StackRadar

CVE-2026-113730

Medium

Advisory

Published 21 Oct 2026In the index since 22 Oct 2026
Severity
Medium
worst across findings
CVSS
5.6
base score, highest
EPSS
0.004
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
79
of 18,232 indexed, latest versions
Container images
74
deployed by those charts
Fix available
1 of 1
affected package

OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies

Carried by container images the latest versions of 79 of 18,232 indexed charts deploy, on 74 images.

Affected packageAffected versionsFixed inImages
ognlmaven2.6.5-atlassian-3, 3.0.8, 3.1.2, 3.1.3+21 more3.4.1374
OSV records
GHSA-crwc-vw2r-qr6m

Charts affected

79 by stars
ChartLatestAffected imagesRadar Score
ladeitladeit0.4.01 of 2See more

ladeit ladeit 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
ladeit/ladeit:latest962b665ffe82
ognl@3.2.12
3.4.13

Open the chart page →

29,293
pulsarv2milvus-helm2.7.81 of 4See more

pulsarv2 milvus-helm 2.7.8

1 of the 4 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
ognl@3.1.16
3.4.13

Open the chart page →

18,772
crowdmoxVerified publisher2.4.31 of 3See more

crowd mox 2.4.3

1 of the 3 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
atlassian/crowd:5.2.272590362a85f
ognl@3.1.29
3.4.13

Open the chart page →

5,784
davosnicholaswildeVerified publisher1.0.01 of 1See more

davos nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/davos:2.2.1-ls7624ba55aeaa4f
ognl@3.0.8
3.4.13

Open the chart page →

6,673
operatonoperatonVerified publisher1.2.01 of 1See more

operaton operaton 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
operaton/operaton:2.2.0-jdk258efcb2744fe6
ognl@3.4.4
3.4.13

Open the chart page →

246
panopticumpanopticumVerified publisher1.0.121 of 1See more

panopticum panopticum 1.0.12

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
sharque/panopticum:v8.4.91297852bb4dd
ognl@3.3.4
3.4.13

Open the chart page →

9
pinpointpinpointVerified publisher3.1.72 of 13See more

pinpoint pinpoint 3.1.7

2 of the 13 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
pinpointdocker/pinpoint-collector:3.1.1-metric54707b3d7186
ognl@3.4.2
3.4.13
pinpointdocker/pinpoint-web:3.1.1-metric96eacf9fe45f
ognl@3.4.2
3.4.13

Open the chart page →

34,772
guacamolequench-guacamoleVerified publisher0.0.141 of 3See more

guacamole quench-guacamole 0.0.14

1 of the 3 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/guacamoledigest-pinnedae2235fbc8db
ognl@3.4.4
3.4.13

Open the chart page →

473
management-portalradar-baseVerified publisher1.7.01 of 1See more

management-portal radar-base 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
ghcr.io/radar-base/managementportal/management-portal:3.0.0c1b37e821f72
ognl@3.3.4
3.4.13

Open the chart page →

4,203
sonarquberedhat-cop0.1.131 of 1See more

sonarqube redhat-cop 0.1.13

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
library/sonarqube:10.7.0-community0842dcd4c8f8
ognl@3.4.2
3.4.13

Open the chart page →

4,923
bastillion-upstreamrock8sVerified publisher0.1.01 of 1See more

bastillion-upstream rock8s 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
iamdorsah/bastillion:v0.1db83a0254d81
ognl@3.1.26
3.4.13

Open the chart page →

4,312
languagetoolrubxkubeVerified publisher0.1.01 of 1See more

languagetool rubxkube 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
meyay/languagetool:6.8062924c66c64
ognl@3.4.2
3.4.13

Open the chart page →

31
housekeepersaashousekeeper1.0.01 of 14See more

housekeeper saashousekeeper 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
saashousekeeper/event-tracking:1.0.0d8786cea5bc4
ognl@3.3.0
3.4.13

Open the chart page →

4,916
guacamolesergiotocaliniVerified publisher1.0.01 of 2See more

guacamole sergiotocalini 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
guacamole/guacamole:1.5.50f62f6d17ab3
ognl@3.4.2
3.4.13

Open the chart page →

6,043
shenyushenyu0.6.31 of 2See more

shenyu shenyu 0.6.3

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
apache/shenyu-admin:2.5.1e2be712fc4f4
ognl@3.3.0
3.4.13

Open the chart page →

9,245
shenyushenyu-helm-chart-test2.4.271 of 2See more

shenyu shenyu-helm-chart-test 2.4.27

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
apache/shenyu-admin:2.4.2e8b7c4ddd069
ognl@3.1.2
3.4.13

Open the chart page →

12,775
sonatype-nexus3simcube1.0.11 of 2See more

sonatype-nexus3 simcube 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
sonatype/nexus3:3.58.1586060431b64
ognl@3.2.20
3.4.13

Open the chart page →

5,195
hetzner-iroboslamdev0.0.51 of 1See more

hetzner-irobo slamdev 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
slamdev/hetzner-irobo:0.0.13ca20c184c55
ognl@3.1.26
3.4.13

Open the chart page →

3,867
atlassian-confluencesomeblackmagic3.4.11 of 1See more

atlassian-confluence someblackmagic 3.4.1

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
atlassian/confluence-server:7.10.03b9222ab32ef
ognl@2.6.5-atlassian-3
3.4.13

