StackRadar

CVE-2026-113730

Medium

Advisory

Published 21 Oct 2026In the index since 22 Oct 2026
Severity
Medium
worst across findings
CVSS
5.6
base score, highest
EPSS
0.004
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
79
of 18,232 indexed, latest versions
Container images
74
deployed by those charts
Fix available
1 of 1
affected package

OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies

Carried by container images the latest versions of 79 of 18,232 indexed charts deploy, on 74 images.

Affected packageAffected versionsFixed inImages
ognlmaven2.6.5-atlassian-3, 3.0.8, 3.1.2, 3.1.3+21 more3.4.1374
OSV records
GHSA-crwc-vw2r-qr6m

Charts affected

79 by stars
ChartLatestAffected imagesRadar Score
ladeitladeit0.4.01 of 2See more

ladeit ladeit 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
ladeit/ladeit:latest962b665ffe82
ognl@3.2.12
3.4.13

Open the chart page →

29,293
pulsarv2milvus-helm2.7.81 of 4See more

pulsarv2 milvus-helm 2.7.8

1 of the 4 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
ognl@3.1.16
3.4.13

Open the chart page →

18,772
crowdmoxVerified publisher2.4.31 of 3See more

crowd mox 2.4.3

1 of the 3 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
atlassian/crowd:5.2.272590362a85f
ognl@3.1.29
3.4.13

Open the chart page →

5,784
davosnicholaswildeVerified publisher1.0.01 of 1See more

davos nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/davos:2.2.1-ls7624ba55aeaa4f
ognl@3.0.8
3.4.13

Open the chart page →

6,673
operatonoperatonVerified publisher1.2.01 of 1See more

operaton operaton 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
operaton/operaton:2.2.0-jdk258efcb2744fe6
ognl@3.4.4
3.4.13

Open the chart page →

246
panopticumpanopticumVerified publisher1.0.121 of 1See more

panopticum panopticum 1.0.12

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
sharque/panopticum:v8.4.91297852bb4dd
ognl@3.3.4
3.4.13

Open the chart page →

9
pinpointpinpointVerified publisher3.1.72 of 13See more

pinpoint pinpoint 3.1.7

2 of the 13 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
pinpointdocker/pinpoint-collector:3.1.1-metric54707b3d7186
ognl@3.4.2
3.4.13
pinpointdocker/pinpoint-web:3.1.1-metric96eacf9fe45f
ognl@3.4.2
3.4.13

Open the chart page →

34,772
guacamolequench-guacamoleVerified publisher0.0.141 of 3See more

guacamole quench-guacamole 0.0.14

1 of the 3 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/guacamoledigest-pinnedae2235fbc8db
ognl@3.4.4
3.4.13

Open the chart page →

473
management-portalradar-baseVerified publisher1.7.01 of 1See more

management-portal radar-base 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
ghcr.io/radar-base/managementportal/management-portal:3.0.0c1b37e821f72
ognl@3.3.4
3.4.13

Open the chart page →

4,203
sonarquberedhat-cop0.1.131 of 1See more

sonarqube redhat-cop 0.1.13

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
library/sonarqube:10.7.0-community0842dcd4c8f8
ognl@3.4.2
3.4.13

Open the chart page →

4,923
bastillion-upstreamrock8sVerified publisher0.1.01 of 1See more

bastillion-upstream rock8s 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
iamdorsah/bastillion:v0.1db83a0254d81
ognl@3.1.26
3.4.13

Open the chart page →

4,312
languagetoolrubxkubeVerified publisher0.1.01 of 1See more

languagetool rubxkube 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
meyay/languagetool:6.8062924c66c64
ognl@3.4.2
3.4.13

Open the chart page →

31
housekeepersaashousekeeper1.0.01 of 14See more

housekeeper saashousekeeper 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
saashousekeeper/event-tracking:1.0.0d8786cea5bc4
ognl@3.3.0
3.4.13

Open the chart page →

4,916
guacamolesergiotocaliniVerified publisher1.0.01 of 2See more

guacamole sergiotocalini 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
guacamole/guacamole:1.5.50f62f6d17ab3
ognl@3.4.2
3.4.13

Open the chart page →

6,043
shenyushenyu0.6.31 of 2See more

shenyu shenyu 0.6.3

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
apache/shenyu-admin:2.5.1e2be712fc4f4
ognl@3.3.0
3.4.13

Open the chart page →

9,245
shenyushenyu-helm-chart-test2.4.271 of 2See more

shenyu shenyu-helm-chart-test 2.4.27

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
apache/shenyu-admin:2.4.2e8b7c4ddd069
ognl@3.1.2
3.4.13

