StackRadar

CVE-2026-19032

Medium

Advisory

Published 28 Sept 2026In the index since 29 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.005
42nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,007
of 17,966 indexed, latest versions
Container images
1,009
deployed by those charts
Fix available
1 of 1
affected package

jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution

Carried by container images the latest versions of 1,007 of 17,966 indexed charts deploy, on 1,009 images.

Affected packageAffected versionsFixed inImages
jackson-databindmaven2.8.1, 2.8.4, 2.8.6, 2.8.7+105 more2.18.10, 2.21.6, 2.22.2, 3.1.6+1 more1,009
OSV records
GHSA-wjgm-6hv5-3cvf
Trending
Rank 2 in indexed charts, since 29 Sept 2026. See the ranking →

Charts affected

1,007 by stars
ChartLatestAffected imagesRadar Score
magentomagento3.2.31 of 12See more

magento magento 3.2.3

1 of the 12 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
magento/magento-cloud-docker-opensearch:2.5-1.4.059fb6f0f1461
jackson-databind@2.14.1
2.18.10

Open the chart page →

14,469
Practica_4_Recuperacion_helmmca-03-02-practica4-recuperacionVerified publisher1.0.11 of 6See more

Practica_4_Recuperacion_helm mca-03-02-practica4-recuperacion 1.0.1

1 of the 6 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
torrespro/mca-worker:2.0.06d3bd305a1ba
jackson-databind@2.10.0
2.18.10

Open the chart page →

19,975
mcpmcp-chartsVerified publisher0.0.233 of 7See more

mcp mcp-charts 0.0.23

3 of the 7 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
glarad/mc-service-registry:latest7b02b9e7f1ef
jackson-databind@2.21.4
2.21.6
ghcr.io/maritimeconnectivity/identityregistry:latest91de8dfffafe
jackson-databind@2.21.5
2.21.6
ghcr.io/maritimeconnectivity/mcpkeycloakspi:latestcbe34aa88c42
jackson-databind@2.21.5
2.21.6

Open the chart page →

7,324
metabasemetabase-helmVerified publisher2.7.11 of 1See more

metabase metabase-helm 2.7.1

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
metabase/metabase:v0.46.09ebdc664a6b2
jackson-databind@2.14.1
2.18.10

Open the chart page →

2,277
clowder2ncsaVerified publisher1.9.72 of 12See more

clowder2 ncsa 1.9.7

2 of the 12 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:8.12.215d4647fd491
jackson-databind@2.13.4.2
2.18.10
bitnamilegacy/keycloak:20.0.5cb04e49e6eb1
jackson-databind@2.13.4.2
2.18.10

Open the chart page →

39,408
glowrootnovum-rgi-charts1.0.101 of 2See more

glowroot novum-rgi-charts 1.0.10

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
novumrgi/glowroot-central:0.14.0-beta.38c54790675b1
jackson-databind@2.13.0
2.18.10

Open the chart page →

2,382
openccuopenccuVerified publisher3.89.111 of 1See more

openccu openccu 3.89.11

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/openccu/openccu:3.89.11.202609193cfcb30e1921
jackson-databind@2.18.2
2.18.10

Open the chart page →

1,583
data-prepperopensearch-project-helm-chartsVerified publisher0.3.11 of 1See more

data-prepper opensearch-project-helm-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
opensearchproject/data-prepper:2.8.057c25fa01d3c
jackson-databind@2.17.0
2.18.10

Open the chart page →

1,884
infinispanopenshift0.9.01 of 1See more

infinispan openshift 0.9.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
quay.io/infinispan/server:16.282db6cbba3d9
jackson-databind@2.22.1
2.22.2

Open the chart page →

78
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.13 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.1

3 of the 34 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.1.0-kafka4402ba7fd544
jackson-databind@2.21.2
2.21.6
ghcr.io/open-telemetry/demo:3.1.0-fraud-detectiona07ee694304b
jackson-databind@2.22.1
2.22.2
ghcr.io/open-telemetry/demo:3.1.0-addfd7a4697116
jackson-databind@2.22.1
2.22.2

Open the chart page →

22,392
opikopikOfficialVerified publisher2.2.861See more

opik opik 2.2.86

1 container image this version deploys carries CVE-2026-19032.

