StackRadar

CVE-2026-19032

Medium

Advisory

Published 28 Sept 2026In the index since 29 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.005
42nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,032
of 17,939 indexed, latest versions
Container images
1,027
deployed by those charts
Fix available
1 of 1
affected package

jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution

Carried by container images the latest versions of 1,032 of 17,939 indexed charts deploy, on 1,027 images.

Affected packageAffected versionsFixed inImages
jackson-databindmaven2.8.1, 2.8.4, 2.8.6, 2.8.7+105 more2.18.10, 2.21.6, 2.22.2, 3.1.6+1 more1,027
OSV records
GHSA-wjgm-6hv5-3cvf
Trending
Rank 2 in indexed charts, since 29 Sept 2026. See the ranking →

Charts affected

1,032 by stars
ChartLatestAffected imagesRadar Score
jenkinsjenkinsciOfficialVerified publisher5.9.641 of 2See more

jenkins jenkinsci 5.9.64

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
jenkins/jenkins:2.568.3-jdk21c1e4c349365f
jackson-databind@3.1.3
3.1.6

Open the chart page →

2,731
sonarqubesonarqubeVerified publisher10.0.0+5211 of 3See more

sonarqube sonarqube 10.0.0+521

1 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
library/sonarqube:10.0.0-communityef9723cf4fe4
jackson-databind@2.14.1
2.18.10

Open the chart page →

6,944
metabasepmint932.27.61 of 1See more

metabase pmint93 2.27.6

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
metabase/metabase:v0.61.1.x9491ed11c901
jackson-databind@2.21.2
2.21.6

Open the chart page →

1,768
keycloakcodecentricVerified publisher18.10.01 of 3See more

keycloak codecentric 18.10.0

1 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:17.0.1-legacy68f9f38c8f30
jackson-databind@2.12.1
2.18.10

Open the chart page →

7,878
kafka-uikafka-uiVerified publisher1.6.51 of 1See more

kafka-ui kafka-ui 1.6.5

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/kafbat/kafka-ui:v1.5.07cda86a33344
jackson-databind@2.21.2
2.21.6

Open the chart page →

828
keycloakxcodecentricVerified publisher7.3.21 of 1See more

keycloakx codecentric 7.3.2

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.7.482a77884f3af
jackson-databind@2.21.5
2.21.6

Open the chart page →

141
jiraatlassian-data-centerVerified publisher2.0.151 of 2See more

jira atlassian-data-center 2.0.15

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
atlassian/jira-software:11.3.114046f4a668a4
jackson-databind@2.21.5
2.21.6

Open the chart page →

1,515
strimzi-kafka-operatorstrimzi-kafka-operator1.2.01 of 1See more

strimzi-kafka-operator strimzi-kafka-operator 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:1.2.077f8fa8121a6
jackson-databind@3.1.5
3.1.6

Open the chart page →

170
trinotrino1.42.21 of 1See more

trino trino 1.42.2

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
trinodb/trino:4801565e8cac299
jackson-databind@2.21.2
2.21.6

Open the chart page →

1,454
keycloakcloudpirates-keycloakVerified publisher0.21.411 of 3See more

keycloak cloudpirates-keycloak 0.21.41

1 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.7.482a77884f3af
jackson-databind@2.21.5
2.21.6

Open the chart page →

4,334
graylogkong-zVerified publisher3.0.341 of 5See more

graylog kong-z 3.0.34

1 of the 5 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.19.6e321cb03c643
jackson-databind@2.18.8
2.18.10

Open the chart page →

2,807
nexus3stevehipwellVerified publisher5.26.01 of 2See more

nexus3 stevehipwell 5.26.0

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
sonatype/nexus3:3.96.0-ubia1f2dbdc4c94
jackson-databind@3.2.1
3.2.2

Open the chart page →

113
strimzi-kafka-operatorstrimzi1.2.01 of 1See more

strimzi-kafka-operator strimzi 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:1.2.077f8fa8121a6
jackson-databind@3.1.5
3.1.6

