CVE-2026-18798

High

Advisory

Published 25 Aug 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.015; 73rd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,770; of 17,790 indexed, latest versions
Container images: 1,648; deployed by those charts
Fix available: 2 of 3; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,770 of 17,790 indexed charts deploy, on 1,648 images.

Affected package	Affected versions	Fixed in	Images
opensslapk	3.5.0-r0, 3.5.1-r0, 3.5.2-r0, 3.5.4-r0+4 more	3.5.8-r0	1,190
openssldeb	3.5.1-1, 3.5.1-1+deb13u1, 3.5.4-1~deb13u1, 3.5.4-1~deb13u2+10 more	3.5.5-1ubuntu3.4, 3.5.7-1~deb13u2	447
nodejsdeb	4.2.6~dfsg-1ubuntu4.1, 7.10.1-2nodesource1~xenial1, 8.9.4-1nodesource1, 8.10.0~dfsg-2ubuntu0.4+3 more	no fix listed	11

OSV records: ALPINE-CVE-2026-18798 DEBIAN-CVE-2026-18798 UBUNTU-CVE-2026-18798
Also known as: USN-8678-1

Charts affected

1,770 by stars

Chart

Latest

Affected images

Radar Score

haproxy-ingresswenerme

0.16.1

1 of 1 See more

haproxy-ingress wenerme 0.16.1

1 of the 1 container images this version deploys carry CVE-2026-18798.

Container image	Digest	Package	Fixed in
quay.io/jcmoraisjr/haproxy-ingress :v0.16.1	6fd744191ef6	openssl@3.5.6-r0	3.5.8-r0

Open the chart page →

794

juicefs-csi-driverwenerme

0.32.5

1 of 5 See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-18798.

Container image	Digest	Package	Fixed in
juicedata/csi-dashboard :v0.32.5	b5a407a27f62	openssl@3.5.7-r0	3.5.8-r0

Open the chart page →

9,183

prometheus-nats-exporterwenerme

2.23.2

1 of 1 See more

prometheus-nats-exporter wenerme 2.23.2

1 of the 1 container images this version deploys carry CVE-2026-18798.

Container image	Digest	Package	Fixed in
natsio/prometheus-nats-exporter :0.20.2	c623b608e148	openssl@3.5.7-r0	3.5.8-r0

Open the chart page →

165

vaultwenerme

0.34.1

2 of 2 See more

vault wenerme 0.34.1

2 of the 2 container images this version deploys carry CVE-2026-18798.

Container image	Digest	Package	Fixed in
hashicorp/vault :2.0.4	5be49781ecf7	openssl@3.5.7-r0	3.5.8-r0
hashicorp/vault-k8s :1.7.6	55e27b080c9b	openssl@3.5.7-r0	3.5.8-r0

Open the chart page →

549

victoria-metrics-k8s-stackwenerme

0.92.1

2 of 7 See more

victoria-metrics-k8s-stack wenerme 0.92.1

2 of the 7 container images this version deploys carry CVE-2026-18798.

Container image	Digest	Package	Fixed in
grafana/grafana :13.1.1	7cb8c64c4d57	openssl@3.5.7-r0	3.5.8-r0
quay.io/kiwigrid/k8s-sidecar :2.8.1	abb55b2165c6	openssl@3.5.6-r0	3.5.8-r0

Open the chart page →

1,910

wexa-studiowexa-studio

1.2.0

4 of 15 See more

wexa-studio wexa-studio 1.2.0

4 of the 15 container images this version deploys carry CVE-2026-18798.

Container image	Digest	Package	Fixed in
library/postgres :15-alpine	fe0737ba566a	openssl@3.5.7-r0	3.5.8-r0
temporalio/admin-tools :1.29.1-tctl-1.18.4-cli-1.5.0	a3a52e6ca122	openssl@3.5.0-r0	3.5.8-r0
temporalio/server :1.29.1	c1e3326b2ce1	openssl@3.5.0-r0	3.5.8-r0
temporalio/ui :2.44.0	0b36e00aad30	openssl@3.5.4-r0	3.5.8-r0

Open the chart page →

15,044

whereaboutswhereabouts

0.3.0

1 of 1 See more

whereabouts whereabouts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-18798.

