StackRadar

CVE-2026-27830

High

Advisory

Published 25 Feb 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.9
base score, highest
EPSS
0.005
43rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
20
of 17,781 indexed, latest versions
Container images
21
deployed by those charts
Fix available
1 of 1
affected package

c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

Carried by container images the latest versions of 20 of 17,781 indexed charts deploy, on 21 images.

Affected packageAffected versionsFixed inImages
c3p0maven0.9.5.2, 0.9.5.3, 0.9.5.4, 0.9.5.50.12.021
OSV records
GHSA-5476-xc4j-rqcv

Charts affected

20 by stars
ChartLatestAffected imagesRadar Score
feedbacksystemthm-mni-iiVerified publisher0.47.11 of 10See more

feedbacksystem thm-mni-ii 0.47.1

1 of the 10 container images this version deploys carry CVE-2026-27830.

Container imageDigestPackageFixed in
thmmniii/fbs-runner:v1.27.186105349c1a3
c3p0@0.9.5.4
0.12.0

Open the chart page →

28,534
soarv113assist-iot-cybersecurity-monitoring-soar0.1.31 of 5See more

soarv113 assist-iot-cybersecurity-monitoring-soar 0.1.3

1 of the 5 container images this version deploys carry CVE-2026-27830.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_ir-thv:latestc8b6c7eaa0cd
c3p0@0.9.5.4
0.12.0

Open the chart page →

17,896
nifid4nVerified publisher2.0.01 of 5See more

nifi d4n 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-27830.

Container imageDigestPackageFixed in
apache/nifi-registry:1.26.07cdfd8deec92
c3p0@0.9.5.4
0.12.0

Open the chart page →

5,398
airbyteairbyte-v2Verified publisher2.2.03 of 10See more

airbyte airbyte-v2 2.2.0

3 of the 10 container images this version deploys carry CVE-2026-27830.

Container imageDigestPackageFixed in
airbyte/server:2.2.070e125498a1c
c3p0@0.9.5.4
0.12.0
airbyte/worker:2.2.08060b88b29c8
c3p0@0.9.5.4
0.12.0
airbyte/workload-api-server:2.2.042093cff86e9
c3p0@0.9.5.4
0.12.0

Open the chart page →

12,473
blackduck-alertblackduck8.4.01 of 4See more

blackduck-alert blackduck 8.4.0

1 of the 4 container images this version deploys carry CVE-2026-27830.

Container imageDigestPackageFixed in
blackducksoftware/blackduck-alert:8.4.090cca32de2cc
c3p0@0.9.5.5
0.12.0

Open the chart page →

4,292
rundeckcloudnativeapp0.1.01 of 2See more

rundeck cloudnativeapp 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-27830.

Container imageDigestPackageFixed in
rundeck/rundeck:3.0.16b13e8059ad72
c3p0@0.9.5.2
0.12.0

Open the chart page →

23,665
nifi-registryd4nVerified publisher1.0.01 of 2See more

nifi-registry d4n 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-27830.

Container imageDigestPackageFixed in
apache/nifi-registry:1.26.07cdfd8deec92
c3p0@0.9.5.4
0.12.0

Open the chart page →

5,398
apache-ranger-admindata-platform-stableVerified publisher0.2.01 of 2See more

apache-ranger-admin data-platform-stable 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-27830.

Container imageDigestPackageFixed in
egdsandaru/apache-ranger-admin:1.0.0681baa1926f4
c3p0@0.9.5.3
0.12.0

Open the chart page →

8,245
rundeckdwardu-helm-charts0.3.41 of 2See more

rundeck dwardu-helm-charts 0.3.4

1 of the 2 container images this version deploys carry CVE-2026-27830.

Container imageDigestPackageFixed in
rundeck/rundeck:3.2.74d64fe56f767
c3p0@0.9.5.4
0.12.0

Open the chart page →

19,802
teedygeek-cookbookVerified publisher6.2.01 of 1See more

teedy geek-cookbook 6.2.0

1 of the 1 container images this version deploys carry CVE-2026-27830.

Container imageDigestPackageFixed in
sismics/docs:v1.10f4b0ef019cf1
c3p0@0.9.5.5
0.12.0

Open the chart page →

26,944
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.81 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

1 of the 5 container images this version deploys carry CVE-2026-27830.

Container imageDigestPackageFixed in
jingking/geonetwork-hnap:4.2.843e74ab234e1
c3p0@0.9.5.4
0.12.0

Open the chart page →

34,754
video-analytics-demogpu-operator0.1.91 of 3See more

video-analytics-demo gpu-operator 0.1.9

1 of the 3 container images this version deploys carry CVE-2026-27830.

