StackRadar

CVE-2026-113730

Medium

Advisory

Published 21 Oct 2026In the index since 22 Oct 2026
Severity
Medium
worst across findings
CVSS
5.6
base score, highest
EPSS
0.004
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
79
of 18,232 indexed, latest versions
Container images
74
deployed by those charts
Fix available
1 of 1
affected package

OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies

Carried by container images the latest versions of 79 of 18,232 indexed charts deploy, on 74 images.

Affected packageAffected versionsFixed inImages
ognlmaven2.6.5-atlassian-3, 3.0.8, 3.1.2, 3.1.3+21 more3.4.1374
OSV records
GHSA-crwc-vw2r-qr6m

Charts affected

79 by stars
ChartLatestAffected imagesRadar Score
sonarqubesonarqubeVerified publisher10.0.0+5211 of 3See more

sonarqube sonarqube 10.0.0+521

1 of the 3 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
library/sonarqube:10.0.0-communityef9723cf4fe4
ognl@3.3.4
3.4.13

Open the chart page →

7,316
nexus3stevehipwellVerified publisher5.27.01 of 2See more

nexus3 stevehipwell 5.27.0

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
sonatype/nexus3:3.97.0-ubi4a1b19c7efe6
ognl@3.4.4
3.4.13

Open the chart page →

9
guacamoleberyju-org1.4.21 of 3See more

guacamole beryju-org 1.4.2

1 of the 3 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
guacamole/guacamole:1.6.0f344085e618b
ognl@3.4.4
3.4.13

Open the chart page →

4,341
gocdgocdOfficialVerified publisher2.18.11 of 2See more

gocd gocd 2.18.1

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
gocd/gocd-server:v26.1.0720d1012b93f
ognl@3.4.4
3.4.13

Open the chart page →

1,825
sonarqube-ltssonarqubeVerified publisher1.0.16+981 of 4See more

sonarqube-lts sonarqube 1.0.16+98

1 of the 4 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
library/sonarqube:8.9.2-community88cd63154d4b
ognl@3.2.15
3.4.13

Open the chart page →

4,268
camunda-bpm-platformcamunda-community-hub7.6.111 of 1See more

camunda-bpm-platform camunda-community-hub 7.6.11

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
camunda/camunda-bpm-platform:latestbcc5bb0542df
ognl@3.4.2
3.4.13

Open the chart page →

1,507
guacamoledmunozv04Verified publisher0.3.41 of 2See more

guacamole dmunozv04 0.3.4

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
guacamole/guacamole:1.6.0f344085e618b
ognl@3.4.4
3.4.13

Open the chart page →

4,341
crowdatlassian-data-centerVerified publisher2.0.181 of 2See more

crowd atlassian-data-center 2.0.18

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
atlassian/crowd:7.2.43e1e1aa08071
ognl@3.4.11
3.4.13

Open the chart page →

1,553
bambooatlassian-data-centerVerified publisher2.0.181 of 2See more

bamboo atlassian-data-center 2.0.18

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
atlassian/bamboo:12.1.122009b0c8591a
ognl@3.3.5
3.4.13

Open the chart page →

26,156
guacamolehalkeye0.2.11 of 3See more

guacamole halkeye 0.2.1

1 of the 3 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
guacamole/guacamole:1.1.0333a7f40c145
ognl@3.1.16
3.4.13

Open the chart page →

6,756
hertzbeathertzbeatOfficialVerified publisher1.8.11 of 4See more

hertzbeat hertzbeat 1.8.1

1 of the 4 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
apache/hertzbeat:1.8.075d48a62748f
ognl@3.2.6
3.4.13

Open the chart page →

17,020
sonarqube-dcesonarqubeVerified publisher0.1.2+1212 of 5See more

sonarqube-dce sonarqube 0.1.2+121

2 of the 5 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
library/sonarqube:9.1.0-datacenter-search7e43ff493a47
ognl@3.1.26
3.4.13
library/sonarqube:9.1.0-datacenter-appa9bc5a3a1fc3
ognl@3.2.15
3.4.13

