StackRadar

CVE-2026-114094

High

Advisory

Published 2 Oct 2026In the index since 22 Oct 2026
Severity
High
worst across findings
CVSS
8.8
base score, highest
EPSS
0.007
51st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
43
of 18,232 indexed, latest versions
Container images
56
deployed by those charts
Fix available
1 of 1
affected package

Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths

Carried by container images the latest versions of 43 of 18,232 indexed charts deploy, on 56 images.

Affected packageAffected versionsFixed inImages
dulwichpypi0.20.31, 0.20.50, 0.21.3, 0.21.5+7 more1.2.956
OSV records
GHSA-8mcx-5rqc-vhmf

Charts affected

43 by stars
ChartLatestAffected imagesRadar Score
kube-downscalerdeliveryheroVerified publisher0.7.61 of 1See more

kube-downscaler deliveryhero 0.7.6

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
dulwich@0.21.5
1.2.9

Open the chart page →

88,003
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
dulwich@0.21.7
1.2.9

Open the chart page →

60,015
netscaler-ingress-controllernetscalerOfficialVerified publisher4.2.261 of 1See more

netscaler-ingress-controller netscaler 4.2.26

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
quay.io/netscaler/netscaler-k8s-ingress-controller:4.2.26a68453858339
dulwich@0.22.8
1.2.9

Open the chart page →

226
netboxstartechnicaVerified publisher5.1.01 of 4See more

netbox startechnica 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
dulwich@0.21.7
1.2.9

Open the chart page →

2,234
machinarislib42Verified publisher0.2.01 of 1See more

machinaris lib42 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
ghcr.io/guydavis/machinaris:testf77fa53b89cb
dulwich@0.21.7
1.2.9

Open the chart page →

26,667
netscaler-cpx-with-ingress-controllernetscalerOfficialVerified publisher4.2.261 of 2See more

netscaler-cpx-with-ingress-controller netscaler 4.2.26

1 of the 2 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
quay.io/netscaler/netscaler-k8s-ingress-controller:4.2.26a68453858339
dulwich@0.22.8
1.2.9

Open the chart page →

421
squestchristianhuthVerified publisher7.0.41See more

squest christianhuth 7.0.4

1 container image this version deploys carries CVE-2026-114094.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
dulwich@0.21.7
1.2.9

Open the chart page →

—
hpe-greenlake-file-csi-driverhpe-storageVerified publisher2.6.41 of 7See more

hpe-greenlake-file-csi-driver hpe-storage 2.6.4

1 of the 7 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
quay.io/hpestorage/filex-csi-driver:2.6.4b7f960bbf472
dulwich@0.21.7
1.2.9

Open the chart page →

9,679
kuma-ingress-watcherkuma-ingress-watcherVerified publisher1.4.01 of 1See more

kuma-ingress-watcher kuma-ingress-watcher 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
ghcr.io/squent/kuma-ingress-watcher:1.7.014d45b2a1f00
dulwich@0.22.7
1.2.9

Open the chart page →

3,081
locustlocustVerified publisher0.1.41 of 1See more

locust locust 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
hansehe/locust:1.1.0bc8e45262bc4
dulwich@0.21.7
1.2.9

Open the chart page →

3,144
mend-renovate-enterprise-editionmend-renovateVerified publisher10.8.01 of 2See more

mend-renovate-enterprise-edition mend-renovate 10.8.0

1 of the 2 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
ghcr.io/mend/renovate-ee-server:15.8.02df8d6bb970b
dulwich@0.21.6
1.2.9

Open the chart page →

26,022
redminemt1905027.3.41 of 3See more

redmine mt190502 7.3.4

1 of the 3 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
library/redmine:6.1.204ac44a2595b
dulwich@0.22.7
1.2.9

Open the chart page →

9,509
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
dulwich@1.2.5
1.2.9

Open the chart page →

50,051
redmineredmine-helm-chartVerified publisher0.2.61 of 1See more

redmine redmine-helm-chart 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
library/redmine:6.1.3-trixief474a901faec
dulwich@0.22.7
1.2.9