Open the chart page →

12,775
sonatype-nexus3simcube1.0.11 of 2See more

sonatype-nexus3 simcube 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
sonatype/nexus3:3.58.1586060431b64
ognl@3.2.20
3.4.13

Open the chart page →

5,195
hetzner-iroboslamdev0.0.51 of 1See more

hetzner-irobo slamdev 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
slamdev/hetzner-irobo:0.0.13ca20c184c55
ognl@3.1.26
3.4.13

Open the chart page →

3,867
atlassian-confluencesomeblackmagic3.4.11 of 1See more

atlassian-confluence someblackmagic 3.4.1

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
atlassian/confluence-server:7.10.03b9222ab32ef
ognl@2.6.5-atlassian-3
3.4.13

Open the chart page →

14,449
languagetoolsomeone-stole-my-nameVerified publisher0.1.91 of 1See more

languagetool someone-stole-my-name 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
ghcr.io/someone-stole-my-name/docker-languagetool:6.0d411e4365eef
ognl@3.3.0
3.4.13

Open the chart page →

1,670
sonarqubestakaterVerified publisher0.10.31 of 2See more

sonarqube stakater 0.10.3

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
library/sonarqube:6.7.6-community0ae5169e3d0f
ognl@3.1.14
3.4.13

Open the chart page →

13,513
teku-validatorstakewise4.3.21 of 2See more

teku-validator stakewise 4.3.2

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
consensys/teku:25.4.1bf6ecd2ea716
ognl@3.3.4
3.4.13

Open the chart page →

3,722
sn-consolestreamnative1.13.01 of 1See more

sn-console streamnative 1.13.0

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
streamnative/private-cloud-console:v2.3.27-all91e54375e154
ognl@3.2.15
3.4.13

Open the chart page →

2,232
languagetool-serverszpadel-chartsVerified publisher0.4.21 of 1See more

languagetool-server szpadel-charts 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
ghcr.io/szpadel/languagetool-server:6.6.18de7e68c4a34
ognl@3.4.2
3.4.13

Open the chart page →

488
shenyutest-helm2.4.211 of 2See more

shenyu test-helm 2.4.21

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
apache/shenyu-admin:2.4.2e8b7c4ddd069
ognl@3.1.2
3.4.13

Open the chart page →

12,775
sonarqubewebencryptor6.7.31 of 3See more

sonarqube webencryptor 6.7.3

1 of the 3 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
library/sonarqube:8.2-communitya246bc64207e
ognl@3.2.10
3.4.13

Open the chart page →

6,364
canal-serverxxl-job-adminVerified publisher0.1.21 of 2See more

canal-server xxl-job-admin 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
ghcr.io/dellnoantechnp/canal-server:v1.1.6af724c855f65
ognl@3.2.12
3.4.13

Open the chart page →

6,181
xxl-job-adminxxl-job-adminVerified publisher1.1.31 of 1See more

xxl-job-admin xxl-job-admin 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
xuxueli/xxl-job-admin:2.4.0640093c35fd6
ognl@3.3.4
3.4.13

Open the chart page →

3,595
language-toolzekker6Verified publisher1.12.11 of 2See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-113730.

Container imageDigestPackageFixed in
erikvl87/languagetool:6.7-dockerupdate-3e1ea6a975388
ognl@3.4.2
3.4.13