Open the chart page →

170
datahubdatahubVerified publisher1.1.52 of 4See more

datahub datahub 1.1.5

2 of the 4 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
acryldata/datahub-frontend-react:v1.7.0.199513cc1c45e
jackson-databind@2.21.5
2.21.6
acryldata/datahub-upgrade:v1.7.0.1c3db54d8fb94
jackson-databind@2.21.2
2.21.6

Open the chart page →

1,013
milvusmilvus4.0.311 of 5See more

milvus milvus 4.0.31

1 of the 5 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.8.2d538416d5afe
jackson-databind@2.12.3
2.18.10

Open the chart page →

178,976
signozsignoz0.143.01 of 5See more

signoz signoz 0.143.0

1 of the 5 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
signoz/zookeeper:3.7.1fcc4a3288154
jackson-databind@2.13.2.1
2.18.10

Open the chart page →

7,842
nacosygqygq2Verified publisher2.1.101 of 4See more

nacos ygqygq2 2.1.10

1 of the 4 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
nacos/nacos-server:v3.0.20e951a1d07bb
jackson-databind@2.18.3
2.18.10

Open the chart page →

5,105
akhqakhq0.28.01 of 1See more

akhq akhq 0.28.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
tchiotludo/akhq:0.28.0c2824dc2ae44
jackson-databind@3.1.3
3.1.6

Open the chart page →

1,784
guacamoleberyju-org1.4.21 of 3See more

guacamole beryju-org 1.4.2

1 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
guacamole/guacamole:1.6.0f344085e618b
jackson-databind@2.19.0
2.21.6

Open the chart page →

4,001
gocdgocdOfficialVerified publisher2.18.11 of 2See more

gocd gocd 2.18.1

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
gocd/gocd-server:v26.1.0720d1012b93f
jackson-databind@2.22.0
2.22.2

Open the chart page →

1,655
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
wazuh/wazuh-indexer:4.14.3b149b30da686
jackson-databind@2.18.2
2.18.10

Open the chart page →

11,972
dependency-trackevryfs-ossVerified publisher1.5.51 of 3See more

dependency-track evryfs-oss 1.5.5

1 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
dependencytrack/apiserver:4.6.3485ac0952c02
jackson-databind@2.13.4
2.18.10

Open the chart page →

2,552
glasskube-operatorglasskubeOfficialVerified publisher0.12.21 of 3See more

glasskube-operator glasskube 0.12.2

1 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
glasskube/operator:0.12.2be5133100d63
jackson-databind@2.15.2
2.18.10

Open the chart page →

12,552
milvusmilvus-helm5.0.281 of 4See more

milvus milvus-helm 5.0.28

1 of the 4 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
apachepulsar/pulsar:3.0.79c9947de139d
jackson-databind@2.14.2
2.18.10

Open the chart page →

11,769
rocketmqrocketmq12.6.01 of 2See more

rocketmq rocketmq 12.6.0

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
apacherocketmq/rocketmq-dashboard:2.1.0ce78506bd6fe
jackson-databind@2.18.3
2.18.10

Open the chart page →

6,739
cerebrowiremindVerified publisher2.4.01 of 1See more

cerebro wiremind 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
lmenezes/cerebro:0.9.47d9e2b77e459
jackson-databind@2.10.5.1
2.18.10

Open the chart page →

968
apicurio-registryapicurio-registry-helmVerified publisher3.8.02 of 2See more

apicurio-registry apicurio-registry-helm 3.8.0

2 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
quay.io/apicurio/apicurio-registry-kube-sync:1.0.170ef31840269
jackson-databind@2.12.5
2.18.10
quay.io/apicurio/apicurio-registry-mem:2.5.8.Final3b036692d546
jackson-databind@2.15.2
2.18.10

Open the chart page →

6,907
bitbucketatlassian-data-centerVerified publisher2.0.151 of 1See more

bitbucket atlassian-data-center 2.0.15

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
atlassian/bitbucket:10.2.705933f2b1cfd
jackson-databind@2.21.5
2.21.6

