StackRadar

CVE-2026-18446

High

Advisory

Published 31 Jul 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.002
13th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
125
of 17,781 indexed, latest versions
Container images
130
deployed by those charts
Fix available
1 of 2
affected packages

fast-uri vulnerable to host confusion via backslash authority introducer

Carried by container images the latest versions of 125 of 17,781 indexed charts deploy, on 130 images.

Affected packageAffected versionsFixed inImages
fast-urinpm2.1.0, 2.2.0, 2.3.0, 2.4.0+10 more2.4.4, 3.1.5, 4.1.2127
node-ajvdeb6.10.2-1, 8.12.0~ds+~2.1.1-4no fix listed3
OSV records
GHSA-7p8r-x3mc-p8w7UBUNTU-CVE-2026-18446

Charts affected

125 by stars
ChartLatestAffected imagesRadar Score
colosseumbook-k8sinfra-v21.0.182 of 5See more

colosseum book-k8sinfra-v2 1.0.18

2 of the 5 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-cms:loge74b43c7f492
fast-uri@3.0.6
3.1.5
sysnet4admin/colosseum-prm:log5802bfcd7fed
fast-uri@3.0.6
3.1.5

Open the chart page →

26,996
openmctbryopsida0.1.11 of 1See more

openmct bryopsida 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/openmct:main38b6a50a62b2
fast-uri@3.0.1
3.1.5

Open the chart page →

951
dv-podcharonOfficialVerified publisher0.19.11 of 5See more

dv-pod charon 0.19.1

1 of the 5 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
obolnetwork/charon-dkg-sidecar:maine263be0a7440
fast-uri@3.1.0
3.1.5

Open the chart page →

7,405
mcp-for-argocdchristianhuthVerified publisher2.0.01 of 1See more

mcp-for-argocd christianhuth 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
ghcr.io/argoproj-labs/mcp-for-argocd:v0.9.0dffc6c719d86
fast-uri@3.1.0
3.1.5

Open the chart page →

1,947
kamaji-consoleclastixVerified publisher0.1.31 of 1See more

kamaji-console clastix 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
fast-uri@3.0.6
3.1.5

Open the chart page →

2,759
codehubcodehubVerified publisher6.2.181 of 5See more

codehub codehub 6.2.18

1 of the 5 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
jupyterhub/jupyterhub:5.4.63974ba945e65
node-ajv@8.12.0~ds+~2.1.1-4
no fix listed

Open the chart page →

13,220
cortezacorteza1.0.121 of 3See more

corteza corteza 1.0.12

1 of the 3 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
cortezaproject/corteza-server-corredor:2024.9.44ea78dfe5364
fast-uri@3.0.6
3.1.5

Open the chart page →

8,368
authfcryptexlabsVerified publisher0.12.131 of 4See more

authf cryptexlabs 0.12.13

1 of the 4 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
cryptexlabs/authf:0.12.11189c07411d7c
fast-uri@3.0.3
3.1.5

Open the chart page →

3,769
dyff-frontenddyff-frontendVerified publisher0.20.11 of 1See more

dyff-frontend dyff-frontend 0.20.1

1 of the 1 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
registry.gitlab.com/dyff/dyff-frontend:0.20.152549f52ae53
fast-uri@3.1.2
3.1.5

Open the chart page →

973
node-redegebackVerified publisher2.0.131 of 1See more

node-red egeback 2.0.13

1 of the 1 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
nodered/node-red:5.0.410f40d0a83e7
fast-uri@3.1.4
3.1.5

Open the chart page →

975
edp-installepmdedpOfficialVerified publisher3.15.01 of 7See more

edp-install epmdedp 3.15.0

1 of the 7 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
epamedp/krci-portal:0.8.0687acf641097
fast-uri@3.1.2
3.1.5

