StackRadarChart IndexLive demo

CVE-2026-22746

Low

Advisory

Published 22 Apr 2026In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 3.7; base score, highest
EPSS: 0.002; 12th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 75; of 17,781 indexed, latest versions
Container images: 73; deployed by those charts
Fix available: 1 of 1; affected package

Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider

Carried by container images the latest versions of 75 of 17,781 indexed charts deploy, on 73 images.

Affected package	Affected versions	Fixed in	Images
spring-security-coremaven	5.7.1, 5.7.2, 5.7.3, 5.7.4+33 more	6.5.10, 7.0.5	73

OSV records: GHSA-vxf7-qj7q-83fh

Charts affected

75 by stars

Chart

Latest

Affected images

Radar Score

appswitcher-serverit-at-m

1 of 1 See more

appswitcher-server it-at-m 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
ghcr.io/it-at-m/appswitcher-server :1.3.0	10006bc0f309	spring-security-core@6.4.5	no fix listed

Open the chart page →

3,774

kf-app-eaiit-at-m

1 of 1 See more

kf-app-eai it-at-m 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
ghcr.io/it-at-m/kf-app-eai :1.0.6	5de339b3d537	spring-security-core@6.5.3	6.5.10

Open the chart page →

1,947

komgalinkding

1 of 1 See more

komga linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
gotson/komga :1.22.0	ba892ab3e082	spring-security-core@6.4.1	no fix listed

Open the chart page →

3,131

nacosnacos-yunye

1 of 1 See more

nacos nacos-yunye 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
nacos/nacos-server :v3.0.1	30a39cb0c54d	spring-security-core@6.4.4	no fix listed

Open the chart page →

1,783

file-system-ms-helm-chartnotesprojectchart

1 of 2 See more

file-system-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
vlebediantsev/file-system-ms-final :latest	10393a89b4a8	spring-security-core@5.7.2	no fix listed

Open the chart page →

5,875

logic-ms-helm-chartnotesprojectchart

1 of 2 See more

logic-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
vlebediantsev/logic-ms :latest	df8bf38c535b	spring-security-core@5.7.2	no fix listed

Open the chart page →

6,852

registration-ms-helm-chartnotesprojectchart

1 of 2 See more

registration-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
vlebediantsev/registration-ms-final :latest	427af418b75e	spring-security-core@5.7.2	no fix listed

Open the chart page →

5,916

user-data-ms-helm-chartnotesprojectchart

1 of 2 See more

user-data-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
vlebediantsev/user-data-ms-final-final :latest	9319437f3c8f	spring-security-core@5.7.2	no fix listed

Open the chart page →

5,873

my-bloody-jenkinsodavid

1 of 1 See more

my-bloody-jenkins odavid 0.1.218

1 of the 1 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
odavid/my-bloody-jenkins :2.462.3-306	e7ab3bbc948e	spring-security-core@5.8.14	no fix listed

Open the chart page →

5,826

bpjstk-serviceopenshift

1 of 6 See more

bpjstk-service openshift 1.0.0

1 of the 6 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
andrianrf/backoffice-be :latest	6036614803d4	spring-security-core@5.7.8	no fix listed

Open the chart page →

34,671

fineractopenshift

1 of 4 See more

fineract openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
apache/fineract :1.12.1	a83cf1980609	spring-security-core@6.4.4	no fix listed

Open the chart page →

7,792

operatonoperaton

1 of 1 See more

operaton operaton 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
operaton/operaton :1.0.0-beta-4	b35867ffe4d8	spring-security-core@6.4.4	no fix listed

Open the chart page →

2,003

management-portalradar-base

1 of 1 See more

management-portal radar-base 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
ghcr.io/radar-base/managementportal/management-portal :3.0.0	c1b37e821f72	spring-security-core@5.7.12	no fix listed

Open the chart page →

3,182

smartquerysearchhub

1 of 1 See more

smartquery searchhub 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
commerceexperts/smartquery-service :2.2.0	9e33ad89baf6	spring-security-core@5.7.10	no fix listed

Open the chart page →

1,528

seataseata

1 of 1 See more

seata seata 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
seataio/seata-server :latest	703b5de7f1a6	spring-security-core@5.7.11	no fix listed

Open the chart page →

4,245

sistas-chatbotsistas-chatbot

1 of 6 See more

sistas-chatbot sistas-chatbot 5.0.2

1 of the 6 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
jhipster/jhipster-registry :latest	7184525acd4d	spring-security-core@5.7.3	no fix listed

Open the chart page →

5,856

static-src-people-detector-appstatic-src-people-detector-chart

1 of 6 See more

static-src-people-detector-app static-src-people-detector-chart 1.5.5

1 of the 6 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
fimperato/detected-info-notification :1.2.6-RELEASE	6441f6545613	spring-security-core@5.7.5	no fix listed