Open the chart page →

9,120
nexus3stevehipwell-helm-charts-nexus3Verified publisher5.27.01 of 2See more

nexus3 stevehipwell-helm-charts-nexus3 5.27.0

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
sonatype/nexus3:3.97.0-ubi4a1b19c7efe6
ognl@3.4.4
3.4.13

Open the chart page →

9
flowableflowable-oss7.1.01 of 2See more

flowable flowable-oss 7.1.0

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
flowable/flowable-rest:7.1.0b7ae287502cd
ognl@3.4.2
3.4.13

Open the chart page →

3,023
cbioportalcbioportalOfficialVerified publisher1.1.01 of 1See more

cbioportal cbioportal 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
cbioportal/cbioportal:6.4.1-web-shenandoah08debbd2dbf9
ognl@3.4.3
3.4.13

Open the chart page →

4,354
cert-vaultcert-vaultOfficialVerified publisher2.12.01 of 7See more

cert-vault cert-vault 2.12.0

1 of the 7 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
ghcr.io/gregperlinli/certvault:2.12.0a7d0cc9e260a
ognl@3.4.4
3.4.13

Open the chart page →

19,219
atlas-cmmsf3k-techVerified publisher0.151.51 of 4See more

atlas-cmms f3k-tech 0.151.5

1 of the 4 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
intelloop/atlas-cmms-backend:v1.5.14c61bc3dd3f8
ognl@3.1.12
3.4.13

Open the chart page →

5,562
amgraviteeioVerified publisher4.13.12 of 3See more

am graviteeio 4.13.1

2 of the 3 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
graviteeio/am-gateway:4.13.10168317e2395
ognl@3.3.4
3.4.13
graviteeio/am-management-api:4.13.1b2bd35d38f51
ognl@3.3.4
3.4.13

Open the chart page →

2,249
guacamolehelmforgeVerified publisher1.6.31 of 5See more

guacamole helmforge 1.6.3

1 of the 5 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
guacamole/guacamole:1.6.0f344085e618b
ognl@3.4.4
3.4.13

Open the chart page →

10,806
holoinsightholoinsight0.2.51 of 6See more

holoinsight holoinsight 0.2.5

1 of the 6 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
holoinsight/server:latest88978988756b
ognl@3.1.19
3.4.13

Open the chart page →

30,618
nexusscalified-nexusVerified publisher3.97.01 of 1See more

nexus scalified-nexus 3.97.0

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
sonatype/nexus3:3.97.0772ad5badde0
ognl@3.4.4
3.4.13

Open the chart page →

145
starwhalestarwhaleVerified publisher0.6.151 of 4See more

starwhale starwhale 0.6.15

1 of the 4 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
ghcr.io/star-whale/server:0.6.158368359c8dd0
ognl@3.3.0
3.4.13

Open the chart page →

14,758
streamvisorstreamvisorVerified publisher4.1.61 of 1See more

streamvisor streamvisor 4.1.6

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
ghcr.io/streamvisor/streamvisor:4.1.40bc598b2ac9a
ognl@3.3.4
3.4.13

Open the chart page →

3,443
aktoakto0.2.01 of 7See more

akto akto 0.2.0

1 of the 7 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-dashboard:latest142caa08d1f0
ognl@3.3.5
3.4.13

Open the chart page →

14,725
akto-ai-guardrails-v2akto0.3.01 of 6See more

akto-ai-guardrails-v2 akto 0.3.0

1 of the 6 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
aktosecurity/data-ingestion-service:1.4.946ed5bcb04b2
ognl@3.1.29
3.4.13

Open the chart page →

53,517
akto-central-setupakto1.2.42 of 5See more

akto-central-setup akto 1.2.4

2 of the 5 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-dashboard:1.70.3142caa08d1f0
ognl@3.3.5
3.4.13
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor:1.70.366b0ec8b3de3
ognl@3.3.5
3.4.13