Container imageDigestPackageFixed in
library/zookeeper:3.9.4dfa9ba46d14b
jackson-databind@2.15.2
2.18.10

Open the chart page →

—
todo-apipavanelthepu0.1.01 of 2See more

todo-api pavanelthepu 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
pavanelthepu/todo-api:1.0.2f47658e3b24c
jackson-databind@2.12.3
2.18.10

Open the chart page →

2,580
spring-boot-api-apppiominVerified publisher0.3.111 of 1See more

spring-boot-api-app piomin 0.3.11

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
piomin/sample-spring-kotlin-microservice:1.1871f784dd6bc
jackson-databind@2.13.4
2.18.10

Open the chart page →

7,837
portraitportraitVerified publisher0.2.132 of 8See more

portrait portrait 0.2.13

2 of the 8 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
library/elasticsearch:7.17.0332c6d416808
jackson-databind@2.10.4
2.18.10
treskon/portrait:DEV-latest88e813f22347
jackson-databind@2.15.1
2.18.10

Open the chart page →

33,687
JenkinsprasoonjenkinsVerified publisher0.1.01 of 1See more

Jenkins prasoonjenkins 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.6

Open the chart page →

2,766
nifi-registryprofyu1.14.0-r0011 of 1See more

nifi-registry profyu 1.14.0-r001

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
apache/nifi-registry:1.14.0090b7f87ec7f
jackson-databind@2.12.3
2.18.10

Open the chart page →

4,726
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
library/neo4j:2026.02.25ab4ab0358cf
jackson-databind@2.20.1
2.21.6

Open the chart page →

9,277
kafka-managerradar-baseVerified publisher2.3.11 of 1See more

kafka-manager radar-base 2.3.1

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
radarbase/kafka-manager:1.3.3.181d2af7dd5a4e
jackson-databind@2.9.4
2.18.10

Open the chart page →

3,992
shinyproxyremche0.6.61 of 2See more

shinyproxy remche 0.6.6

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
remche/shinyproxy:2.6.18bcda8a04d3b
jackson-databind@2.12.6.1
2.18.10

Open the chart page →

4,041
reportportalreportportal-ioOfficialVerified publisher26.8.123 of 15See more

reportportal reportportal-io 26.8.12

3 of the 15 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
reportportal/service-api:5.15.4bf193091525a
jackson-databind@2.21.2
2.21.6
reportportal/service-authorization:5.15.16a954407b417
jackson-databind@2.21.4
2.21.6
reportportal/service-jobs:5.15.299d27d58d6b4
jackson-databind@2.15.4
2.18.10

Open the chart page →

13,192
reservation-appreservation-app1.0.91 of 4See more

reservation-app reservation-app 1.0.9

1 of the 4 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
zbalogh/reservation-api-server:1.0.97c247e399a1f
jackson-databind@2.13.4
2.18.10

Open the chart page →

6,788
resurfaceresurfaceioVerified publisher3.9.01 of 3See more

resurface resurfaceio 3.9.0

1 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
resurfaceio/resurface:3.7.84d5cda2f64109
jackson-databind@2.18.2
2.18.10

Open the chart page →

7,732
dev-feedrm3lVerified publisher3.1.21 of 3See more

dev-feed rm3l 3.1.2

1 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
rm3l/dev-feed-api:latestf03921cd3b26
jackson-databind@2.13.4.2
2.18.10

Open the chart page →

10,221
service-names-port-numbersrm3lVerified publisher0.26.11 of 1See more

service-names-port-numbers rm3l 0.26.1

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
rm3l/service-names-port-numbers:0.12.162d1cc4223e5
jackson-databind@2.13.0
2.18.10

Open the chart page →

10,371
elasticsearchromanow-helm-chartsVerified publisher1.7.11 of 2See more

elasticsearch romanow-helm-charts 1.7.1

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
library/elasticsearch:7.17.8fdc73b3249c1
jackson-databind@2.10.4
2.18.10

