CVE-2026-28389

High

Advisory

Published 7 Apr 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.008; 55th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,307; of 17,805 indexed, latest versions
Container images: 2,555; deployed by those charts
Fix available: 4 of 5; affected packages

CVE-2026-28389 affecting package openssl for versions less than 3.3.5-5

Carried by container images the latest versions of 2,307 of 17,805 indexed charts deploy, on 2,555 images.

Affected package	Affected versions	Fixed in	Images
openssldeb	1.0.2g-1ubuntu4.5, 1.0.2g-1ubuntu4.6, 1.0.2g-1ubuntu4.8, 1.0.2g-1ubuntu4.9+94 more	1.0.2g-1ubuntu4.20+esm15, 1.1.1-1ubuntu2.1~18.04.23+esm8, 1.1.1f-1ubuntu2.24+esm3, 3.0.2-0ubuntu1.23+4 more	1,653
opensslapk	3.1.4-r2, 3.2.0-r0, 3.3.0-r2, 3.3.1-r0+22 more	3.3.7-r0, 3.5.6-r0, 3.6.2-r0	899
nodejsdeb	4.2.6~dfsg-1ubuntu4.1, 7.10.1-2nodesource1~xenial1, 8.9.4-1nodesource1, 8.10.0~dfsg-2ubuntu0.4+8 more	no fix listed	16
openssl1.0deb	1.0.2n-1ubuntu5.3, 1.0.2n-1ubuntu5.4, 1.0.2n-1ubuntu5.6, 1.0.2n-1ubuntu5.10+2 more	1.0.2n-1ubuntu5.13+esm4	15
opensslrpm	3.3.5-1.azl3, 3.3.5-3.azl3	3.3.5-5	3

OSV records: ALPINE-CVE-2026-28389 CGA-2r23-9xvx-4prr CGA-c3mq-2w7x-m4x8 DEBIAN-CVE-2026-28389 UBUNTU-CVE-2026-28389 AZL-82067 ECHO-ba3d-b3f7-03e8
Also known as: CGA-p78p-49m2-xjvw, CGA-rff8-35jv-r39r, USN-8155-1, USN-8155-2

Charts affected

2,307 by stars

Chart

Latest

Affected images

Radar Score

ygdrassil-monitoringygdrassil

0.4.0

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-28389.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	openssl@3.3.2-r0	3.3.7-r0

Open the chart page →

9,426

api-snapyoukadev

0.1.1

1 of 1 See more

api-snap youkadev 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-28389.

Container image	Digest	Package	Fixed in
youkadev/api-snap :0.1.1	4db0f9428e67	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2

Open the chart page →

2,710

zahori-schedulerzahori

1.0.1

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-28389.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	openssl@1.1.1-1ubuntu2.1~18.04.23	1.1.1-1ubuntu2.1~18.04.23+esm8

Open the chart page →

2,477

language-toolzekker6

1.12.1

1 of 2 See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-28389.

Container image	Digest	Package	Fixed in
erikvl87/languagetool :6.7-dockerupdate-3	e1ea6a975388	openssl@3.5.5-r0	3.5.6-r0

Open the chart page →

1,569

zipkinzipkin

0.5.0

1 of 1 See more

zipkin zipkin 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-28389.

Container image	Digest	Package	Fixed in
openzipkin/zipkin-slim :3.6.0	a69e1057df36	openssl@3.5.5-r0	3.5.6-r0

Open the chart page →

1,160

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-28389.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	openssl@1.1.1-1ubuntu2.1~18.04.14	1.1.1-1ubuntu2.1~18.04.23+esm8
yandex/clickhouse-server :21.3.20	4eccfffb01d7	openssl@1.1.1f-1ubuntu2.10	1.1.1f-1ubuntu2.24+esm3

Open the chart page →

9,280

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-28389.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	openssl@3.0.2-0ubuntu1.26	no fix listed