Open the chart page →

5,088
akto-dashboardakto0.1.71 of 1See more

akto-dashboard akto 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
aktosecurity/akto-api-security-dashboard:latest9ef5e8cb6a43
ognl@3.3.5
3.4.13

Open the chart page →

951
akto-dbabsakto0.1.91 of 1See more

akto-dbabs akto 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor:latestb5a1c2601c12
ognl@3.3.5
3.4.13

Open the chart page →

913
akto-regional-setupakto1.4.121 of 9See more

akto-regional-setup akto 1.4.12

1 of the 9 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
aktosecurity/data-ingestion-service:1.6.6dc4b05df83f7
ognl@3.3.5
3.4.13

Open the chart page →

35,113
akto-testing-db-layerakto1.42.171 of 2See more

akto-testing-db-layer akto 1.42.17

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-testing-db-layer:1.74.4_local1ed844ecab29
ognl@3.3.5
3.4.13

Open the chart page →

41,812
data-ingestion-serviceakto0.1.61 of 1See more

data-ingestion-service akto 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
aktosecurity/data-ingestion-servicedigest-pinned213aded7adc5
ognl@3.1.29
3.4.13

Open the chart page →

64,046
axelor-open-suiteaxelor-open-suiteVerified publisher7.2.581 of 2See more

axelor-open-suite axelor-open-suite 7.2.58

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
pmoscode/axelor-open-suite:v7.2.57a58f4d762f5c
ognl@3.2.15
3.4.13

Open the chart page →

10,728
event-store-servicechoerodon0.8.01 of 2See more

event-store-service choerodon 0.8.0

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
choerodon/event-store-service:0.8.03c94c97f6f69
ognl@3.1.12
3.4.13

Open the chart page →

9,901
gocdcloudnativeapp1.9.21 of 2See more

gocd cloudnativeapp 1.9.2

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
gocd/gocd-server:v19.3.02da45cb09d57
ognl@3.1.16
3.4.13

Open the chart page →

9,225
pulsarcnieg1.0.81 of 2See more

pulsar cnieg 1.0.8

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
ognl@3.1.16
3.4.13

Open the chart page →

18,633
shenyuerdeng2.4.211 of 2See more

shenyu erdeng 2.4.21

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
apache/shenyu-admin:2.4.2e8b7c4ddd069
ognl@3.1.2
3.4.13

Open the chart page →

12,775
tekuethereum-helm-chartsVerified publisher1.2.11 of 2See more

teku ethereum-helm-charts 1.2.1

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
consensys/teku:latest19049d6a1e09
ognl@3.3.4
3.4.13

Open the chart page →

564
eximeebpmseximeebpms-k8sOfficialVerified publisher0.4.11 of 1See more

eximeebpms eximeebpms-k8s 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
ghcr.io/eximeebpms/eximeebpms-bpm-platform:run-1.4.00f4a5c0eea07
ognl@3.4.4
3.4.13

Open the chart page →

308
mod-marccatfolio-org0.1.301 of 1See more

mod-marccat folio-org 0.1.30

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
folioci/mod-marccat:latest1b57d690d568
ognl@3.1.15
3.4.13

Open the chart page →

6,993
guacamolegabibbo970.3.01 of 3See more

guacamole gabibbo97 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
guacamole/guacamole:1.3.0739cb6820ae8
ognl@3.1.16
3.4.13

Open the chart page →

8,642
komgageek-cookbookVerified publisher2.4.21 of 1See more

komga geek-cookbook 2.4.2

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
gotson/komga:0.99.49b15ea6bfc30
ognl@3.1.26
3.4.13

Open the chart page →

13,181
gravitino-iceberg-rest-server-helmgravitino-iceberg-rest-server1.3.111 of 1See more

gravitino-iceberg-rest-server-helm gravitino-iceberg-rest-server 1.3.11

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
apache/gravitino-iceberg-rest:1.3.080136ae753ee
ognl@3.2.15
3.4.13