Open the chart page →

6,021
kube-resource-reportrlex0.10.11 of 2See more

kube-resource-report rlex 0.10.1

1 of the 2 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
hjacobs/kube-resource-report:22.11.0c173cd02f5af
dulwich@0.20.50
1.2.9

Open the chart page →

1,607
airbyteairbyte-v2Verified publisher2.4.01 of 10See more

airbyte airbyte-v2 2.4.0

1 of the 10 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
airbyte/manifest-server:7.28.2deec511b51c3
dulwich@0.22.8
1.2.9

Open the chart page →

15,854
camerahubcamerahub0.10.211 of 2See more

camerahub camerahub 0.10.21

1 of the 2 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
camerahub/camerahub:0.36.23a5af37dd6e1b
dulwich@0.21.3
1.2.9

Open the chart page →

3,499
kube-ops-viewchristianhuthVerified publisher9.0.01 of 1See more

kube-ops-view christianhuth 9.0.0

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
hjacobs/kube-ops-view:23.5.0a4fae38f93d7
dulwich@0.21.5
1.2.9

Open the chart page →

1,517
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
dulwich@0.22.8
1.2.9

Open the chart page →

50,688
deployhubdeployhubVerified publisher10.0.4157 of 11See more

deployhub deployhub 10.0.415

7 of the 11 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
dulwich@0.24.10
1.2.9
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
dulwich@0.24.10
1.2.9
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
dulwich@0.24.10
1.2.9
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
dulwich@0.24.10
1.2.9
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
dulwich@0.24.10
1.2.9
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
dulwich@0.24.10
1.2.9
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
dulwich@0.24.10
1.2.9

Open the chart page →

13,638
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
dulwich@0.21.7
1.2.9

Open the chart page →

11,025
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
dulwich@0.21.7
1.2.9

Open the chart page →

11,025
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
dulwich@0.22.7
1.2.9

Open the chart page →

56,433
autonodelabeldjjudas21Verified publisher0.0.101 of 1See more

autonodelabel djjudas21 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
djjudas21/autonodelabel:0.0.6f17233350c4f
dulwich@0.21.5
1.2.9

Open the chart page →

1,482
huntingfactlyVerified publisher0.4.141 of 1See more

hunting factly 0.4.14

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
dulwich@0.20.50
1.2.9

Open the chart page →

5,730
kube-downscalerhelm-charts-nr0.7.61 of 1See more

kube-downscaler helm-charts-nr 0.7.6

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
dulwich@0.21.5
1.2.9

Open the chart page →

88,003
shynetjuniorjpdj0.1.331 of 1See more

shynet juniorjpdj 0.1.33

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.13.1ba54f7797a6b
dulwich@0.20.50
1.2.9

Open the chart page →

3,009
lnbitskronkltdVerified publisher0.1.01 of 1See more

lnbits kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
lnbitsdocker/lnbits-legend:latest26fae6327477
dulwich@0.21.7
1.2.9

Open the chart page →

2,066
kube-janitorkube-janitor0.3.31 of 1See more

kube-janitor kube-janitor 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
hjacobs/kube-janitor:23.7.0fbb303ed463c
dulwich@0.21.5
1.2.9

Open the chart page →

88,003
lnbitslnbits0.2.11 of 1See more

lnbits lnbits 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
lnbitsdocker/lnbits-legend:0.10.6a11aaa6d2b21
dulwich@0.21.5
1.2.9

Open the chart page →

2,828
servicesmicroslacVerified publisher0.4.01 of 8See more

services microslac 0.4.0

1 of the 8 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
microslac/auth:latest5c1eb1f5c64d
dulwich@0.21.7
1.2.9

Open the chart page →

357,905
errbotmidokura-communityVerified publisher0.0.51 of 1See more

errbot midokura-community 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
errbotio/errbot:6.1.900ee4e0953ab
dulwich@0.20.31
1.2.9

Open the chart page →

2,781
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.04 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

4 of the 40 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
dulwich@0.21.6
1.2.9
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestbd496fa8c9df
dulwich@0.21.6
1.2.9
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
dulwich@0.21.6
1.2.9
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
dulwich@0.21.6
1.2.9