Container image	Digest	Package	Fixed in
ghcr.io/k8snetworkplumbingwg/whereabouts :v0.9.4	f279fd7dc112	openssl@3.5.6-r0	3.5.8-r0

Open the chart page →

618

wikiwikijs

3.0.0

2 of 2 See more

wiki wikijs 3.0.0

2 of the 2 container images this version deploys carry CVE-2026-18798.

Container image	Digest	Package	Fixed in
library/postgres :18	4ef4dbc939d6	openssl@3.5.6-1~deb13u2	3.5.7-1~deb13u2
requarks/wiki :2	68f0d1848261	openssl@3.5.6-r0	3.5.8-r0

Open the chart page →

5,483

metabasewiremind

2.27.5-wiremind0

1 of 1 See more

metabase wiremind 2.27.5-wiremind0

1 of the 1 container images this version deploys carry CVE-2026-18798.

Container image	Digest	Package	Fixed in
metabase/metabase :v0.61.1.x	9491ed11c901	openssl@3.5.6-r0	3.5.8-r0

Open the chart page →

1,640

ovh-exporterwiremind

1.2.0

1 of 1 See more

ovh-exporter wiremind 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-18798.

Container image	Digest	Package	Fixed in
ghcr.io/wiremind/ovh-exporter :v2.3.1	609f955bd977	openssl@3.5.7-r0	3.5.8-r0

Open the chart page →

209

wordpress-alpinewordpress-alpine

1.5.18

2 of 6 See more

wordpress-alpine wordpress-alpine 1.5.18

2 of the 6 container images this version deploys carry CVE-2026-18798.

Container image	Digest	Package	Fixed in
library/memcached :1.6.45	dc561d52bb8a	openssl@3.5.6-1~deb13u2	3.5.7-1~deb13u2
ghcr.io/shesselink81/nginx-alpine :7.1.0.0	9783481cad2a	openssl@3.5.7-r0	3.5.8-r0

Open the chart page →

4,063

Wordpresswordpress-mariadb

1.0.2

1 of 2 See more

Wordpress wordpress-mariadb 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-18798.

Container image	Digest	Package	Fixed in
library/wordpress :latest	5a93c470ae82	openssl@3.5.6-1~deb13u2	3.5.7-1~deb13u2

Open the chart page →

5,676

wicekxxczaki

0.1.255

1 of 2 See more

wicek xxczaki 0.1.255

1 of the 2 container images this version deploys carry CVE-2026-18798.

Container image	Digest	Package	Fixed in
library/alpine :3	28bd5fe8b56d	openssl@3.5.7-r0	3.5.8-r0

Open the chart page →

149

helm-demoyahoon-helm-demo

1.0.0

1 of 1 See more

helm-demo yahoon-helm-demo 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-18798.

Container image	Digest	Package	Fixed in
ghcr.io/yahoon/helm-demo :1.0.0	2930290a758c	openssl@3.5.6-1~deb13u1	3.5.7-1~deb13u2

Open the chart page →

1,304

prometheus-monitoring-stackyotron-helm-charts

1.2.0

1 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

1 of the 3 container images this version deploys carry CVE-2026-18798.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	openssl@3.5.7-r0	3.5.8-r0

Open the chart page →

899

endlessh-gozekker6

0.4.0

1 of 1 See more

endlessh-go zekker6 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-18798.

Container image	Digest	Package	Fixed in
ghcr.io/shizunge/endlessh-go :2026.0730.0	8826dad32623	openssl@3.5.6-1~deb13u2	3.5.7-1~deb13u2

Open the chart page →

478

homerzekker6

8.35.0

1 of 1 See more

homer zekker6 8.35.0

1 of the 1 container images this version deploys carry CVE-2026-18798.