Open the chart page →

37,864
zipkincarlosjgp0.2.01 of 2See more

zipkin carlosjgp 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
openzipkin/zipkin:2.21.060c3970df479
jackson-databind@2.10.3
2.18.10

Open the chart page →

3,380
zookeepercloudpirates-zookeeperVerified publisher0.15.01 of 1See more

zookeeper cloudpirates-zookeeper 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
library/zookeeper:3.9.57d0f24ebb67b
jackson-databind@2.15.2
2.18.10

Open the chart page →

3,164
apim3graviteeioVerified publisher4.12.202 of 4See more

apim3 graviteeio 4.12.20

2 of the 4 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
graviteeio/apim-gateway:4.12.20-debian8f1a14449381
jackson-databind@2.18.1
2.18.10
graviteeio/apim-management-api:4.12.20-debiand30d085395ca
jackson-databind@2.21.2
2.21.6

Open the chart page →

4,865
polarisapache-polarisOfficialVerified publisher1.3.0-incubating1 of 1See more

polaris apache-polaris 1.3.0-incubating

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
apache/polaris:lateste66366e783f1
jackson-databind@3.2.0
3.2.2

Open the chart page →

646
cloudbeaveravistoVerified publisher1.1.71 of 1See more

cloudbeaver avisto 1.1.7

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
dbeaver/cloudbeaver:26.1.287ab86d00f8c
jackson-databind@2.15.2
2.18.10

Open the chart page →

1,971
druiddruid-helmVerified publisher37.0.21 of 3See more

druid druid-helm 37.0.2

1 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
apache/druid:37.0.00116fb802786
jackson-databind@2.19.2
2.21.6

Open the chart page →

4,149
paperless-ngxfmjstudios0.2.81 of 5See more

paperless-ngx fmjstudios 0.2.8

1 of the 5 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
apache/tika:2.9.0.092d055a84e9e
jackson-databind@2.15.2
2.18.10

Open the chart page →

32,529
hivemq-operatorhivemqOfficialVerified publisher0.11.621 of 2See more

hivemq-operator hivemq 0.11.62

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
hivemq/hivemq-operator:4.7.10241d6a8e1963
jackson-databind@2.13.2.2
2.18.10

Open the chart page →

8,210
cassandrakubelauncherVerified publisher0.1.291 of 1See more

cassandra kubelauncher 0.1.29

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/cassandradigest-pinned4a2625365fc6
jackson-databind@2.19.2
2.21.6

Open the chart page →

1,165
kafkakubelauncherVerified publisher0.1.271 of 1See more

kafka kubelauncher 0.1.27

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/kafkadigest-pinned1b681e349375
jackson-databind@2.16.2
2.18.10

Open the chart page →

1,418
keycloakkubelauncherVerified publisher0.4.51 of 1See more

keycloak kubelauncher 0.4.5

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/keycloakdigest-pinned6ffd1e8b6845
jackson-databind@2.21.5
2.21.6

Open the chart page →

931
zookeeperkubelauncherVerified publisher0.2.111 of 1See more

zookeeper kubelauncher 0.2.11

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/zookeeperdigest-pinned7826e9caa461
jackson-databind@2.15.2
2.18.10

Open the chart page →

1,222
minecraft-proxyminecraft-server-chartsVerified publisher3.10.01 of 1See more

minecraft-proxy minecraft-server-charts 3.10.0

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
itzg/bungeecord:latestde76286c0e73
jackson-databind@3.1.3
3.1.6

Open the chart page →

3,004
neo4jneo4j-helm4.3.2-11 of 1See more

neo4j neo4j-helm 4.3.2-1

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
library/neo4j:4.3.2-enterprise56a9453c4064
jackson-databind@2.10.5.1
2.18.10