Open the chart page →

307,056
phronetisphronetis0.1.271 of 2See more

phronetis phronetis 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
knspar/phronetis:0.1.4609499d2dc91a
dulwich@0.22.8
1.2.9

Open the chart page →

87,474
prowlerprowler0.1.11 of 1See more

prowler prowler 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
toniblyx/prowler:stable9dbcc3c9abd7
dulwich@1.2.5
1.2.9

Open the chart page →

2,366
redminerestic-pvc-backupVerified publisher0.2.61 of 1See more

redmine restic-pvc-backup 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
library/redmine:6.1.3-trixief474a901faec
dulwich@0.22.7
1.2.9

Open the chart page →

6,021
kube-web-viewrlex0.5.01 of 1See more

kube-web-view rlex 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
hjacobs/kube-web-view:23.8.0431f1bf013d0
dulwich@0.21.5
1.2.9

Open the chart page →

86,174
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
dulwich@0.21.7
1.2.9

Open the chart page →

11,025
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
dulwich@0.22.8
1.2.9

Open the chart page →

4,083
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
dulwich@0.22.8
1.2.9

Open the chart page →

6,160
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
dulwich@0.20.50
1.2.9

Open the chart page →

7,039
downscalersqream-chartsVerified publisher1.0.01 of 1See more

downscaler sqream-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.05d328c003efe
dulwich@0.20.50
1.2.9

Open the chart page →

1,288
servicexssl-hep1.8.611 of 16See more

servicex ssl-hep 1.8.6

11 of the 16 container images this version deploys carry CVE-2026-114094.

Container imageDigestPackageFixed in
sslhep/servicex_app:v1.8.6c935e123030d
dulwich@0.22.8
1.2.9
sslhep/servicex_code_gen_atlas_xaod:v1.8.67827e689caa5
dulwich@0.22.8
1.2.9
sslhep/servicex_code_gen_func_adl_uproot:v1.8.62d6843be2d8d
dulwich@0.22.8
1.2.9
sslhep/servicex_code_gen_python:v1.8.696805be717ff
dulwich@0.22.8
1.2.9
sslhep/servicex_code_gen_raw_uproot:v1.8.61494a81a474b
dulwich@0.22.8
1.2.9
sslhep/servicex_code_gen_topcp:v1.8.6f7faf8c6c3e4
dulwich@0.22.8
1.2.9
sslhep/servicex-did-finder:v1.8.6e15e68307d33
dulwich@0.22.8
1.2.9
sslhep/servicex-did-finder-atlasopenmagic:v1.8.6bd738c952e72
dulwich@0.25.2
1.2.9
sslhep/servicex-did-finder-cernopendata:v1.8.623a80e40ab18
dulwich@0.22.8
1.2.9
sslhep/servicex-did-finder-xrootd:v1.8.69a9fb17458f1
dulwich@0.22.8
1.2.9
sslhep/x509-secrets:v1.8.634e1c87cea8a
dulwich@0.22.8
1.2.9