Open the chart page →

5,341
guacamoleguacamole1.0.01 of 4See more

guacamole guacamole 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
guacamole/guacamole:1.6.0f344085e618b
ognl@3.4.4
3.4.13

Open the chart page →

4,754
hapi-fhirhapi-fhirVerified publisher0.1.01 of 1See more

hapi-fhir hapi-fhir 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
polyakov/hapi-fhir-jpaserver-example:latestdbcef69146b8
ognl@3.1.3
3.4.13

Open the chart page →

7,378
jasperreportshelm-dojo8.0.0-v1.31 of 2See more

jasperreports helm-dojo 8.0.0-v1.3

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
palopalepalo/jasperreports:8-v1.356b99b194d20
ognl@3.1.22
3.4.13

Open the chart page →

7,985
nexus3huangchengwu-helm-chart0.1.01 of 1See more

nexus3 huangchengwu-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
sonatype/nexus3:3.53.04bd975493104
ognl@3.2.20
3.4.13

Open the chart page →

4,837
nexusjenkins-x0.1.371 of 1See more

nexus jenkins-x 0.1.37

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
ghcr.io/jenkins-x/nexus:0.1.378caf5289fe73
ognl@3.2.14
3.4.13

Open the chart page →

13,366
xxl-job-adminjoelee2012Verified publisher1.1.01 of 2See more

xxl-job-admin joelee2012 1.1.0

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
xuxueli/xxl-job-admin:2.4.0640093c35fd6
ognl@3.3.4
3.4.13

Open the chart page →

3,595
tapm-componentkubebb5.7.11 of 3See more

tapm-component kubebb 5.7.1

1 of the 3 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
refar/apm-api:v5.7.1241373fa2972
ognl@3.1.19
3.4.13

Open the chart page →

10,487
sonarqubekubesphereVerified publisher6.7.01 of 3See more

sonarqube kubesphere 6.7.0

1 of the 3 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
library/sonarqube:8.9-communityeb2f0be32efd
ognl@3.2.15
3.4.13

