

1,554
langflow-idelangflow0.1.21 of 2See more

langflow-ide langflow 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
langflowai/langflow:latesta0396e089eb9
filelock@3.32.0
4.2.1

Open the chart page →

5,289
langflow-runtimelangflow0.1.11 of 1See more

langflow-runtime langflow 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
langflowai/langflow:latesta0396e089eb9
filelock@3.32.0
4.2.1

Open the chart page →

861
home-assistantloeken-at-homeVerified publisher2026.9.21 of 1See more

home-assistant loeken-at-home 2026.9.2

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
loeken/home-assistant:2026.9.2b1dff5b4c593
filelock@3.32.6
4.2.1

Open the chart page →

3,201
growthbookone-acre-fundVerified publisher0.3.01 of 3See more

growthbook one-acre-fund 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
growthbook/growthbook:latestdca716a7bf47
filelock@3.32.7
4.2.1

Open the chart page →

1,642
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.61 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.6

1 of the 34 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.1.0-chatbot604b1f493c92
filelock@3.29.3
4.2.1

Open the chart page →

29,432
paperless-ngxpaperlessVerified publisher0.4.11 of 3See more

paperless-ngx paperless 0.4.1

1 of the 3 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngxdigest-pinned9bc6e8248891
filelock@4.0.12
4.2.1

Open the chart page →

10,012
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
treskon/portrait-pythonruntime:DEV-latest694c098bcb52
filelock@3.32.3
4.2.1

Open the chart page →

96,248
rstudio-pmrstudioVerified publisher0.20.71 of 1See more

rstudio-pm rstudio 0.20.7

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
posit/package-manager:2026.10.0-ubuntu-24.04574ed7ec955f
filelock@4.1.1
4.2.1

Open the chart page →

24,894
sceptresceptreai0.1.121 of 5See more

sceptre sceptreai 0.1.12

1 of the 5 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
maponyacharles/sceptreai:api-0.1.127b37b092130a
filelock@3.32.2
4.2.1

Open the chart page →

7,183
securosecuroVerified publisher0.16.51 of 4See more

securo securo 0.16.5

1 of the 4 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/securo-finance/securo-backend:0.16.50e40c6858fb3
filelock@3.32.2
4.2.1

Open the chart page →

4,488
switcher-slack-appswitcherapiOfficialVerified publisher1.1.51 of 1See more

switcher-slack-app switcherapi 1.1.5

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
trackerforce/switcher-slack-app:latest410e58e54e09
filelock@4.0.12
4.2.1

Open the chart page →

102
qleverzazukoVerified publisher0.7.21 of 2See more

qlever zazuko 0.7.2

1 of the 2 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/zazukoians/qlever-server:v0.10.39f553deb16a5
filelock@4.0.10
4.2.1

Open the chart page →

2,816
airbyteairbyte-v2Verified publisher2.4.01 of 10See more

airbyte airbyte-v2 2.4.0

1 of the 10 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
airbyte/manifest-server:7.28.2deec511b51c3
filelock@3.32.3
4.2.1

Open the chart page →

16,214
akto-ai-guardrails-v2akto0.3.02 of 6See more

akto-ai-guardrails-v2 akto 0.3.0

2 of the 6 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
aktosecurity/akto-agent-guard-anonymizer:1.1.4d4b100cbdc47
filelock@3.29.7
4.2.1
aktosecurity/akto-agent-guard-embedder:1.1.4dbc566b2376c
filelock@3.29.0
4.2.1

Open the chart page →

53,517
akto-mini-testingakto1.47.01 of 5See more

akto-mini-testing akto 1.47.0

1 of the 5 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-ai-automated-testing:latest3fde5f4a0c1d
filelock@3.32.7
4.2.1

Open the chart page →

5,663
akto-regional-setupakto1.4.122 of 9See more

akto-regional-setup akto 1.4.12

2 of the 9 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
aktosecurity/akto-agent-guard-anonymizer:1.2.2212328d85f87
filelock@4.0.8
4.2.1
aktosecurity/akto-agent-guard-embedder:1.2.26d90b501493b
filelock@3.32.3
4.2.1

Open the chart page →

35,113
litellmalareira0.3.01 of 1See more

litellm alareira 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm:main-stable7294b90f868c
filelock@3.32.7
4.2.1

Open the chart page →

277
esphomealekcVerified publisher2.10.01 of 1See more

esphome alekc 2.10.0

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
esphome/esphome:2026.10.03a32372dfbd6
filelock@4.0.10
4.2.1

Open the chart page →

4,253
music-assistant-serverandibraeuVerified publisher2.1.71 of 1See more

music-assistant-server andibraeu 2.1.7

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
filelock@4.2.0
4.2.1

Open the chart page →

5,760
argonix-apiargonix0.6.51 of 4See more

argonix-api argonix 0.6.5

1 of the 4 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
ghcr.io/argonix-io/argonix-api:0.6.5431abcce7c1e
filelock@4.0.12
4.2.1

Open the chart page →

7,438
wyoming-piperbdclark-helm-chartsVerified publisher0.1.41 of 1See more

wyoming-piper bdclark-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-112907.

