CVE-2026-21226
HighAdvisory
Published 13 Jan 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.009
- 59th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 58
- of 17,781 indexed, latest versions
- Container images
- 56
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Azure Core is vulnerable to deserialization of untrusted data
Carried by container images the latest versions of 58 of 17,781 indexed charts deploy, on 56 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| azure-corepypi | 1.7.0, 1.12.0, 1.23.1, 1.24.0+19 more | 1.38.0 | 56 |
- OSV records
- GHSA-jm66-cg57-jjv5
- Also known as
- PYSEC-2026-1208
Charts affected
58 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| airflowairflow-helmVerified publisher | 8.9.0 | 1 of 4See more | 11,367 |
| netboxbootcVerified publisher | 4.1.1 | 1 of 4See more | 9,145 |
| clearmlallegroaiOfficialVerified publisher | 7.15.0 | 1 of 4See more | 10,622 |
| wazuhwazuh-helm-morgovedVerified publisher | 2.0.7 | 1 of 5See more | 11,384 |
| home-assistantgeek-cookbookVerified publisher | 13.5.0 | 1 of 1See more | 7,705 |
| redashredash | 4.2.0 | 1 of 3See more | 5,987 |
| homeassistantvolker-raschekVerified publisher | 0.2.3 | 1 of 1See more | 6,041 |
| syftopenmined | 0.9.5 | 1 of 6See more | 17,245 |
| wazuhwazuh-helmVerified publisher | 0.0.8 | 1 of 4See more | 6,168 |
| netboxstartechnicaVerified publisher | 5.1.0 | 1 of 4See more | 1,650 |
| convertigoconvertigoOfficialVerified publisher | 8.4.3 | 1 of 5See more | 17,404 |
| openshift-secured-pgadmineximiaitVerified publisher | 0.2.0 | 1 of 2See more | 14,546 |
| kobotoolboxone-acre-fundVerified publisher | 0.7.4 | 2 of 9See more | 18,517 |
| psonoankra-chartsVerified publisher | 1.2.0 | 1 of 2See more | 2,388 |
| pgbenchcloudnative-pgVerified publisher | 0.1.0 | 1 of 1See more | 2,713 |
| cosmotech-copilot-apicosmotech-apiVerified publisher | 0.1.1 | 1 of 1See more | 11,205 |
| appdaemongeek-cookbookVerified publisher | 8.4.2 | 1 of 1See more | 3,461 |
| IMgrycapOfficialVerified publisher | 1.8.0 | 1 of 3See more | 4,132 |
| iris-webappiris-webapp | 0.2.4 | 1 of 2See more | 11,764 |
| difykubeblocksVerified publisher | 0.5.1 | 1 of 5See more | 20,403 |
| litellmlitellm-helm | 0.2.0 | 1 of 1See more | 4,292 |
| mlflow-controllermlflow-deployment-controller | 0.1.8 | 1 of 2See more | 8,957 |
| slo-reportingslo-reportingVerified publisher | 0.3.34 | 1 of 2See more | 2,928 |
| pgadminappscodeVerified publisher | 2026.3.30 | 1 of 1See more | 1,565 |
| pgadminarunalakmalVerified publisher | 0.1.0 | 1 of 1See more | 2,418 |
| swdpgadminarunalakmalVerified publisher | 0.1.0 | 1 of 1See more | 2,418 |
| locationprocessingassist-iot-location-processing | 1.0.0 | 1 of 3See more | 10,061 |
| azure-advanced-backupazure-advanced-backup | 0.4.1 | 1 of 1See more | 4,568 |
| azure-app-exporterazure-app-exporterVerified publisher | 0.4.2 | 1 of 2See more | 1,790 |
| baserowblackbird-cloudVerified publisher | 1.0.17 | 1 of 6See more | 10,145 |
| kube-acp-stackcloudentity | 2.28.0 | 1 of 7See more | 20,900 |
| ibm-toolkit-installcloud-native-toolkit | 0.3.0 | 1 of 1See more | 6,695 |
| iteration-zerocloud-native-toolkit | 0.2.0 | 1 of 1See more | 6,921 |
| galaxykubemancloudve | 2.10.1 | 1 of 7See more | 16,069 |
| metaflowcluster-deploy | 0.2.2 | 1 of 1See more | 8,009 |
| csghubcsghubVerified publisher | 2.4.3 | 1 of 34See more | 58,897 |
| dataflowcsghubVerified publisher | 2.5.0 | 1 of 7See more | 6,632 |
| home-assistantdamounVerified publisher | 1.1.0 | 1 of 1See more | 6,179 |
| redashdasmeta | 0.1.0 | 1 of 1See more | 5,062 |
