StackRadar

CVE-2026-22751

Medium

Advisory

Published 21 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.8
base score, highest
EPSS
0.001
2nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
25
of 17,926 indexed, latest versions
Container images
24
deployed by those charts
Fix available
1 of 1
affected package

Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured

Carried by container images the latest versions of 25 of 17,926 indexed charts deploy, on 24 images.

Affected packageAffected versionsFixed inImages
spring-security-coremaven6.4.1, 6.4.3, 6.4.4, 6.4.5+8 more6.5.10, 7.0.524
OSV records
GHSA-x2wq-9x2f-fhj7

Charts affected

25 by stars
ChartLatestAffected imagesRadar Score
kafka-uikafka-uiVerified publisher1.6.51 of 1See more

kafka-ui kafka-ui 1.6.5

1 of the 1 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
ghcr.io/kafbat/kafka-ui:v1.5.07cda86a33344
spring-security-core@6.5.9
6.5.10

Open the chart page →

787
nacosygqygq2Verified publisher2.1.101 of 4See more

nacos ygqygq2 2.1.10

1 of the 4 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
nacos/nacos-server:v3.0.20e951a1d07bb
spring-security-core@6.4.4
no fix listed

Open the chart page →

5,064
rocketmqrocketmq12.6.01 of 2See more

rocketmq rocketmq 12.6.0

1 of the 2 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
apacherocketmq/rocketmq-dashboard:2.1.0ce78506bd6fe
spring-security-core@6.4.5
no fix listed

Open the chart page →

6,712
thingsboardcetic0.1.21 of 2See more

thingsboard cetic 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
thingsboard/tb-postgres:latest2d17e4e36edc
spring-security-core@6.4.11
no fix listed

Open the chart page →

5,656
rocketmq-clusterrocketmq12.6.01 of 2See more

rocketmq-cluster rocketmq 12.6.0

1 of the 2 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
apacherocketmq/rocketmq-dashboard:2.1.0ce78506bd6fe
spring-security-core@6.4.5
no fix listed

Open the chart page →

6,712
structurizrvirtualrootVerified publisher0.5.01 of 1See more

structurizr virtualroot 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
structurizr/onpremises:2025.11.094b5ffb5119c8
spring-security-core@6.4.6
no fix listed

Open the chart page →

4,762
cbioportalcbioportalOfficialVerified publisher1.1.01 of 1See more

cbioportal cbioportal 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
cbioportal/cbioportal:6.4.1-web-shenandoah08debbd2dbf9
spring-security-core@6.5.5
6.5.10

Open the chart page →

4,006
cert-vaultcert-vaultOfficialVerified publisher2.12.01 of 7See more

cert-vault cert-vault 2.12.0

1 of the 7 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
ghcr.io/gregperlinli/certvault:2.12.0a7d0cc9e260a
spring-security-core@6.5.7
6.5.10

Open the chart page →

16,556
enavenav-service-architectureVerified publisher0.0.74 of 10See more

enav enav-service-architecture 0.0.7

4 of the 10 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
ghcr.io/gla-rad/enav-api-gateway:latest8f4345c77dda
spring-security-core@7.0.4
7.0.5
ghcr.io/gla-rad/enav-eureka:latest05002092c621
spring-security-core@7.0.4
7.0.5
ghcr.io/gla-rad/enav-msg-broker:latest6fe372e4e481
spring-security-core@7.0.4
7.0.5
ghcr.io/gla-rad/enav-vdes-controller:latestc4c52955814f
spring-security-core@7.0.4
7.0.5

Open the chart page →

13,338
kafka-uiappscodeVerified publisher2026.3.301 of 1See more

kafka-ui appscode 2026.3.30

1 of the 1 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
ghcr.io/kafbat/kafka-ui:v1.5.07cda86a33344
spring-security-core@6.5.9
6.5.10

Open the chart page →

787
bluerange-serverbluerangeOfficialVerified publisher1.4.01 of 1See more

bluerange-server bluerange 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
bluerange/bluerange:26.2.0503577ef9143
spring-security-core@6.4.5
no fix listed

Open the chart page →

1,855
clusterfactoryclusterfactory0.2.01 of 5See more

clusterfactory clusterfactory 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
jenkins/jenkins:2.541.3-jdk21c4098086090c
spring-security-core@6.5.7
6.5.10

Open the chart page →

7,466
gitea-jenkinsclusterfactory0.1.11 of 5See more

gitea-jenkins clusterfactory 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
jenkins/jenkins:2.541.3-jdk21c4098086090c
spring-security-core@6.5.7
6.5.10

Open the chart page →

7,239
castlemockcnieg2.0.11 of 1See more

castlemock cnieg 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
castlemock/castlemock:latestb7f3f1527ba9
spring-security-core@6.4.4
no fix listed

Open the chart page →

4,859
kafka-uidoubanVerified publisher1.5.21 of 1See more

kafka-ui douban 1.5.2

1 of the 1 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
ghcr.io/kafbat/kafka-ui:v1.2.0185da4ad3e88
spring-security-core@6.4.3
no fix listed

Open the chart page →

1,348
fineractfineract-openshift0.1.11 of 4See more

fineract fineract-openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
apache/fineract:1.12.1a83cf1980609
spring-security-core@6.4.4
no fix listed