Container image	Digest	Package	Fixed in
b4bz/homer :v26.08.3	febc8967c9f7	openssl@3.5.7-r0	3.5.8-r0

Open the chart page →

149

language-toolzekker6

1.12.1

2 of 2 See more

language-tool zekker6 1.12.1

2 of the 2 container images this version deploys carry CVE-2026-18798.

Container image	Digest	Package	Fixed in
erikvl87/languagetool :6.7-dockerupdate-3	e1ea6a975388	openssl@3.5.5-r0	3.5.8-r0
library/alpine :3	28bd5fe8b56d	openssl@3.5.7-r0	3.5.8-r0

Open the chart page →

1,571

zipkinzipkin

0.5.0

1 of 1 See more

zipkin zipkin 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-18798.

Container image	Digest	Package	Fixed in
openzipkin/zipkin-slim :3.6.0	a69e1057df36	openssl@3.5.5-r0	3.5.8-r0

Open the chart page →

1,159

zoo-project-druzoo-project

0.10.4

3 of 6 See more

zoo-project-dru zoo-project 0.10.4

3 of the 6 container images this version deploys carry CVE-2026-18798.

Container image	Digest	Package	Fixed in
curlimages/curl :8.21.0	7c12af72ceb3	openssl@3.5.7-r0	3.5.8-r0
library/postgres :18.4-alpine3.24	9a8afca54e78	openssl@3.5.7-r0	3.5.8-r0
library/rabbitmq :4.3.2-alpine	835cbc6fabce	openssl@3.5.7-r0	3.5.8-r0