Open the chart page →

2,448

Container images carrying it

74 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
guacamole/guacamole:1.6.0f344085e618b
ognl@3.4.4
3.4.13
4
apache/shenyu-admin:2.4.2e8b7c4ddd069
ognl@3.1.2
3.4.13
3
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
ognl@3.1.16
3.4.13
2
sonatype/nexus3:3.97.0-ubi4a1b19c7efe6
ognl@3.4.4
3.4.13
2
xuxueli/xxl-job-admin:2.4.0640093c35fd6
ognl@3.3.4
3.4.13
2
public.ecr.aws/aktosecurity/akto-api-security-dashboard:1.70.3:latest142caa08d1f0
ognl@3.3.5
3.4.13
2
aktosecurity/akto-api-security-dashboard:latest9ef5e8cb6a43
ognl@3.3.5
3.4.13
1
aktosecurity/data-ingestion-service213aded7adc5
ognl@3.1.29
3.4.13
1
aktosecurity/data-ingestion-service:1.4.946ed5bcb04b2
ognl@3.1.29
3.4.13
1
aktosecurity/data-ingestion-service:1.6.6dc4b05df83f7
ognl@3.3.5
3.4.13
1
apache/gravitino-iceberg-rest:1.3.080136ae753ee
ognl@3.2.15
3.4.13
1
apache/hertzbeat:1.8.075d48a62748f
ognl@3.2.6
3.4.13
1
apache/shenyu-admin:2.5.1e2be712fc4f4
ognl@3.3.0
3.4.13
1
atlassian/bamboo:12.1.122009b0c8591a
ognl@3.3.5
3.4.13
1
atlassian/confluence-server:7.10.03b9222ab32ef
ognl@2.6.5-atlassian-3
3.4.13
1
atlassian/crowd:7.2.43e1e1aa08071
ognl@3.4.11
3.4.13
1
atlassian/crowd:5.2.272590362a85f
ognl@3.1.29
3.4.13
1
camunda/camunda-bpm-platform:latestbcc5bb0542df
ognl@3.4.2
3.4.13
1
cbioportal/cbioportal:6.4.1-web-shenandoah08debbd2dbf9
ognl@3.4.3
3.4.13
1
choerodon/event-store-service:0.8.03c94c97f6f69
ognl@3.1.12
3.4.13
1
consensys/teku:latest19049d6a1e09
ognl@3.3.4
3.4.13
1
consensys/teku:25.4.1bf6ecd2ea716
ognl@3.3.4
3.4.13
1
erikvl87/languagetool:6.7-dockerupdate-3e1ea6a975388
ognl@3.4.2
3.4.13
1
flowable/flowable-rest:7.1.0b7ae287502cd
ognl@3.4.2
3.4.13
1
folioci/mod-marccat:latest1b57d690d568
ognl@3.1.15
3.4.13
1
gocd/gocd-server:v19.3.02da45cb09d57
ognl@3.1.16
3.4.13
1
gocd/gocd-server:v26.1.0720d1012b93f
ognl@3.4.4
3.4.13
1
gotson/komga:0.99.49b15ea6bfc30
ognl@3.1.26
3.4.13
1
graviteeio/am-gateway:4.13.10168317e2395
ognl@3.3.4
3.4.13
1
graviteeio/am-management-api:4.13.1b2bd35d38f51
ognl@3.3.4
3.4.13
1
guacamole/guacamole:1.5.50f62f6d17ab3
ognl@3.4.2
3.4.13
1
guacamole/guacamole:1.1.0333a7f40c145
ognl@3.1.16
3.4.13
1
guacamole/guacamole:1.3.0739cb6820ae8
ognl@3.1.16
3.4.13
1
holoinsight/server:latest88978988756b
ognl@3.1.19
3.4.13
1
iamdorsah/bastillion:v0.1db83a0254d81
ognl@3.1.26
3.4.13
1
intelloop/atlas-cmms-backend:v1.5.14c61bc3dd3f8
ognl@3.1.12
3.4.13
1
ladeit/ladeit:latest962b665ffe82
ognl@3.2.12
3.4.13
1
library/sonarqube:10.7.0-community0842dcd4c8f8
ognl@3.4.2
3.4.13
1
library/sonarqube:6.7.6-community0ae5169e3d0f
ognl@3.1.14
3.4.13
1
library/sonarqube:9.1.0-datacenter-search7e43ff493a47
ognl@3.1.26
3.4.13
1
library/sonarqube:8.9.2-community88cd63154d4b
ognl@3.2.15
3.4.13
1
library/sonarqube:8.2-communitya246bc64207e
ognl@3.2.10
3.4.13
1
library/sonarqube:9.1.0-datacenter-appa9bc5a3a1fc3
ognl@3.2.15
3.4.13
1
library/sonarqube:8.9-communityeb2f0be32efd
ognl@3.2.15
3.4.13
1
library/sonarqube:10.0.0-communityef9723cf4fe4
ognl@3.3.4
3.4.13
1
meyay/languagetool:6.8062924c66c64
ognl@3.4.2
3.4.13
1
operaton/operaton:2.2.0-jdk258efcb2744fe6
ognl@3.4.4
3.4.13
1
palopalepalo/jasperreports:8-v1.356b99b194d20
ognl@3.1.22
3.4.13
1
pinpointdocker/pinpoint-collector:3.1.1-metric54707b3d7186
ognl@3.4.2
3.4.13
1
pinpointdocker/pinpoint-web:3.1.1-metric96eacf9fe45f
ognl@3.4.2
3.4.13
1

syft 1.42.1 · advisories as of 24 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.