Open the chart page →

2,696
sonarqube-ltssonarqubeVerified publisher1.0.16+981 of 4See more

sonarqube-lts sonarqube 1.0.16+98

1 of the 4 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
library/sonarqube:8.9.2-community88cd63154d4b
jackson-databind@2.11.4
2.18.10

Open the chart page →

4,173
camunda-bpm-platformcamunda-community-hub7.6.111 of 1See more

camunda-bpm-platform camunda-community-hub 7.6.11

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
camunda/camunda-bpm-platform:latestbcc5bb0542df
jackson-databind@2.15.2
2.18.10

Open the chart page →

1,249
penpotcodechemVerified publisher1.0.102 of 3See more

penpot codechem 1.0.10

2 of the 3 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
penpotapp/backend:1.16.0-betae978e871be07
jackson-databind@2.13.2.2
2.18.10
penpotapp/exporter:1.16.0-betafa7086ad92b1
jackson-databind@2.9.10.1
2.18.10

Open the chart page →

29,448
metabasedeliveryheroVerified publisher0.14.41 of 1See more

metabase deliveryhero 0.14.4

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
metabase/metabase:v0.45.21fb334ce4820
jackson-databind@2.13.4.2
2.18.10

Open the chart page →

2,613
guacamoledmunozv04Verified publisher0.3.41 of 2See more

guacamole dmunozv04 0.3.4

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
guacamole/guacamole:1.6.0f344085e618b
jackson-databind@2.19.0
2.21.6

Open the chart page →

4,001
hdfsgaffer2.2.11 of 2See more

hdfs gaffer 2.2.1

1 of the 2 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
gchq/hdfs:3.3.35ec58edbb2db
jackson-databind@2.13.2.2
2.18.10

Open the chart page →

5,718
grayloggroundhog2k0.13.101 of 1See more

graylog groundhog2k 0.13.10

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
graylog/graylog:7.1.9598bd41fefd5
jackson-databind@2.21.2
2.21.6

Open the chart page →

1,268
kafkakafka18.0.11 of 1See more

kafka kafka 18.0.1

1 of the 1 container images this version deploys carry CVE-2026-19032.

Container imageDigestPackageFixed in
kafkace/kafka:v3.7.1-63ba8d27adc206bf5a4
jackson-databind@2.16.2
2.18.10