Container imageDigestPackageFixed in
rhasspy/wyoming-piper:2.5.27d39aafac409
filelock@3.32.6
4.2.1

Open the chart page →

1,591

Container images carrying it

90 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
sslhep/servicex_code_gen_raw_uproot:v1.8.61494a81a474b
filelock@3.32.7
4.2.1
1
sslhep/servicex_code_gen_topcp:v1.8.6f7faf8c6c3e4
filelock@3.32.7
4.2.1
1
sslhep/servicex-did-finder:v1.8.6e15e68307d33
filelock@3.32.7
4.2.1
1
sslhep/servicex-did-finder-atlasopenmagic:v1.8.6bd738c952e72
filelock@3.32.7
4.2.1
1
sslhep/servicex-did-finder-cernopendata:v1.8.623a80e40ab18
filelock@3.32.7
4.2.1
1
sslhep/servicex-did-finder-xrootd:v1.8.69a9fb17458f1
filelock@3.32.7
4.2.1
1
sslhep/x509-secrets:v1.8.634e1c87cea8a
filelock@3.29.6
4.2.1
1
tombursch/kitchenowl-backend:v0.7.104a7ed693531b
filelock@3.32.0
4.2.1
1
trackerforce/switcher-slack-app:latest410e58e54e09
filelock@4.0.12
4.2.1
1
treskon/portrait-pythonruntime:DEV-latest694c098bcb52
filelock@3.32.3
4.2.1
1
upstreamyard/nemo-guardrails:0.24.19f673183cfc0
filelock@3.29.4
4.2.1
1
weblate/weblate:2026.10.1.26663a7c8b444
filelock@4.0.12
4.2.1
1
zenmldocker/zenml-server:0.98.06a03880ace49
filelock@4.1.1
4.2.1
1
zooproject/zoo-project:dru-e150308e13ba5e922d16e0eaef6547d60ffb2a40d05f09b1b46d
filelock@4.1.0
4.2.1
1
ghcr.io/argonix-io/argonix-api:0.6.5431abcce7c1e
filelock@4.0.12
4.2.1
1
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latesta62ce2221b43
filelock@3.32.7
4.2.1
1
ghcr.io/devops-ia/simple-krr-dashboard:1.6.34c625eff5410
filelock@3.32.5
4.2.1
1
ghcr.io/esphome/esphome:latest776a845d5089
filelock@3.32.4
4.2.1
1
ghcr.io/esphome/esphome:2026.7.4e636269c6390
filelock@3.32.0
4.2.1
1
ghcr.io/gabe565/obico/web:latest6acb4a5903eb
filelock@4.0.9
4.2.1
1
ghcr.io/guydavis/machinaris:testf77fa53b89cb
filelock@3.32.7
4.2.1
1
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
filelock@3.25.0
4.2.1
1
ghcr.io/home-assistant/home-assistant:2026.10.1130241f28d01
filelock@4.1.0
4.2.1
1
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
filelock@3.32.6
4.2.1
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
filelock@3.25.0
4.2.1
1
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
filelock@3.29.0
4.2.1
1
ghcr.io/music-assistant/server:2.10.645fdb050e069
filelock@4.0.12
4.2.1
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
filelock@3.29.0
4.2.1
1
ghcr.io/observal/observal-api:1.15.1e40d18a3a739
filelock@3.29.0
4.2.1
1
ghcr.io/open-telemetry/demo:3.1.0-chatbot604b1f493c92
filelock@3.29.3
4.2.1
1
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
filelock@3.32.0
4.2.1
1
ghcr.io/runwhen-contrib/runwhen-local:0.12.4914e75d9f445
filelock@4.1.0
4.2.1
1
ghcr.io/securo-finance/securo-backend:0.16.50e40c6858fb3
filelock@3.32.2
4.2.1
1
ghcr.io/vinny1892/octantis:latest45459c0910fc
filelock@3.25.2
4.2.1
1
ghcr.io/zazukoians/qlever-server:v0.10.39f553deb16a5
filelock@4.0.10
4.2.1
1
public.ecr.aws/aktosecurity/akto-ai-automated-testing:latest3fde5f4a0c1d
filelock@3.32.7
4.2.1
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
filelock@3.29.0
4.2.1
1
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
filelock@3.25.2
4.2.1
1
quay.io/kubev2v/forklift-operator:release-2.12c879733fd77e
filelock@3.32.0
4.2.1
1
registry.gitlab.com/xrow-public/ci-tools/tools:main90a7a94db2b0
filelock@4.1.0
4.2.1
1

syft 1.42.1 · advisories as of 24 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.