Open the chart page →

6,349
logstashromanow-helm-chartsVerified publisher1.5.01 of 1See more

logstash romanow-helm-charts 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
library/logstash:7.17.817a4f64e9cf5
jackson-databind@2.9.10.8
2.18.10

Open the chart page →

7,823
routrroutr0.0.101 of 2See more

routr routr 0.0.10

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
fonoster/routr:1.0.0-rc52ca65af17cbc
jackson-databind@2.10.0
2.18.10

Open the chart page →

5,052
nexusscalified-nexusVerified publisher3.96.31 of 1See more

nexus scalified-nexus 3.96.3

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
sonatype/nexus3:3.96.3a406f4e9dc14
jackson-databind@3.2.1
3.2.2

Open the chart page →

33
seldon-coreseldon0.2.72 of 3See more

seldon-core seldon 0.2.7

2 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
seldonio/apife:0.2.7ba81b17f00eb
jackson-databind@2.8.11.2
2.18.10
seldonio/cluster-manager:0.2.729e362bb1ba2
jackson-databind@2.8.11.2
2.18.10

Open the chart page →

13,827
sentinel-dashboardsentinel-dashboardVerified publisher0.1.01 of 1See more

sentinel-dashboard sentinel-dashboard 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
royalwang/sentinel-dashboard:1.8.4df99e2499f91
jackson-databind@2.12.6.1
2.18.10

Open the chart page →

4,289
sentry-k8ssentry-k8sVerified publisher1.4.11 of 11See more

sentry-k8s sentry-k8s 1.4.1

1 of the 11 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:7.6.683dbca3efd2a
jackson-databind@2.13.5
2.18.10

Open the chart page →

18,055
querysiakhooiVerified publisher1.0.01 of 1See more

query siakhooi 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
siakhooi/query:1.0.0f1f4b5b1b870
jackson-databind@3.1.0
3.1.6

Open the chart page →

1,939
clickhousesignoz24.1.181 of 3See more

clickhouse signoz 24.1.18

1 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
signoz/zookeeper:3.7.1fcc4a3288154
jackson-databind@2.13.2.1
2.18.10

Open the chart page →

4,804
signserver-cesignserverOfficialVerified publisher2.4.41 of 1See more

signserver-ce signserver 2.4.4

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
keyfactor/signserver-ce:7.7.1f8d64caeaea9
jackson-databind@2.20.1
2.21.6

Open the chart page →

1,174
nexus-iq-server-hasonatypeVerified publisher207.1.01 of 2See more

nexus-iq-server-ha sonatype 207.1.0

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
sonatype/nexus-iq-server:1.207.1a70014ed10b1
jackson-databind@2.22.1
2.22.2

Open the chart page →

125
ocean-metric-exporterspot1.1.11 of 1See more

ocean-metric-exporter spot 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
gcr.io/spotinst-artifacts/spot-ocean-metric-exporter:1.0.5ae57b62291aa
jackson-databind@2.19.2
2.21.6

Open the chart page →

1,584
stardogstardog3.1.01 of 3See more

stardog stardog 3.1.0

1 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
stardog/stardog:latest2714e5c4b3c1
jackson-databind@2.18.3
2.18.10

Open the chart page →

495
starwhalestarwhaleVerified publisher0.6.151 of 4See more

starwhale starwhale 0.6.15

1 of the 4 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/star-whale/server:0.6.158368359c8dd0
jackson-databind@2.13.2.2
2.18.10

Open the chart page →

14,050
ckanstatcan0.0.352 of 8See more

ckan statcan 0.0.35

2 of the 8 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
library/solr:8.11.18c5f7881cebb
jackson-databind@2.12.3
2.18.10
library/zookeeper:3.5.5b7a76ec06f68
jackson-databind@2.9.8
2.18.10

Open the chart page →

106,525
streamvisorstreamvisorVerified publisher4.1.61 of 1See more

streamvisor streamvisor 4.1.6

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/streamvisor/streamvisor:4.1.40bc598b2ac9a
jackson-databind@2.21.2
2.21.6