Open the chart page →

3,671

Container images carrying it

1,027 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
folioci/mod-entities-links:latest3e2412815c0f
jackson-databind@3.1.5
3.1.6
1
folioci/mod-erm-usage:latest56a8421de884
jackson-databind@3.1.5
3.1.6
1
folioci/mod-erm-usage-harvester:latest2d6767933c59
jackson-databind@2.18.6
2.18.10
1
folioci/mod-event-config:latest0192adad3897
jackson-databind@3.1.4
3.1.6
1
folioci/mod-feesfines:latestfe3a7049f2fb
jackson-databind@2.18.2
2.18.10
1
folioci/mod-finance:latest14450bc15430
jackson-databind@2.21.4
2.21.6
1
folioci/mod-finance-storage:latest4bc4057abaea
jackson-databind@3.1.4
3.1.6
1
folioci/mod-gobi:latestc58c989dac44
jackson-databind@2.20.1
2.21.6
1
folioci/mod-inn-reach:latestcc8584e43382
jackson-databind@3.1.4
3.1.6
1
folioci/mod-inventory-storage:latestf92ff0a3ca40
jackson-databind@3.1.5
3.1.6
1
folioci/mod-inventory-update:latestba84812b4d58
jackson-databind@2.18.2
2.18.10
1
folioci/mod-invoice:latest45b7b13e81e1
jackson-databind@3.1.4
3.1.6
1
folioci/mod-invoice-storage:latest0bc720abcb78
jackson-databind@2.21.5
2.21.6
1
folioci/mod-ldp:latestb55696fd9065
jackson-databind@2.15.4
2.18.10
1
folioci/mod-licenses:latestcfd6109bf477
jackson-databind@2.18.7
2.18.10
1
folioci/mod-login:latest88de493f86db
jackson-databind@2.16.1
2.18.10
1
folioci/mod-login-saml:latest5f3358ccaa0f
jackson-databind@2.21.2
2.21.6
1
folioci/mod-marccat:latest1b57d690d568
jackson-databind@2.9.4
2.18.10
1
folioci/mod-notes:latest998ac4782e0d
jackson-databind@2.21.5
2.21.6
1
folioci/mod-notify:latesta8c1a90005fc
jackson-databind@3.1.4
3.1.6
1
folioci/mod-oa:latestae3b069d4ba5
jackson-databind@2.11.1
2.18.10
1
folioci/mod-oai-pmh:latest5cd5ef063f2a
jackson-databind@2.18.2
2.18.10
1
folioci/mod-orders:latestfc4528220fb8
jackson-databind@3.1.4
3.1.6
1
folioci/mod-orders-storage:latestceeaacc3bf16
jackson-databind@3.1.4
3.1.6
1
folioci/mod-organizations:latest7dc9ccf3d937
jackson-databind@2.18.6
2.18.10
1
folioci/mod-organizations-storage:lateste46892405fde
jackson-databind@2.21.4
2.21.6
1
folioci/mod-password-validator:latestb31d75f2bf7b
jackson-databind@3.1.4
3.1.6
1
folioci/mod-patron:latest5f213acfe2f8
jackson-databind@2.18.2
2.18.10
1
folioci/mod-patron-blocks:latestde7318069a67
jackson-databind@2.21.5
2.21.6
1
folioci/mod-permissions:latest5363e98c6299
jackson-databind@2.18.6
2.18.10
1
folioci/mod-pubsub:latest0a4fa4ad5d72
jackson-databind@2.18.6
2.18.10
1
folioci/mod-quick-marc:latest4d70ebda4d00
jackson-databind@2.21.5
2.21.6
1
folioci/mod-remote-storage:latest4f12177123dc
jackson-databind@2.21.4
2.21.6
1
folioci/mod-rtac:latestc959b2d6142f
jackson-databind@2.18.2
2.18.10
1
folioci/mod-search:latest44d7ee9acdf6
jackson-databind@3.1.5
3.1.6
1
folioci/mod-sender:latestd88a675dddf0
jackson-databind@2.18.2
2.18.10
1
folioci/mod-serials-management:latest571fa1ffe8c9
jackson-databind@2.11.1
2.18.10
1
folioci/mod-service-interaction:latestf53c327a48e8
jackson-databind@2.11.1
2.18.10
1
folioci/mod-source-record-manager:latesta940caf026ee
jackson-databind@2.21.5
2.21.6
1
folioci/mod-tags:latest6e8beeb70272
jackson-databind@2.21.4
2.21.6
1
folioci/mod-template-engine:latestd105c585da30
jackson-databind@2.18.2
2.18.10
1
folioci/mod-user-import:latest1807734472bd
jackson-databind@2.18.6
2.18.10
1
folioci/mod-users:latest6f60033321b0
jackson-databind@2.21.4
2.21.6
1
folioci/mod-users-bl:latest4e2d96c9340d
jackson-databind@2.18.2
2.18.10
1
folioci/okapi:latestdf29ac807a45
jackson-databind@3.1.5
3.1.6
1
fonoster/routr:1.0.0-rc52ca65af17cbc
jackson-databind@2.10.0
2.18.10
1
fonoster/routr-edgeport:2.13.6d08a8a574a50
jackson-databind@2.9.6
2.18.10
1
fonoster/routr-requester:2.13.6e0c823506eb2
jackson-databind@2.9.6
2.18.10
1
frankescobar/allure-docker-service:2.27.00815040339a9
jackson-databind@2.16.1
2.18.10
1
frankescobar/allure-docker-service:2.35.14154286c0209
jackson-databind@2.20.0
2.21.6
1

syft 1.42.1 · advisories as of 29 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.