| mlflowdeliveryheroVerified publisher | 1.0.10 | 1 of 1See more | 4,422 |
| difydify | 1.0.0 | 1 of 4See more | 19,224 |
| datadog-apmfairwinds-incubator | 2.0.0 | 1 of 1See more | 2,785 |
| infrafibonacci-cluster-infraVerified publisher | 1.0.0 | 1 of 4See more | 12,454 |
| batchrunnerflanksourceVerified publisher | 1.0.44 | 1 of 1See more | 5,292 |
| skypilotgeek-cookbookVerified publisher | 0.0.1 | 1 of 3See more | 8,923 |
| opentelemetry-demogpg-dev | 0.33.8 | 1 of 27See more | 49,025 |
| home-assistanthelm-chart-roeiVerified publisher | 2025.3.0 | 1 of 1See more | 4,647 |
| mlflowhelm-charts-nr | 1.0.10 | 1 of 1See more | 4,422 |
| home-assistantkfirfer | 0.5.4 | 1 of 1See more | 6,447 |
| graphiti-mcpkiberonlabs | 0.1.2 | 1 of 1See more | 3,393 |
Container images carrying it
56 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| dpage/ | 781369df9994 | azure-core | 1.38.0 | 3 |
| larribas/ | 05ccb0b46bfb | azure-core | 1.38.0 | 2 |
| acockburn/ | 3a93281d7e94 | azure-core | 1.38.0 | 1 |
| allegroai/ | 713ae38f7daf | azure-core | 1.38.0 | 1 |
| apache/ | 64e58748b6b9 | azure-core | 1.38.0 | 1 |
| apache/ | ce90bdc3d2af | azure-core | 1.38.0 | 1 |
| apache/ | e5560ad0b86e | azure-core | 1.38.0 | 1 |
| apecloud/ | 8ac9947a2c84 | azure-core | 1.38.0 | 1 |
| baserow/ | e0b3c8130b91 | azure-core | 1.38.0 | 1 |
| baserow/ | df0c42eb67e8 | azure-core | 1.38.0 | 1 |
| berkeleyskypilot/ | 8da2f3cda472 | azure-core | 1.38.0 | 1 |
| dpage/ | 18cd5711fc9a | azure-core | 1.38.0 | 1 |
| dpage/ | 37946e4f3e7b | azure-core | 1.38.0 | 1 |
| dpage/ | 50700ac17936 | azure-core | 1.38.0 | 1 |
| dpage/ | 52cb72a9e3da | azure-core | 1.38.0 | 1 |
| dpage/ | 561c1f8f99f2 | azure-core | 1.38.0 | 1 |
| evk02/ | ef6ff257ef35 | azure-core | 1.38.0 | 1 |
| flanksource/ | 689687a7cf95 | azure-core | 1.38.0 | 1 |
| galaxy/ | e5c265fe9fcd | azure-core | 1.38.0 | 1 |
| homeassistant/ | 021e2afc6e57 | azure-core | 1.38.0 | 1 |
| homeassistant/ | 8d000332b09b | azure-core | 1.38.0 | 1 |
| kobotoolbox/ | b15679454415 | azure-core | 1.38.0 | 1 |
| kobotoolbox/ | bcacc01bccd4 | azure-core | 1.38.0 | 1 |
| langgenius/ | 066035f93856 | azure-core | 1.38.0 | 1 |
| langgenius/ | fca918260dd6 | azure-core | 1.38.0 | 1 |
| netboxcommunity/ | 3d652dca5351 | azure-core | 1.38.0 | 1 |
| netboxcommunity/ | 9bf83b350a89 | azure-core | 1.38.0 | 1 |
| opencsghq/ | 47e22aa71870 | azure-core | 1.38.0 | 1 |
| opencsghq/ | b4e849fcf94a | azure-core | 1.38.0 | 1 |
| openmined/ | b72f74a68b32 | azure-core | 1.38.0 | 1 |
| psono/ | 3b974b43ea03 | azure-core | 1.38.0 | 1 |
| redash/ | 00d813437db5 | azure-core | 1.38.0 | 1 |
| redash/ | c5c9148f5c38 | azure-core | 1.38.0 | 1 |
| tachyongroup/ | 7e79b9000856 | azure-core | 1.38.0 | 1 |
| timescale/ | e8d0a9cc3db5 | azure-core | 1.38.0 | 1 |
| wazuh/ | 1da5c38c6a78 | azure-core | 1.38.0 | 1 |
| wazuh/ | f09282d281f6 | azure-core | 1.38.0 | 1 |
| zepai/ | 6ab0ee79926b | azure-core | 1.38.0 | 1 |
| ghcr.io/ | ab63d26a8a2c | azure-core | 1.38.0 | 1 |
| ghcr.io/ | b3b30d04b362 | azure-core | 1.38.0 | 1 |
| ghcr.io/ | 6b64d194a27d | azure-core | 1.38.0 | 1 |
| ghcr.io/ | a2be95de450c | azure-core | 1.38.0 | 1 |
| ghcr.io/ | e59ebde55709 | azure-core | 1.38.0 | 1 |
| ghcr.io/ | 1041d4449e49 | azure-core | 1.38.0 | 1 |
| ghcr.io/ | b472877847f5 | azure-core | 1.38.0 | 1 |
| ghcr.io/ | 06a16d4f279f | azure-core | 1.38.0 | 1 |
| ghcr.io/ | 26c51e44d932 | azure-core | 1.38.0 | 1 |
| ghcr.io/ | 9a5a3eb4a213 | azure-core | 1.38.0 | 1 |
| ghcr.io/ | ec6d67fbedfa | azure-core | 1.38.0 | 1 |
| ghcr.io/ | feffc0b8227d | azure-core | 1.38.0 | 1 |