Open the chart page →

3,062
strimzi-drain-cleanerstrimzi1.6.11 of 1See more

strimzi-drain-cleaner strimzi 1.6.1

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
quay.io/strimzi/drain-cleaner:1.6.15fb28e9f30d0
jackson-databind@2.21.2
2.21.6

Open the chart page →

647
strimzi-drain-cleanerstrimzi-drain-cleaner1.6.11 of 1See more

strimzi-drain-cleaner strimzi-drain-cleaner 1.6.1

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
quay.io/strimzi/drain-cleaner:1.6.15fb28e9f30d0
jackson-databind@2.21.2
2.21.6

Open the chart page →

647
graylogt3n1.0.01 of 3See more

graylog t3n 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
graylog2/server:2.4.3-38ff28c66e6c1
jackson-databind@2.8.9
2.18.10

Open the chart page →

8,106
snowplowt3n0.0.11 of 1See more

snowplow t3n 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
snowplow/scala-stream-collector-pubsub:2.2.041d318841516
jackson-databind@2.9.10.6
2.18.10

Open the chart page →

2,304
tenuretenureVerified publisher1.0.61 of 2See more

tenure tenure 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
mongodb/mongodb-atlas-local:8e118f5c131c5
jackson-databind@2.18.9
2.18.10

Open the chart page →

2,813
jenkinstestchart0.1.91 of 2See more

jenkins testchart 0.1.9

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
jenkins/jenkins:2.426.1-jdk11b470bcdc4ecd
jackson-databind@2.15.2
2.18.10

Open the chart page →

9,399
jenkinstest-jenkins9.1.01 of 2See more

jenkins test-jenkins 9.1.0

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
jenkins/jenkins:2.426.1-jdk11b470bcdc4ecd
jackson-databind@2.15.2
2.18.10

Open the chart page →

9,399
tocktock0.6.36 of 9See more

tock tock 0.6.3

6 of the 9 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
tock/bot_admin:25.10.7df3e38c77a38
jackson-databind@2.20.0
2.21.6
tock/bot_api:25.10.7dd5d5c70e333
jackson-databind@2.20.0
2.21.6
tock/build_worker:25.10.7080cb6b08d5b
jackson-databind@2.20.0
2.21.6
tock/duckling:25.10.7ac1f3f1a1e9c
jackson-databind@2.20.0
2.21.6
tock/kotlin_compiler:25.10.7c9c0fb40089a
jackson-databind@2.20.0
2.21.6
tock/nlp_api:25.10.7c04ffe67b977
jackson-databind@2.20.0
2.21.6

Open the chart page →

14,952
wavefront-adapter-for-istiowavefront0.1.41 of 2See more

wavefront-adapter-for-istio wavefront 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
wavefronthq/proxy:9.2d1064d28f6eb
jackson-databind@2.11.0
2.18.10

Open the chart page →

16,485
spark-operatorwikimedia2.2.71 of 1See more

spark-operator wikimedia 2.2.7

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/kubeflow/spark-operator/controller:2.2.1865ff4da5686
jackson-databind@2.13.4.2
2.18.10

Open the chart page →

60,034

Container images carrying it

1,009 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/snowdrop/spring-boot-rest-http-example:2.7b1a054613715
jackson-databind@2.13.5
2.18.10
1
quay.io/srcmaxim/gradle-example-app:1.1.37c3fc28746ef
jackson-databind@2.12.3
2.18.10
1
quay.io/sshaaf/keycloak-mcp-server:0.4.0b7e9cba72f8a
jackson-databind@2.22.0
2.22.2
1
quay.io/streamshub/console-operator:0.11.0e40bbfeae125
jackson-databind@2.19.2
2.21.6
1
quay.io/strimzi/operator:0.45.158c727cd2e68
jackson-databind@2.16.2
2.18.10
1
quay.io/strimzi/operator:0.32.0c5e0e5dca750
jackson-databind@2.13.4.1
2.18.10
1
quay.io/strimzi/operator:0.36.1e9e03b31007c
jackson-databind@2.14.2
2.18.10
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
jackson-databind@2.17.2
2.18.10
1
registry.gitlab.com/dyff/workflows-aggregator:0.16.1126450354eba9
jackson-databind@2.13.5
2.18.10
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.