Open the chart page →

7,929

Container images carrying it

1,648 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
dunglas/mercure :v0 :v0.24.2	916834e49961	openssl@3.5.6-r0	3.5.8-r0	2
fireflyiii/core :version-6.5.9	fe4ecec4c2ba	openssl@3.5.5-1~deb13u1	3.5.7-1~deb13u2	2
fireflyiii/data-importer :version-2.2.3	ab52bf932546	openssl@3.5.5-1~deb13u1	3.5.7-1~deb13u2	2
gisaia/arlas-wui :28.0.3	b83b3e067173	openssl@3.5.7-r0	3.5.8-r0	2
gisaia/arlas-wui-builder :28.0.1	a35977a5bb7d	openssl@3.5.7-r0	3.5.8-r0	2
gisaia/arlas-wui-hub :28.0.2	1a3cc43d822f	openssl@3.5.6-r0	3.5.8-r0	2
gotenberg/gotenberg :8.36.0	87c16b9f3642	openssl@3.5.6-1~deb13u2	3.5.7-1~deb13u2	2
gotson/komga :1.26.3	6c2a967bbe9a	openssl@3.5.5-1ubuntu3.3	3.5.5-1ubuntu3.4	2
grafana/grafana :12.3.1	2175aaa91c96	openssl@3.5.4-r0	3.5.8-r0	2
grafana/grafana :12.3.3	9e1e77ade304	openssl@3.5.5-r0	3.5.8-r0	2
grafana/grafana :12.4.1	e932bd6ed0e0	openssl@3.5.5-r0	3.5.8-r0	2
hashicorp/vault :2.0.4	5be49781ecf7	openssl@3.5.7-r0	3.5.8-r0	2
hashicorp/vault-k8s :1.7.6	55e27b080c9b	openssl@3.5.7-r0	3.5.8-r0	2
helmforge/kubectl :1.35.3	c3f97e954c47	openssl@3.5.5-r0	3.5.8-r0	2
hetznercloud/hcloud-cloud-controller-manager :v1.37.0	c139e7220dbc	openssl@3.5.7-r0	3.5.8-r0	2
ilum/api :6.7.3	624fd09528c8	openssl@3.5.6-1~deb13u2	3.5.7-1~deb13u2	2
ilum/ui :6.7.3	998937726679	openssl@3.5.5-r0	3.5.8-r0	2
jenkins/jenkins :2.541.3-jdk21	c4098086090c	openssl@3.5.5-1~deb13u1	3.5.7-1~deb13u2	2
jhaals/yopass :14.9.0	934e4f2c016f	openssl@3.5.6-1~deb13u2	3.5.7-1~deb13u2	2
jupyterhub/configurable-http-proxy :5.3.0 :latest	69a7170eeeda	openssl@3.5.7-r0	3.5.8-r0	2
kiwigrid/k8s-sidecar :1.30.9	8c06e1ba643a	openssl@3.5.1-r0	3.5.8-r0	2
kubeshop/testkube-api-server :2.13.2	44166c28422f	openssl@3.5.7-r0	3.5.8-r0	2
kutt/kutt :latest :v3.2.6	fa3d24a89b04	openssl@3.5.7-r0	3.5.8-r0	2
library/alpine :3.23	fd791d74b689	openssl@3.5.7-r0	3.5.8-r0	2
library/bash :5 :latest	a19c811ee9e9	openssl@3.5.7-r0	3.5.8-r0	2
library/buildpack-deps :curl	04907bdd423b	openssl@3.5.6-1~deb13u2	3.5.7-1~deb13u2	2
library/caddy :2.11.4-alpine :2-alpine	5f5c8640aae0	openssl@3.5.7-r0	3.5.8-r0	2
library/caddy :latest	df7f1c2fb114	openssl@3.5.7-r0	3.5.8-r0	2
library/debian :stable-slim	04634311a8d5	openssl@3.5.6-1~deb13u2	3.5.7-1~deb13u2	2
library/eclipse-mosquitto :2 :2.1.2-alpine	6f8d8a947c50	openssl@3.5.7-r0	3.5.8-r0	2
library/nginx :latest	6e23479198b9	openssl@3.5.5-1~deb13u2	3.5.7-1~deb13u2	2
library/nginx :1.29.4	9dd288848f44	openssl@3.5.4-1~deb13u2	3.5.7-1~deb13u2	2
library/node :24.21.0-alpine3.23	159fe6464903	openssl@3.5.7-r0	3.5.8-r0	2
library/node :24.21.0-alpine	be80f76cf40e	openssl@3.5.7-r0	3.5.8-r0	2
library/postgres :18.1	1090bc3a8ccf	openssl@3.5.4-1~deb13u2	3.5.7-1~deb13u2	2
library/postgres :18.0	6f3e42ad37de	openssl@3.5.1-1+deb13u1	3.5.7-1~deb13u2	2
library/postgres :13-alpine	fb9065b6e3e2	openssl@3.5.4-r0	3.5.8-r0	2
library/redis :8.6.6-alpine	75934ddb37bf	openssl@3.5.7-r0	3.5.8-r0	2
library/redmine :6.1.3-trixie	f474a901faec	openssl@3.5.6-1~deb13u2	3.5.7-1~deb13u2	2
library/telegraf :1.40-alpine	e2f55b0afaa3	openssl@3.5.7-r0	3.5.8-r0	2
library/traefik :v3.7.1	6b9cbca6fac4	openssl@3.5.6-r0	3.5.8-r0	2
library/traefik :v3.7.13	f86a2cab1b5c	openssl@3.5.7-r0	3.5.8-r0	2
library/wordpress :6.8.3-apache :6.8-apache	30bff39330d1	openssl@3.5.4-1~deb13u1	3.5.7-1~deb13u2	2
linuxserver/ddclient :4.0.0	6468911d00b1	openssl@3.5.7-r0	3.5.8-r0	2
listmonk/listmonk :latest :v6.2.0	f535d59e1499	openssl@3.5.7-r0	3.5.8-r0	2
mesosphere/kubectl :v1.35.0-alpine	ea01a9387771	openssl@3.5.4-r0	3.5.8-r0	2
metabase/metabase :v0.61.1.x	9491ed11c901	openssl@3.5.6-r0	3.5.8-r0	2
mikefarah/yq :4 :latest	cfc4eee65859	openssl@3.5.7-r0	3.5.8-r0	2
moby/buildkit :v0.32.2-rootless	504731e577c2	openssl@3.5.7-r0	3.5.8-r0	2
mojaloop/reporting-events-processor-svc :v3.5.1	1e0d24d28512	openssl@3.5.1-r0	3.5.8-r0	2