Open the chart page →

66,935

Container images carrying it

56 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/devtron/ai-agent:0.0.16545dac92173
dulwich@0.21.7
1.2.9
3
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
dulwich@0.21.5
1.2.9
2
library/redmine:6.1.3-trixief474a901faec
dulwich@0.22.7
1.2.9
2
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
dulwich@0.22.8
1.2.9
2
quay.io/netscaler/netscaler-k8s-ingress-controller:4.2.26a68453858339
dulwich@0.22.8
1.2.9
2
airbyte/manifest-server:7.28.2deec511b51c3
dulwich@0.22.8
1.2.9
1
camerahub/camerahub:0.36.23a5af37dd6e1b
dulwich@0.21.3
1.2.9
1
djjudas21/autonodelabel:0.0.6f17233350c4f
dulwich@0.21.5
1.2.9
1
errbotio/errbot:6.1.900ee4e0953ab
dulwich@0.20.31
1.2.9
1
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
dulwich@0.20.50
1.2.9
1
hansehe/locust:1.1.0bc8e45262bc4
dulwich@0.21.7
1.2.9
1
hjacobs/kube-downscaler:23.2.05d328c003efe
dulwich@0.20.50
1.2.9
1
hjacobs/kube-janitor:23.7.0fbb303ed463c
dulwich@0.21.5
1.2.9
1
hjacobs/kube-ops-view:23.5.0a4fae38f93d7
dulwich@0.21.5
1.2.9
1
hjacobs/kube-resource-report:22.11.0c173cd02f5af
dulwich@0.20.50
1.2.9
1
hjacobs/kube-web-view:23.8.0431f1bf013d0
dulwich@0.21.5
1.2.9
1
knspar/phronetis:0.1.4609499d2dc91a
dulwich@0.22.8
1.2.9
1
langgenius/dify-api:1.0.0066035f93856
dulwich@0.22.7
1.2.9
1
library/redmine:6.1.204ac44a2595b
dulwich@0.22.7
1.2.9
1
lnbitsdocker/lnbits-legend:latest26fae6327477
dulwich@0.21.7
1.2.9
1
lnbitsdocker/lnbits-legend:0.10.6a11aaa6d2b21
dulwich@0.21.5
1.2.9
1
microslac/auth:latest5c1eb1f5c64d
dulwich@0.21.7
1.2.9
1
milesmcc/shynet:v0.13.1ba54f7797a6b
dulwich@0.20.50
1.2.9
1
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
dulwich@0.21.7
1.2.9
1
prowlercloud/prowler-api:5.31.14f252d579be2
dulwich@1.2.5
1.2.9
1
redash/redash:25.8.000d813437db5
dulwich@0.21.7
1.2.9
1
redash/redash:26.3.0c5c9148f5c38
dulwich@0.22.8
1.2.9
1
sslhep/servicex_app:v1.8.6c935e123030d
dulwich@0.22.8
1.2.9
1
sslhep/servicex_code_gen_atlas_xaod:v1.8.67827e689caa5
dulwich@0.22.8
1.2.9
1
sslhep/servicex_code_gen_func_adl_uproot:v1.8.62d6843be2d8d
dulwich@0.22.8
1.2.9
1
sslhep/servicex_code_gen_python:v1.8.696805be717ff
dulwich@0.22.8
1.2.9
1
sslhep/servicex_code_gen_raw_uproot:v1.8.61494a81a474b
dulwich@0.22.8
1.2.9
1
sslhep/servicex_code_gen_topcp:v1.8.6f7faf8c6c3e4
dulwich@0.22.8
1.2.9
1
sslhep/servicex-did-finder:v1.8.6e15e68307d33
dulwich@0.22.8
1.2.9
1
sslhep/servicex-did-finder-atlasopenmagic:v1.8.6bd738c952e72
dulwich@0.25.2
1.2.9
1
sslhep/servicex-did-finder-cernopendata:v1.8.623a80e40ab18
dulwich@0.22.8
1.2.9
1
sslhep/servicex-did-finder-xrootd:v1.8.69a9fb17458f1
dulwich@0.22.8
1.2.9
1
sslhep/x509-secrets:v1.8.634e1c87cea8a
dulwich@0.22.8
1.2.9
1
toniblyx/prowler:stable9dbcc3c9abd7
dulwich@1.2.5
1.2.9
1
ghcr.io/guydavis/machinaris:testf77fa53b89cb
dulwich@0.21.7
1.2.9
1
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
dulwich@0.20.50
1.2.9
1
ghcr.io/mend/renovate-ee-server:15.8.02df8d6bb970b
dulwich@0.21.6
1.2.9
1
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
dulwich@0.21.6
1.2.9
1
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestbd496fa8c9df
dulwich@0.21.6
1.2.9
1
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
dulwich@0.21.6
1.2.9
1
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
dulwich@0.21.6
1.2.9
1
ghcr.io/squent/kuma-ingress-watcher:1.7.014d45b2a1f00
dulwich@0.22.7
1.2.9
1
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
dulwich@0.21.7
1.2.9
1
quay.io/hpestorage/filex-csi-driver:2.6.4b7f960bbf472
dulwich@0.21.7
1.2.9
1
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
dulwich@0.24.10
1.2.9
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.