Container imageDigestPackageFixed in
anguda/ant-media:2.5c435285fc241
c3p0@0.9.5.4
0.12.0

Open the chart page →

15,722
ckanhelmforgeVerified publisher1.3.81 of 6See more

ckan helmforge 1.3.8

1 of the 6 container images this version deploys carry CVE-2026-27830.

Container imageDigestPackageFixed in
ckan/ckan-solr:2.11-solr9ef8e5d3e6be1
c3p0@0.9.5.5
0.12.0

Open the chart page →

9,920
nifi-registryimprowisedVerified publisher1.0.01 of 2See more

nifi-registry improwised 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-27830.

Container imageDigestPackageFixed in
apache/nifi-registry:1.27.063b8e3e40742
c3p0@0.9.5.4
0.12.0

Open the chart page →

5,320
crowdmoxVerified publisher2.4.31 of 3See more

crowd mox 2.4.3

1 of the 3 container images this version deploys carry CVE-2026-27830.

Container imageDigestPackageFixed in
atlassian/crowd:5.2.2ebf761c7d437
c3p0@0.9.5.4
0.12.0

Open the chart page →

5,663
onedevonedev11.9.01 of 1See more

onedev onedev 11.9.0

1 of the 1 container images this version deploys carry CVE-2026-27830.

Container imageDigestPackageFixed in
1dev/server:11.9.0cd5b12fe5471
c3p0@0.9.5.4
0.12.0

Open the chart page →

6,037
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-27830.

Container imageDigestPackageFixed in
trinodb/trino:45038c6f24ab1a4
c3p0@0.9.5.4
0.12.0

Open the chart page →

21,211
atlassian-confluencesomeblackmagic3.4.11 of 1See more

atlassian-confluence someblackmagic 3.4.1

1 of the 1 container images this version deploys carry CVE-2026-27830.

Container imageDigestPackageFixed in
atlassian/confluence-server:7.10.03b9222ab32ef
c3p0@0.9.5.5
0.12.0

Open the chart page →

13,605
trinostatcan1.23.41 of 2See more

trino statcan 1.23.4

1 of the 2 container images this version deploys carry CVE-2026-27830.

Container imageDigestPackageFixed in
trinodb/trino:405ee80ab5eeab2
c3p0@0.9.5.4
0.12.0

Open the chart page →

13,767
rundecksvtech-public-helm-charts1.0.01 of 2See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-27830.

Container imageDigestPackageFixed in
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
c3p0@0.9.5.4
0.12.0

Open the chart page →

18,756

Container images carrying it

21 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
apache/nifi-registry:1.26.07cdfd8deec92
c3p0@0.9.5.4
0.12.0
2
1dev/server:11.9.0cd5b12fe5471
c3p0@0.9.5.4
0.12.0
1
airbyte/server:2.2.070e125498a1c
c3p0@0.9.5.4
0.12.0
1
airbyte/worker:2.2.08060b88b29c8
c3p0@0.9.5.4
0.12.0
1
airbyte/workload-api-server:2.2.042093cff86e9
c3p0@0.9.5.4
0.12.0
1
anguda/ant-media:2.5c435285fc241
c3p0@0.9.5.4
0.12.0
1
apache/nifi-registry:1.27.063b8e3e40742
c3p0@0.9.5.4
0.12.0
1
assistiot/cybersecurity-monitoring_ir-thv:latestc8b6c7eaa0cd
c3p0@0.9.5.4
0.12.0
1
atlassian/confluence-server:7.10.03b9222ab32ef
c3p0@0.9.5.5
0.12.0
1
atlassian/crowd:5.2.2ebf761c7d437
c3p0@0.9.5.4
0.12.0
1
blackducksoftware/blackduck-alert:8.4.090cca32de2cc
c3p0@0.9.5.5
0.12.0
1
ckan/ckan-solr:2.11-solr9ef8e5d3e6be1
c3p0@0.9.5.5
0.12.0
1
egdsandaru/apache-ranger-admin:1.0.0681baa1926f4
c3p0@0.9.5.3
0.12.0
1
jingking/geonetwork-hnap:4.2.843e74ab234e1
c3p0@0.9.5.4
0.12.0
1
rundeck/rundeck:3.2.74d64fe56f767
c3p0@0.9.5.4
0.12.0
1
rundeck/rundeck:3.0.16b13e8059ad72
c3p0@0.9.5.2
0.12.0
1
sismics/docs:v1.10f4b0ef019cf1
c3p0@0.9.5.5
0.12.0
1
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
c3p0@0.9.5.4
0.12.0
1
thmmniii/fbs-runner:v1.27.186105349c1a3
c3p0@0.9.5.4
0.12.0
1
trinodb/trino:45038c6f24ab1a4
c3p0@0.9.5.4
0.12.0
1
trinodb/trino:405ee80ab5eeab2
c3p0@0.9.5.4
0.12.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.