Open the chart page →

13,646

sn-consolestreamnative

1 of 1 See more

sn-console streamnative 1.13.0

1 of the 1 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
streamnative/private-cloud-console :v2.3.27-all	91e54375e154	spring-security-core@6.3.8	no fix listed

Open the chart page →

1,827

netforge-besvtech

1 of 3 See more

netforge-be svtech 0.0.2

1 of the 3 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
conductoross/conductor :3.31.0	9fba127693e6	spring-security-core@6.3.9	no fix listed

Open the chart page →

4,674

rundecksvtech-public-helm-charts

1 of 2 See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_rundeck :v1.2.2	6e368ace0977	spring-security-core@5.8.3	no fix listed

Open the chart page →

18,756

thingsboardthingsboard

1 of 12 See more

thingsboard thingsboard 0.1.3

1 of the 12 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
thingsboard/tb-node :3.4.1	645f43b688f7	spring-security-core@5.7.1	no fix listed

Open the chart page →

25,394

timetabletwomartens

1 of 1 See more

timetable twomartens 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
2martens/timetable :latest	bd1ba6ab84c9	spring-security-core@6.5.5	6.5.10

Open the chart page →

1,527

wahlrechttwomartens

1 of 1 See more

wahlrecht twomartens 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
2martens/wahlrecht :latest	ba2c3040dab0	spring-security-core@6.5.2	6.5.10

Open the chart page →

1,689

hazelcastwenerme

1 of 2 See more

hazelcast wenerme 5.10.2

1 of the 2 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
hazelcast/management-center :5.5.2	991ddb27c251	spring-security-core@6.3.3	no fix listed

Open the chart page →

2,634

zahori-serverzahori

1 of 2 See more

zahori-server zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-22746.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-server :0.1.17	b2de13916f3e	spring-security-core@5.7.6	no fix listed

Open the chart page →

5,846

Container images carrying it

73 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
thingsboard/tb-node :3.6.0	f40a542832c4	spring-security-core@5.7.7	no fix listed	1
thingsboard/tb-postgres :latest	2d17e4e36edc	spring-security-core@6.4.11	no fix listed	1
thmmniii/fbs-core :v1.27.1	5438517d9fc2	spring-security-core@5.7.8	no fix listed	1
treskon/portrait :DEV-latest	88e813f22347	spring-security-core@6.3.5	no fix listed	1
vlebediantsev/file-system-ms-final :latest	10393a89b4a8	spring-security-core@5.7.2	no fix listed	1
vlebediantsev/logic-ms :latest	df8bf38c535b	spring-security-core@5.7.2	no fix listed	1
vlebediantsev/registration-ms-final :latest	427af418b75e	spring-security-core@5.7.2	no fix listed	1
vlebediantsev/user-data-ms-final-final :latest	9319437f3c8f	spring-security-core@5.7.2	no fix listed	1
vrijbrp/haal-centraal-brp-bevragen :develop	5c770c2ae48c	spring-security-core@5.7.8	no fix listed	1
zahoriaut/zahori-server :0.1.17	b2de13916f3e	spring-security-core@5.7.6	no fix listed	1
zbalogh/reservation-api-server :1.0.9	7c247e399a1f	spring-security-core@5.7.3	no fix listed	1
ghcr.io/eximeebpms/eximeebpms-bpm-platform :run-1.3.0	acb8dbce38fd	spring-security-core@7.0.3	7.0.5	1
ghcr.io/gla-rad/enav-api-gateway :latest	8f4345c77dda	spring-security-core@7.0.4	7.0.5	1
ghcr.io/gla-rad/enav-ckeeper :latest	415323ef112b	spring-security-core@7.0.4	7.0.5	1
ghcr.io/gla-rad/enav-eureka :latest	05002092c621	spring-security-core@7.0.4	7.0.5	1
ghcr.io/gla-rad/enav-msg-broker :latest	6fe372e4e481	spring-security-core@7.0.4	7.0.5	1
ghcr.io/gla-rad/enav-vdes-controller :latest	c4c52955814f	spring-security-core@7.0.4	7.0.5	1
ghcr.io/gregperlinli/certvault :2.12.0	a7d0cc9e260a	spring-security-core@6.5.7	6.5.10	1
ghcr.io/it-at-m/appswitcher-server :1.3.0	10006bc0f309	spring-security-core@6.4.5	no fix listed	1
ghcr.io/it-at-m/kf-app-eai :1.0.6	5de339b3d537	spring-security-core@6.5.3	6.5.10	1
ghcr.io/kafbat/kafka-ui :v1.2.0	185da4ad3e88	spring-security-core@6.4.3	no fix listed	1
ghcr.io/radar-base/managementportal/management-portal :3.0.0	c1b37e821f72	spring-security-core@5.7.12	no fix listed	1
ghcr.io/star-whale/server :0.6.15	8368359c8dd0	spring-security-core@5.7.6	no fix listed	1