Open the chart page →

7,949

Container images carrying it

2,555 by charts deploying them

A fixed version is listed for 4 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
soulteary/cronicle :0.9.80	ac2512fa6e39	openssl@3.3.3-r0	3.3.7-r0	1
speckle/speckle-frontend-2 :2.20.2-branch.testing4.134160-9fad4b2	10ad4ade8bf2	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-frontend-2 :2.20.6-branch.testing1.154030-9b09114	32fc940d9b4c	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-frontend-2 :2.19.2-branch.hotfix-2.19.1.124125-665e7e1	4f9241665ae3	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-frontend-2 :2.21.3-branch.testing5.219631-2153bef	d4ca6ebf09b9	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-frontend-2 :2.20.3-branch.hotfix-2.20.2.149555-37ea0cb	fdc008effc7a	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-monitor-deployment :2.25.10-branch.testing6.645-b125c1e	2dbc553ed87c	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-monitor-deployment :2.20.3-branch.hotfix-2.20.2.149555-37ea0cb	2faf1508c1d3	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-monitor-deployment :2.20.2-branch.testing4.134160-9fad4b2	3c8fbe855665	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-monitor-deployment :2.20.6-branch.testing1.154030-9b09114	738c77eb6f97	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-monitor-deployment :2.18.12-branch.testing3.88744-f55b341	81335b40696a	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-monitor-deployment :2.19.2-branch.hotfix-2.19.1.124125-665e7e1	b696ac5022ab	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-monitor-deployment :2.21.3-branch.testing5.219631-2153bef	cf72ad0f25fb	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-monitor-deployment :2.26.3	d51e1b0cf231	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-monitor-deployment :2.18.11-branch.testing2.88634-335d469	d6790a97ad47	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-monitor-deployment :2.17.14-branch.testing.72707.921a5f8	ff1641ac3f1b	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-preview-service :2.26.3	092384dba45d	openssl@3.0.17-1~deb12u3	3.0.19-1~deb12u2	1
speckle/speckle-preview-service :2.20.2-branch.testing4.134160-9fad4b2	1f897ca906ea	openssl@3.0.13-1~deb12u1	3.0.19-1~deb12u2	1
speckle/speckle-preview-service :2.21.3-branch.testing5.219631-2153bef	52cad5e3293e	openssl@3.0.14-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-preview-service :2.23.14-branch.testing6.334655-b4e04ee	6dee853ba74a	openssl@3.0.15-1~deb12u1	3.0.19-1~deb12u2	1
speckle/speckle-preview-service :2.25.10-branch.testing6.645-b125c1e	787adcb20a3a	openssl@3.0.17-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-preview-service :2.17.14-branch.testing.72707.921a5f8	84fc39bca0c8	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-preview-service :2.20.6-branch.testing1.154030-9b09114	8f3c1ea153ba	openssl@3.0.13-1~deb12u1	3.0.19-1~deb12u2	1
speckle/speckle-preview-service :2.19.2-branch.hotfix-2.19.1.124125-665e7e1	c102b087481a	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-preview-service :2.20.3-branch.hotfix-2.20.2.149555-37ea0cb	d3da0a84de98	openssl@3.0.13-1~deb12u1	3.0.19-1~deb12u2	1
speckle/speckle-server :2.25.10-branch.testing6.645-b125c1e	75cdf256067b	openssl@3.0.16-1~deb12u1	3.0.19-1~deb12u2	1
speckle/speckle-server :2.26.3	79f14a2bf931	openssl@3.0.16-1~deb12u1	3.0.19-1~deb12u2	1
speckle/speckle-server :2.21.3-branch.testing5.219631-2153bef	8fd157733393	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-webhook-service :2.21.3-branch.testing5.219631-2153bef	06ecc7a66a40	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-webhook-service :2.20.3-branch.hotfix-2.20.2.149555-37ea0cb	107c63336ab5	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-webhook-service :2.19.2-branch.hotfix-2.19.1.124125-665e7e1	4828aee2277c	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-webhook-service :2.20.2-branch.testing4.134160-9fad4b2	70f5167d1d4d	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-webhook-service :2.18.12-branch.testing3.88744-f55b341	771f872cfa63	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-webhook-service :2.18.11-branch.testing2.88634-335d469	902b98ad5327	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-webhook-service :2.17.14-branch.testing.72707.921a5f8	99913052b72e	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-webhook-service :2.26.3	c58eb372c488	openssl@3.0.13-1~deb12u1	3.0.19-1~deb12u2	1
speckle/speckle-webhook-service :2.20.6-branch.testing1.154030-9b09114	cf1d99bad89a	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	1
speckle/speckle-webhook-service :2.25.10-branch.testing6.645-b125c1e	dd9db6cbe9bb	openssl@3.0.13-1~deb12u1	3.0.19-1~deb12u2	1
spy86/rabbitmq-stomp :latest	ea649101b9fb	openssl@1.1.1f-1ubuntu2.17	1.1.1f-1ubuntu2.24+esm3	1
stackstorm/st2actionrunner :3.8	88235ba70cad	openssl@1.1.1f-1ubuntu2.20	1.1.1f-1ubuntu2.24+esm3	1
stackstorm/st2api :3.8	6f56d239d280	openssl@1.1.1f-1ubuntu2.20	1.1.1f-1ubuntu2.24+esm3	1
stackstorm/st2auth :3.8	33ecfda16608	openssl@1.1.1f-1ubuntu2.20	1.1.1f-1ubuntu2.24+esm3	1
stackstorm/st2garbagecollector :3.8	4e3f8c7ca52d	openssl@1.1.1f-1ubuntu2.20	1.1.1f-1ubuntu2.24+esm3	1
stackstorm/st2notifier :3.8	f190a6212195	openssl@1.1.1f-1ubuntu2.20	1.1.1f-1ubuntu2.24+esm3	1
stackstorm/st2rulesengine :3.8	259503496ff9	openssl@1.1.1f-1ubuntu2.20	1.1.1f-1ubuntu2.24+esm3	1
stackstorm/st2scheduler :3.8	b1de2055c362	openssl@1.1.1f-1ubuntu2.20	1.1.1f-1ubuntu2.24+esm3	1
stackstorm/st2sensorcontainer :3.8	b1a338f64773	openssl@1.1.1f-1ubuntu2.20	1.1.1f-1ubuntu2.24+esm3	1
stackstorm/st2stream :3.8	1c8904a3bf67	openssl@1.1.1f-1ubuntu2.20	1.1.1f-1ubuntu2.24+esm3	1
stackstorm/st2timersengine :3.8	1bf35bfaf00c	openssl@1.1.1f-1ubuntu2.20	1.1.1f-1ubuntu2.24+esm3	1
stackstorm/st2web :3.8	09989a26c8b7	openssl@1.1.1f-1ubuntu2.20	1.1.1f-1ubuntu2.24+esm3	1