Open the chart page →

14,449
languagetoolsomeone-stole-my-nameVerified publisher0.1.91 of 1See more

languagetool someone-stole-my-name 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
ghcr.io/someone-stole-my-name/docker-languagetool:6.0d411e4365eef
ognl@3.3.0
3.4.13

Open the chart page →

1,670
sonarqubestakaterVerified publisher0.10.31 of 2See more

sonarqube stakater 0.10.3

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
library/sonarqube:6.7.6-community0ae5169e3d0f
ognl@3.1.14
3.4.13

Open the chart page →

13,513
teku-validatorstakewise4.3.21 of 2See more

teku-validator stakewise 4.3.2

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
consensys/teku:25.4.1bf6ecd2ea716
ognl@3.3.4
3.4.13

Open the chart page →

3,722
sn-consolestreamnative1.13.01 of 1See more

sn-console streamnative 1.13.0

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
streamnative/private-cloud-console:v2.3.27-all91e54375e154
ognl@3.2.15
3.4.13

Open the chart page →

2,232
languagetool-serverszpadel-chartsVerified publisher0.4.21 of 1See more

languagetool-server szpadel-charts 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
ghcr.io/szpadel/languagetool-server:6.6.18de7e68c4a34
ognl@3.4.2
3.4.13

Open the chart page →

488
shenyutest-helm2.4.211 of 2See more

shenyu test-helm 2.4.21

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
apache/shenyu-admin:2.4.2e8b7c4ddd069
ognl@3.1.2
3.4.13

Open the chart page →

12,775
sonarqubewebencryptor6.7.31 of 3See more

sonarqube webencryptor 6.7.3

1 of the 3 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
library/sonarqube:8.2-communitya246bc64207e
ognl@3.2.10
3.4.13

Open the chart page →

6,364
canal-serverxxl-job-adminVerified publisher0.1.21 of 2See more

canal-server xxl-job-admin 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
ghcr.io/dellnoantechnp/canal-server:v1.1.6af724c855f65
ognl@3.2.12
3.4.13

Open the chart page →

6,181
xxl-job-adminxxl-job-adminVerified publisher1.1.31 of 1See more

xxl-job-admin xxl-job-admin 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
xuxueli/xxl-job-admin:2.4.0640093c35fd6
ognl@3.3.4
3.4.13

Open the chart page →

3,595
language-toolzekker6Verified publisher1.12.11 of 2See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
erikvl87/languagetool:6.7-dockerupdate-3e1ea6a975388
ognl@3.4.2
3.4.13

Open the chart page →

1,615

Container images carrying it

74 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
pmoscode/axelor-open-suite:v7.2.57a58f4d762f5c
ognl@3.2.15
3.4.13
1
polyakov/hapi-fhir-jpaserver-example:latestdbcef69146b8
ognl@3.1.3
3.4.13
1
refar/apm-api:v5.7.1241373fa2972
ognl@3.1.19
3.4.13
1
saashousekeeper/event-tracking:1.0.0d8786cea5bc4
ognl@3.3.0
3.4.13
1
sharque/panopticum:v8.4.91297852bb4dd
ognl@3.3.4
3.4.13
1
slamdev/hetzner-irobo:0.0.13ca20c184c55
ognl@3.1.26
3.4.13
1
sonatype/nexus3:3.53.04bd975493104
ognl@3.2.20
3.4.13
1
sonatype/nexus3:3.58.1586060431b64
ognl@3.2.20
3.4.13
1
sonatype/nexus3:3.97.0772ad5badde0
ognl@3.4.4
3.4.13
1
streamnative/private-cloud-console:v2.3.27-all91e54375e154
ognl@3.2.15
3.4.13
1
ghcr.io/dellnoantechnp/canal-server:v1.1.6af724c855f65
ognl@3.2.12
3.4.13
1
ghcr.io/eximeebpms/eximeebpms-bpm-platform:run-1.4.00f4a5c0eea07
ognl@3.4.4
3.4.13
1
ghcr.io/gregperlinli/certvault:2.12.0a7d0cc9e260a
ognl@3.4.4
3.4.13
1
ghcr.io/jenkins-x/nexus:0.1.378caf5289fe73
ognl@3.2.14
3.4.13
1
ghcr.io/linuxserver/davos:2.2.1-ls7624ba55aeaa4f
ognl@3.0.8
3.4.13
1
ghcr.io/quenchworks/images/guacamoleae2235fbc8db
ognl@3.4.4
3.4.13
1
ghcr.io/radar-base/managementportal/management-portal:3.0.0c1b37e821f72
ognl@3.3.4
3.4.13
1
ghcr.io/someone-stole-my-name/docker-languagetool:6.0d411e4365eef
ognl@3.3.0
3.4.13
1
ghcr.io/star-whale/server:0.6.158368359c8dd0
ognl@3.3.0
3.4.13
1
ghcr.io/streamvisor/streamvisor:4.1.40bc598b2ac9a
ognl@3.3.4
3.4.13
1
ghcr.io/szpadel/languagetool-server:6.6.18de7e68c4a34
ognl@3.4.2
3.4.13
1
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor:1.70.366b0ec8b3de3
ognl@3.3.5
3.4.13
1
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor:latestb5a1c2601c12
ognl@3.3.5
3.4.13
1
public.ecr.aws/aktosecurity/akto-api-security-testing-db-layer:1.74.4_local1ed844ecab29
ognl@3.3.5
3.4.13
1

syft 1.42.1 · advisories as of 24 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.