CVE-2026-13067
HighAdvisory
Published 22 Jul 2026In the index since 6 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.2
- base score, highest
- EPSS
- 0.001
- 1st percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 13
- of 17,781 indexed, latest versions
- Container images
- 10
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket
Carried by container images the latest versions of 13 of 17,781 indexed charts deploy, on 10 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| mongodbbitnami | 8.0.8-0, 8.0.10-1, 8.0.11-0, 8.0.13-0 | 8.0.28 | 4 |
| mongodbdeb | 1:3.6.3-0ubuntu1.4, 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3 | no fix listed | 6 |
- OSV records
- BIT-mongodb-2026-13067UBUNTU-CVE-2026-13067
Charts affected
13 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| litmuslitmuschaos | 3.30.0 | 1 of 6See more | 7,007 |
| unifiunifiVerified publisher | 1.16.0 | 1 of 1See more | 7,268 |
| unifi-controllerqonstruktVerified publisher | 2.6.1 | 1 of 1See more | 10,469 |
| unifigeek-cookbookVerified publisher | 5.1.3 | 1 of 1See more | 11,839 |
| omada-controllergeek-cookbookVerified publisher | 4.4.2 | 1 of 1See more | 11,553 |
| mongodb-backupsinextraVerified publisher | 1.1.0 | 1 of 1See more | 4,238 |
| omada-controllerandrelote-k8sVerified publisher | 4.5.0 | 1 of 1See more | 11,553 |
| unifiegebackVerified publisher | 2.1.6 | 1 of 1See more | 7,268 |
| unifik8sonlabVerified publisher | 0.3.7 | 1 of 1See more | 7,268 |
| unifimidokura-communityVerified publisher | 0.0.6 | 1 of 1See more | 11,188 |
| mongodbpetersandor | 14.1.8 | 1 of 1See more | 4,109 |
| your-spotifyrubxkubeVerified publisher | 1.0.1 | 1 of 3See more | 5,066 |
| unifistartechnicaVerified publisher | 0.1.3 | 1 of 2See more | 14,493 |
Container images carrying it
10 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| jacobalberty/ | 896c0ab82d33 | mongodb | no fix listed | 3 |
| mbentley/ | f4e682274bed | mongodb | no fix listed | 2 |
| bitnamilegacy/ | 2579e968033e | mongodb | 8.0.28 | 1 |
| bitnamilegacy/ | b0652af9c8d0 | mongodb | 8.0.28 | 1 |
| bitnami/ | b3bd5b6be9a0 | mongodb | 8.0.28 | 1 |
| jacobalberty/ | 4a3616625dda | mongodb | no fix listed | 1 |
| jacobalberty/ | b3edc809a3ff | mongodb | no fix listed | 1 |
| linuxserver/ | 0ae315a3a456 | mongodb | no fix listed | 1 |
| linuxserver/ | ab105cc50322 | mongodb | no fix listed | 1 |
| ghcr.io/ | 1eee8e20a87f | mongodb | 8.0.28 | 1 |