Open the chart page →

2,033
krci-portalepmdedpVerified publisher0.8.01 of 1See more

krci-portal epmdedp 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
epamedp/krci-portal:0.8.0687acf641097
fast-uri@3.1.2
3.1.5

Open the chart page →

839
lodestarethereum-helm-chartsVerified publisher1.2.21 of 2See more

lodestar ethereum-helm-charts 1.2.2

1 of the 2 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
chainsafe/lodestar:latest5593f6e97912
fast-uri@3.1.0
3.1.5

Open the chart page →

2,522
flanksource-uiflanksourceVerified publisher1.4.3181 of 1See more

flanksource-ui flanksource 1.4.318

1 of the 1 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
flanksource/incident-manager-ui:v1.4.318891f21df54fb
fast-uri@3.1.3
3.1.5

Open the chart page →

2,558
mission-controlflanksourceVerified publisher0.1.3361 of 8See more

mission-control flanksource 0.1.336

1 of the 8 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
public.ecr.aws/flanksource/incident-manager-ui:v1.4.317fea799d4fb2f
fast-uri@3.1.3
3.1.5

Open the chart page →

8,902
qryn-helmgigapipeVerified publisher0.1.91 of 1See more

qryn-helm gigapipe 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
qxip/qryn:3.2.3977acc9c7a9fd
fast-uri@3.0.1
3.1.5

Open the chart page →

2,973
opentelemetry-demogpg-dev0.33.82 of 27See more

opentelemetry-demo gpg-dev 0.33.8

2 of the 27 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
fast-uri@3.0.1
3.1.5
ghcr.io/open-telemetry/demo:1.12.0-flagduif6bdafaa9075
fast-uri@3.0.1
3.1.5

Open the chart page →

49,025
web-checkhajowielandVerified publisher1.0.11 of 1See more

web-check hajowieland 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
ghcr.io/lissy93/web-check:latesta4e021c0f6a9
fast-uri@3.1.4
3.1.5

Open the chart page →

9,047
automatischhelmforgeVerified publisher1.3.71 of 4See more

automatisch helmforge 1.3.7

1 of the 4 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
fast-uri@3.0.3
3.1.5

Open the chart page →

5,769
bytestashhelmforgeVerified publisher1.0.01 of 1See more

bytestash helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
ghcr.io/jordan-dalby/bytestash:1.5.12eb4f736b8cd4
fast-uri@3.1.2
3.1.5

Open the chart page →

739
ghosthelmforgeVerified publisher1.2.61 of 3See more

ghost helmforge 1.2.6

1 of the 3 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
library/ghost:6.62.0a7a268bbfb7f
fast-uri@3.1.2
3.1.5

Open the chart page →

2,463
immichhelmforgeVerified publisher1.2.81 of 5See more

immich helmforge 1.2.8

1 of the 5 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
fast-uri@3.1.3
3.1.5

Open the chart page →

11,042
ryothelmforgeVerified publisher1.0.01 of 2See more

ryot helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
fast-uri@3.1.0
3.1.5

Open the chart page →

6,012
ilum-unity-catalogilumVerified publisher0.1.01 of 4See more

ilum-unity-catalog ilum 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
fast-uri@3.0.1
3.1.5

Open the chart page →

11,812
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
fast-uri@3.1.0
3.1.5

Open the chart page →

3,436
n8njanip81-helm-chartsVerified publisher0.1.41 of 1See more

n8n janip81-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
n8nio/n8n:1.86.08b39ed5a2de9
fast-uri@3.0.6
3.1.5

Open the chart page →

5,826
ghostk8s-home-lab-repo4.1.01 of 1See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
library/ghost:6.41.129773d6be407
fast-uri@3.1.0
3.1.5

Open the chart page →

3,092
k8s-jacoco-operatork8s-jacoco-operator0.4.01 of 4See more

k8s-jacoco-operator k8s-jacoco-operator 0.4.0

1 of the 4 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
ghcr.io/curium-rocks/k8s-jacoco-operator:maina558ceae6cdb
fast-uri@2.1.0
2.4.4