Open the chart page →

7,594
cc-spring-appgridgainVerified publisher1.0.61 of 1See more

cc-spring-app gridgain 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
gridgain/cloud-connector:2025.5.15ab838d7d3cb
spring-security-core@6.5.7
6.5.10

Open the chart page →

1,800
appswitcher-serverit-at-mOfficialVerified publisher2.0.21 of 1See more

appswitcher-server it-at-m 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/appswitcher-server:1.3.010006bc0f309
spring-security-core@6.4.5
no fix listed

Open the chart page →

3,992
kf-app-eaiit-at-mOfficialVerified publisher0.1.71 of 1See more

kf-app-eai it-at-m 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/kf-app-eai:1.0.65de339b3d537
spring-security-core@6.5.3
6.5.10

Open the chart page →

2,089
komgalinkding0.2.31 of 1See more

komga linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
gotson/komga:1.22.0ba892ab3e082
spring-security-core@6.4.1
no fix listed

Open the chart page →

3,188
nacosnacos-yunyeVerified publisher1.0.31 of 1See more

nacos nacos-yunye 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
nacos/nacos-server:v3.0.130a39cb0c54d
spring-security-core@6.4.4
no fix listed

Open the chart page →

1,992
fineractopenshift0.1.11 of 4See more

fineract openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
apache/fineract:1.12.1a83cf1980609
spring-security-core@6.4.4
no fix listed

Open the chart page →

7,594
operatonoperatonVerified publisher1.0.51 of 1See more

operaton operaton 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
operaton/operaton:1.0.0-beta-4b35867ffe4d8
spring-security-core@6.4.4
no fix listed

Open the chart page →

2,189
timetabletwomartensVerified publisher0.2.01 of 1See more

timetable twomartens 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
2martens/timetable:latestbd1ba6ab84c9
spring-security-core@6.5.5
6.5.10

Open the chart page →

1,626
wahlrechttwomartensVerified publisher0.3.01 of 1See more

wahlrecht twomartens 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-22751.

Container imageDigestPackageFixed in
2martens/wahlrecht:latestba2c3040dab0
spring-security-core@6.5.2
6.5.10

Open the chart page →

1,786

Container images carrying it

24 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
apache/fineract:1.12.1a83cf1980609
spring-security-core@6.4.4
no fix listed
2
apacherocketmq/rocketmq-dashboard:2.1.0ce78506bd6fe
spring-security-core@6.4.5
no fix listed
2
jenkins/jenkins:2.541.3-jdk21c4098086090c
spring-security-core@6.5.7
6.5.10
2
ghcr.io/kafbat/kafka-ui:v1.5.07cda86a33344
spring-security-core@6.5.9
6.5.10
2
2martens/timetable:latestbd1ba6ab84c9
spring-security-core@6.5.5
6.5.10
1
2martens/wahlrecht:latestba2c3040dab0
spring-security-core@6.5.2
6.5.10
1
bluerange/bluerange:26.2.0503577ef9143
spring-security-core@6.4.5
no fix listed
1
castlemock/castlemock:latestb7f3f1527ba9
spring-security-core@6.4.4
no fix listed
1
cbioportal/cbioportal:6.4.1-web-shenandoah08debbd2dbf9
spring-security-core@6.5.5
6.5.10
1
gotson/komga:1.22.0ba892ab3e082
spring-security-core@6.4.1
no fix listed
1
gridgain/cloud-connector:2025.5.15ab838d7d3cb
spring-security-core@6.5.7
6.5.10
1
nacos/nacos-server:v3.0.20e951a1d07bb
spring-security-core@6.4.4
no fix listed
1
nacos/nacos-server:v3.0.130a39cb0c54d
spring-security-core@6.4.4
no fix listed
1
operaton/operaton:1.0.0-beta-4b35867ffe4d8
spring-security-core@6.4.4
no fix listed
1
structurizr/onpremises:2025.11.094b5ffb5119c8
spring-security-core@6.4.6
no fix listed
1
thingsboard/tb-postgres:latest2d17e4e36edc
spring-security-core@6.4.11
no fix listed
1
ghcr.io/gla-rad/enav-api-gateway:latest8f4345c77dda
spring-security-core@7.0.4
7.0.5
1
ghcr.io/gla-rad/enav-eureka:latest05002092c621
spring-security-core@7.0.4
7.0.5
1
ghcr.io/gla-rad/enav-msg-broker:latest6fe372e4e481
spring-security-core@7.0.4
7.0.5
1
ghcr.io/gla-rad/enav-vdes-controller:latestc4c52955814f
spring-security-core@7.0.4
7.0.5
1
ghcr.io/gregperlinli/certvault:2.12.0a7d0cc9e260a
spring-security-core@6.5.7
6.5.10
1
ghcr.io/it-at-m/appswitcher-server:1.3.010006bc0f309
spring-security-core@6.4.5
no fix listed
1
ghcr.io/it-at-m/kf-app-eai:1.0.65de339b3d537
spring-security-core@6.5.3
6.5.10
1
ghcr.io/kafbat/kafka-ui:v1.2.0185da4ad3e88
spring-security-core@6.4.3
no fix listed
1

syft 1.42.1 · advisories as of 28 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.