Open the chart page →

1,615

Container images carrying it

74 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
guacamole/guacamole:1.6.0f344085e618b
ognl@3.4.4
3.4.13
4
apache/shenyu-admin:2.4.2e8b7c4ddd069
ognl@3.1.2
3.4.13
3
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
ognl@3.1.16
3.4.13
2
sonatype/nexus3:3.97.0-ubi4a1b19c7efe6
ognl@3.4.4
3.4.13
2
xuxueli/xxl-job-admin:2.4.0640093c35fd6
ognl@3.3.4
3.4.13
2
public.ecr.aws/aktosecurity/akto-api-security-dashboard:1.70.3:latest142caa08d1f0
ognl@3.3.5
3.4.13
2
aktosecurity/akto-api-security-dashboard:latest9ef5e8cb6a43
ognl@3.3.5
3.4.13
1
aktosecurity/data-ingestion-service213aded7adc5
ognl@3.1.29
3.4.13
1
aktosecurity/data-ingestion-service:1.4.946ed5bcb04b2
ognl@3.1.29
3.4.13
1
aktosecurity/data-ingestion-service:1.6.6dc4b05df83f7
ognl@3.3.5
3.4.13
1
apache/gravitino-iceberg-rest:1.3.080136ae753ee
ognl@3.2.15
3.4.13
1
apache/hertzbeat:1.8.075d48a62748f
ognl@3.2.6
3.4.13
1
apache/shenyu-admin:2.5.1e2be712fc4f4
ognl@3.3.0
3.4.13
1
atlassian/bamboo:12.1.122009b0c8591a
ognl@3.3.5
3.4.13
1
atlassian/confluence-server:7.10.03b9222ab32ef
ognl@2.6.5-atlassian-3
3.4.13
1
atlassian/crowd:7.2.43e1e1aa08071
ognl@3.4.11
3.4.13
1
atlassian/crowd:5.2.272590362a85f
ognl@3.1.29
3.4.13
1
camunda/camunda-bpm-platform:latestbcc5bb0542df
ognl@3.4.2
3.4.13
1
cbioportal/cbioportal:6.4.1-web-shenandoah08debbd2dbf9
ognl@3.4.3
3.4.13
1
choerodon/event-store-service:0.8.03c94c97f6f69
ognl@3.1.12
3.4.13
1
consensys/teku:latest19049d6a1e09
ognl@3.3.4
3.4.13
1
consensys/teku:25.4.1bf6ecd2ea716
ognl@3.3.4
3.4.13
1
erikvl87/languagetool:6.7-dockerupdate-3e1ea6a975388
ognl@3.4.2
3.4.13
1
flowable/flowable-rest:7.1.0b7ae287502cd
ognl@3.4.2
3.4.13
1
folioci/mod-marccat:latest1b57d690d568
ognl@3.1.15
3.4.13
1
gocd/gocd-server:v19.3.02da45cb09d57
ognl@3.1.16
3.4.13
1
gocd/gocd-server:v26.1.0720d1012b93f
ognl@3.4.4
3.4.13
1
gotson/komga:0.99.49b15ea6bfc30
ognl@3.1.26
3.4.13
1
graviteeio/am-gateway:4.13.10168317e2395
ognl@3.3.4
3.4.13
1
graviteeio/am-management-api:4.13.1b2bd35d38f51
ognl@3.3.4
3.4.13
1
guacamole/guacamole:1.5.50f62f6d17ab3
ognl@3.4.2
3.4.13
1
guacamole/guacamole:1.1.0333a7f40c145
ognl@3.1.16
3.4.13
1
guacamole/guacamole:1.3.0739cb6820ae8
ognl@3.1.16
3.4.13
1
holoinsight/server:latest88978988756b
ognl@3.1.19
3.4.13
1
iamdorsah/bastillion:v0.1db83a0254d81
ognl@3.1.26
3.4.13
1
intelloop/atlas-cmms-backend:v1.5.14c61bc3dd3f8
ognl@3.1.12
3.4.13
1
ladeit/ladeit:latest962b665ffe82
ognl@3.2.12
3.4.13
1
library/sonarqube:10.7.0-community0842dcd4c8f8
ognl@3.4.2
3.4.13
1
library/sonarqube:6.7.6-community0ae5169e3d0f
ognl@3.1.14
3.4.13
1
library/sonarqube:9.1.0-datacenter-search7e43ff493a47
ognl@3.1.26
3.4.13
1
library/sonarqube:8.9.2-community88cd63154d4b
ognl@3.2.15
3.4.13
1
library/sonarqube:8.2-communitya246bc64207e
ognl@3.2.10
3.4.13
1
library/sonarqube:9.1.0-datacenter-appa9bc5a3a1fc3
ognl@3.2.15
3.4.13
1
library/sonarqube:8.9-communityeb2f0be32efd
ognl@3.2.15
3.4.13
1
library/sonarqube:10.0.0-communityef9723cf4fe4
ognl@3.3.4
3.4.13
1
meyay/languagetool:6.8062924c66c64
ognl@3.4.2
3.4.13
1
operaton/operaton:2.2.0-jdk258efcb2744fe6
ognl@3.4.4
3.4.13
1
palopalepalo/jasperreports:8-v1.356b99b194d20
ognl@3.1.22
3.4.13
1
pinpointdocker/pinpoint-collector:3.1.1-metric54707b3d7186
ognl@3.4.2
3.4.13
1
pinpointdocker/pinpoint-web:3.1.1-metric96eacf9fe45f
ognl@3.4.2
3.4.13
1

syft 1.42.1 · advisories as of 24 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.