CVE-2026-28389

High

Advisory

Published 7 Apr 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.008; 55th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,303; of 17,790 indexed, latest versions
Container images: 2,568; deployed by those charts
Fix available: 4 of 5; affected packages

CVE-2026-28389 affecting package openssl for versions less than 3.3.5-5

Carried by container images the latest versions of 2,303 of 17,790 indexed charts deploy, on 2,568 images.

Affected package	Affected versions	Fixed in	Images
openssldeb	1.0.2g-1ubuntu4.5, 1.0.2g-1ubuntu4.6, 1.0.2g-1ubuntu4.8, 1.0.2g-1ubuntu4.9+94 more	1.0.2g-1ubuntu4.20+esm15, 1.1.1-1ubuntu2.1~18.04.23+esm8, 1.1.1f-1ubuntu2.24+esm3, 3.0.2-0ubuntu1.23+4 more	1,663
opensslapk	3.1.4-r2, 3.2.0-r0, 3.3.0-r2, 3.3.1-r0+22 more	3.3.7-r0, 3.5.6-r0, 3.6.2-r0	902
nodejsdeb	4.2.6~dfsg-1ubuntu4.1, 7.10.1-2nodesource1~xenial1, 8.9.4-1nodesource1, 8.10.0~dfsg-2ubuntu0.4+8 more	no fix listed	16
openssl1.0deb	1.0.2n-1ubuntu5.3, 1.0.2n-1ubuntu5.4, 1.0.2n-1ubuntu5.6, 1.0.2n-1ubuntu5.10+2 more	1.0.2n-1ubuntu5.13+esm4	15
opensslrpm	3.3.5-1.azl3, 3.3.5-3.azl3	3.3.5-5	3

OSV records: ALPINE-CVE-2026-28389 CGA-2r23-9xvx-4prr CGA-c3mq-2w7x-m4x8 DEBIAN-CVE-2026-28389 UBUNTU-CVE-2026-28389 AZL-82067 ECHO-ba3d-b3f7-03e8
Also known as: CGA-p78p-49m2-xjvw, CGA-rff8-35jv-r39r, USN-8155-1, USN-8155-2

Charts affected

2,303 by stars

Chart

Latest

Affected images

Radar Score

zipkinzipkin

0.5.0

1 of 1 See more

zipkin zipkin 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-28389.

Container image	Digest	Package	Fixed in
openzipkin/zipkin-slim :3.6.0	a69e1057df36	openssl@3.5.5-r0	3.5.6-r0

Open the chart page →

1,159

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-28389.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	openssl@1.1.1-1ubuntu2.1~18.04.14	1.1.1-1ubuntu2.1~18.04.23+esm8
yandex/clickhouse-server :21.3.20	4eccfffb01d7	openssl@1.1.1f-1ubuntu2.10	1.1.1f-1ubuntu2.24+esm3

Open the chart page →

9,256

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-28389.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	openssl@3.0.2-0ubuntu1.26	no fix listed