Open the chart page →

2,437
k8s-mutating-webhookk8s-mutating-webhook0.3.01 of 2See more

k8s-mutating-webhook k8s-mutating-webhook 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
ghcr.io/curium-rocks/k8s-mutating-webhook:mainaaab005242ae
fast-uri@2.1.0
2.4.4

Open the chart page →

2,009
k8s-validating-webhookk8s-validating-webhook0.4.01 of 2See more

k8s-validating-webhook k8s-validating-webhook 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
ghcr.io/curium-rocks/k8s-validating-webhook:main8344061b2f22
fast-uri@2.1.0
2.4.4

Open the chart page →

2,009
kube-admission-controller-starterk8s-validating-webhook0.2.01 of 2See more

kube-admission-controller-starter k8s-validating-webhook 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
ghcr.io/curium-rocks/kube-admission-controller-starter:maine9716966f30b
fast-uri@2.1.0
2.4.4

Open the chart page →

2,166
ghostkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 2See more

ghost kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
fast-uri@3.1.0
3.1.5

Open the chart page →

2,756
portfolio-trackerkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

portfolio-tracker kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
fast-uri@3.1.2
3.1.5

Open the chart page →

1,498
node-redlmatfyVerified publisher0.1.61 of 1See more

node-red lmatfy 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
nodered/node-red:4.1.10-minimald73ae167cb9b
fast-uri@3.1.2
3.1.5

Open the chart page →

1,809
zigbee2mqttlmatfyVerified publisher0.1.141 of 2See more

zigbee2mqtt lmatfy 0.1.14

1 of the 2 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
koenkk/zigbee2mqtt:2.7.260a295b40f4e
fast-uri@3.0.6
3.1.5

Open the chart page →

1,391
logtidelogtideVerified publisher2.1.142 of 4See more

logtide logtide 2.1.14

2 of the 4 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
fast-uri@3.1.2
3.1.5
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
fast-uri@3.1.2
3.1.5

Open the chart page →

2,774
nublado2lsst-sqre0.8.51 of 2See more

nublado2 lsst-sqre 0.8.5

1 of the 2 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
lsstsqre/nublado2:2.0.1b75bf8aaafa4
node-ajv@6.10.2-1
no fix listed

Open the chart page →

17,779
lynxpromptlynxpromptVerified publisher0.1.21 of 3See more

lynxprompt lynxprompt 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
drumsergio/lynxprompt:2.0.75c6afb6679301
fast-uri@3.1.2
3.1.5

Open the chart page →

1,852
docker-mailservermailserverVerified publisher0.2.651 of 9See more

docker-mailserver mailserver 0.2.65

1 of the 9 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
ghcr.io/jeboehm/fetchmailmgr:0.3.2126c4691b28a4
fast-uri@3.0.6
3.1.5

Open the chart page →

10,897
mauticmautic-chartVerified publisher1.0.21 of 3See more

mautic mautic-chart 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
mautic/mautic:7-apacheeb8cc73d97e1
fast-uri@3.1.0
3.1.5

Open the chart page →

8,303
MINTmint8.0.21 of 15See more

MINT mint 8.0.2

1 of the 15 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
mintproject/ensemble-manager:d5656dbc01623e291564d2894c72f0e7cb2408f4222e3b941a36
fast-uri@3.0.6
3.1.5

Open the chart page →

43,341
bofmojaloop5.1.61 of 1See more

bof mojaloop 5.1.6

1 of the 1 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
fast-uri@3.1.0
3.1.5

Open the chart page →

2,457
finance-portalmojaloop5.1.42 of 11See more

finance-portal mojaloop 5.1.4

2 of the 11 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
fast-uri@3.0.6
3.1.5
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
fast-uri@3.0.6
3.1.5