Open the chart page →

7,929

Container images carrying it

2,568 by charts deploying them

A fixed version is listed for 4 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
library/redis :7.2.3	a7cee7c8178f	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	2
library/redis :8.2.2	f0957bcaa75f	openssl@3.0.17-1~deb12u3	3.0.19-1~deb12u2	2
library/wordpress :6.8.3-apache :6.8-apache	30bff39330d1	openssl@3.5.4-1~deb13u1	3.5.5-1~deb13u2	2
library/zookeeper :3.9.5	f258365d4882	openssl@3.0.2-0ubuntu1.26	no fix listed	2
lightninglabs/lnd :v0.18.3-beta	f86bbec4dfb3	openssl@3.3.2-r0	3.3.7-r0	2
lightstep/collector :2021-01-26_23-02-36Z	11c5569aaf3b	openssl@1.0.2g-1ubuntu4.15	1.0.2g-1ubuntu4.20+esm15	2
linuxserver/ubooquity :2.1.2-ls36	9932d6759112	openssl@3.3.1-r3	3.3.7-r0	2
locustio/locust :2.32.2	a0d4b88e42c1	openssl@3.0.14-1~deb12u2	3.0.19-1~deb12u2	2
mattermost/mattermost-team-edition :10.11.2	b8bd1246cb3a	openssl@3.0.17-1~deb12u2	3.0.19-1~deb12u2	2
mbentley/omada-controller :4.3	f4e682274bed	openssl@1.1.1-1ubuntu2.1~18.04.23	1.1.1-1ubuntu2.1~18.04.23+esm8	2
mesosphere/kubeaddons-catalog :v0.11.4	073db43d0b8b	openssl@1.1.1f-1ubuntu2	1.1.1f-1ubuntu2.24+esm3	2
mesosphere/kubectl :v1.35.0-alpine	ea01a9387771	openssl@3.5.4-r0	3.5.6-r0	2
mojaloop/reporting :v12.1.0	d480a62103d6	openssl@3.3.3-r0	3.3.7-r0	2
mojaloop/reporting-aggregator-svc :v0.0.9	2635baf23298	openssl@3.3.3-r0	3.3.7-r0	2
mojaloop/reporting-events-processor-svc :v3.5.1	1e0d24d28512	openssl@3.5.1-r0	3.5.6-r0	2
mojaloop/reporting-hub-bop-experience-api-svc :v2.0.4	265102a049d6	openssl@3.3.3-r0	3.3.7-r0	2
mojaloop/security-role-perm-operator-svc :v3.0.2	12af60892c75	openssl@3.5.4-r0	3.5.6-r0	2
moreillon/group-manager-front :v3.3.1	c9f85db3baa5	openssl@3.0.13-1~deb12u1	3.0.19-1~deb12u2	2
moreillon/user-manager :v5.0.2	e1c9bfab5c16	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	2
moreillon/user-manager-front :v5.0.3	b067dbbbb6af	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	2
natsio/nats-server-config-reloader :0.21.1	10ff229eaf52	openssl@3.5.4-r0	3.5.6-r0	2
natsio/prometheus-nats-exporter :0.17.3	26c826662ac8	openssl@3.3.3-r0	3.3.7-r0	2
ngick8stesting/c3po-mmeinit :latest	1e764eab77b4	openssl@1.1.0g-2ubuntu4.1	1.1.1-1ubuntu2.1~18.04.23+esm8	2
nginxinc/nginx-unprivileged :1.27-alpine	65e3e85dbaed	openssl@3.3.3-r0	3.3.7-r0	2
obsidiandynamics/kafdrop :3.30.0	5337c9e0e2de	openssl@1.1.1f-1ubuntu2.12	1.1.1f-1ubuntu2.24+esm3	2
omecproject/mcord-synchronizer :comac-1.0.0	cfdb566dd949	openssl@1.0.2g-1ubuntu4.14	1.0.2g-1ubuntu4.20+esm15	2
opea/chatqna-conversation-ui :1.0	02d5674ca863	openssl@3.3.2-r0	3.3.7-r0	2
opea/embedding-tei :1.0	5c9639de61c1	openssl@3.0.14-1~deb12u2	3.0.19-1~deb12u2	2
opea/reranking-tei :1.0	e48613afb191	openssl@3.0.14-1~deb12u2	3.0.19-1~deb12u2	2
opea/retriever-redis :1.0	eb746b263705	openssl@3.0.14-1~deb12u2	3.0.19-1~deb12u2	2
opencloudeu/opencloud-rolling :2.1.0	f9634bb04905	openssl@3.3.3-r0	3.3.7-r0	2
opencloudeu/web-extensions :unzip-1.0.0	1691ad6612a3	openssl@3.0.15-1~deb12u1	3.0.19-1~deb12u2	2
opencloudeu/web-extensions :draw-io-1.0.0	27cb9b952f0d	openssl@3.0.15-1~deb12u1	3.0.19-1~deb12u2	2
opencloudeu/web-extensions :external-sites-1.0.0	5b176baa3694	openssl@3.0.15-1~deb12u1	3.0.19-1~deb12u2	2
opencloudeu/web-extensions :importer-1.0.0	6e8b2df6c5a4	openssl@3.0.15-1~deb12u1	3.0.19-1~deb12u2	2
opencloudeu/web-extensions :progress-bars-1.0.0	82f888a34440	openssl@3.0.15-1~deb12u1	3.0.19-1~deb12u2	2
opencloudeu/web-extensions :json-viewer-1.0.0	e0ac35a9576e	openssl@3.0.15-1~deb12u1	3.0.19-1~deb12u2	2
opendatacube/ows :latest	668cbb41473c	openssl@3.0.13-0ubuntu3.4	3.0.13-0ubuntu3.9	2
openebs/node-disk-manager :2.1.0	f6c18b0f8c8a	openssl@3.0.2-0ubuntu1.7	3.0.2-0ubuntu1.23	2
openebs/node-disk-operator :2.1.0	6afe2123c457	openssl@3.0.2-0ubuntu1.7	3.0.2-0ubuntu1.23	2
oryd/kratos :v1.3.1	fe2428f103a6	openssl@3.3.2-r1	3.3.7-r0	2
percona/everest-helmtools :0.0.1	904458d04a18	openssl@3.3.4-r0	3.3.7-r0	2
piomin/sample-spring-kotlin-microservice :1.1	871f784dd6bc	openssl@3.0.2-0ubuntu1.6	3.0.2-0ubuntu1.23	2
qichenxu4pd/pythonexample :1.0	f3a8502bc21b	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	2
quickwit/quickwit :v0.8.2	363ff56ce456	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	2
rajnandan1/kener :3.2.19	30407afca731	openssl@3.0.17-1~deb12u1	3.0.19-1~deb12u2	2
rancher/local-path-provisioner :v0.0.35	34ff0847cc47	openssl@3.5.5-r0	3.5.6-r0	2
rancher/local-path-provisioner :v0.0.29	9bebefa0b908	openssl@3.3.1-r3	3.3.7-r0	2
rclone/rclone :1.68	74c51b8817e5	openssl@3.3.2-r0	3.3.7-r0	2
redis/redis-stack :7.2.0-v9	1c5f43fddcdd	openssl@3.0.2-0ubuntu1.15	3.0.2-0ubuntu1.23	2