Open the chart page →

14,809
reporting-events-processor-svcmojaloop3.5.31 of 1See more

reporting-events-processor-svc mojaloop 3.5.3

1 of the 1 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
fast-uri@3.0.6
3.1.5

Open the chart page →

2,631
reporting-hub-bop-experience-api-svcmojaloop1.0.31 of 1See more

reporting-hub-bop-experience-api-svc mojaloop 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
fast-uri@3.0.6
3.1.5

Open the chart page →

2,318
security-role-perm-operator-svcmojaloop3.0.01 of 1See more

security-role-perm-operator-svc mojaloop 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
fast-uri@3.1.0
3.1.5

Open the chart page →

2,457
mongo-compassmongo-compass-web-helm1.1.01 of 1See more

mongo-compass mongo-compass-web-helm 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
haohanyang/compass-web:0.5.054f2112602ee
fast-uri@3.1.2
3.1.5

Open the chart page →

2,396
myweatherhelmmyweather1.3.111 of 7See more

myweatherhelm myweather 1.3.11

1 of the 7 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
fast-uri@3.0.1
3.1.5

Open the chart page →

17,929
ixyneoskop2.1.11 of 1See more

ixy neoskop 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
neoskop/ixy:2.1.125152b474f54
fast-uri@3.1.0
3.1.5

Open the chart page →

1,166
nexus-tasksnexus-tasks2.0.01 of 5See more

nexus-tasks nexus-tasks 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-18446.

Container imageDigestPackageFixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
fast-uri@3.1.2
3.1.5

Open the chart page →

3,798

Container images carrying it

130 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
fast-uri@3.1.2
3.1.5
1
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
fast-uri@3.1.0
3.1.5
1
ghcr.io/immich-app/immich-server:v3.2.0ae13784ffcfc
fast-uri@3.1.4
3.1.5
1
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
fast-uri@3.1.3
3.1.5
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
fast-uri@3.1.0
3.1.5
1
ghcr.io/jeboehm/fetchmailmgr:0.3.2126c4691b28a4
fast-uri@3.0.6
3.1.5
1
ghcr.io/jordan-dalby/bytestash:1.5.12eb4f736b8cd4
fast-uri@3.1.2
3.1.5
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
fast-uri@3.0.6
3.1.5
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
fast-uri@3.0.6
3.1.5
1
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
fast-uri@3.1.2
3.1.5
1
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
fast-uri@3.1.2
3.1.5
1
ghcr.io/openclaw/openclaw:2026.6.10af7ea052cf21
fast-uri@3.1.2
3.1.5
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
fast-uri@3.1.2
3.1.5
1
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
fast-uri@3.0.1
3.1.5
1
ghcr.io/open-telemetry/demo:1.12.0-flagduif6bdafaa9075
fast-uri@3.0.1
3.1.5
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
fast-uri@3.1.0
3.1.5
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
fast-uri@3.0.1
3.1.5
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
fast-uri@3.1.2
3.1.5
1
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
fast-uri@3.1.0
3.1.5
1
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
fast-uri@2.2.0
2.4.4
1
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
fast-uri@3.0.6
3.1.5
1
ghcr.io/zazuko/trifid:v6.0.159bda2bf65d4
fast-uri@3.1.2
3.1.5
1
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
fast-uri@3.0.5
3.1.5
1
public.ecr.aws/flanksource/incident-manager-ui:v1.4.317fea799d4fb2f
fast-uri@3.1.3
3.1.5
1
quay.io/netwarps/walletconnect-relay:v2.1.3-rc.15d90b9c193e0
fast-uri@2.1.0
2.4.4
1
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
fast-uri@3.1.3
3.1.5
1
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
fast-uri@3.1.0
3.1.5
1
registry.gitlab.com/dyff/dyff-frontend:0.20.152549f52ae53
fast-uri@3.1.2
3.1.5
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
fast-uri@3.1.0
3.1.5
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
fast-uri@3.1.0
3.1.5
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.