CVE-2026-28390

High

Advisory

Published 7 Apr 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.008; 55th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,601; of 17,832 indexed, latest versions
Container images: 2,970; deployed by those charts
Fix available: 4 of 5; affected packages

Red Hat Security Advisory: openssl security update

Carried by container images the latest versions of 2,601 of 17,832 indexed charts deploy, on 2,970 images.

Affected package	Affected versions	Fixed in	Images
openssldeb	1.0.2g-1ubuntu4.5, 1.0.2g-1ubuntu4.6, 1.0.2g-1ubuntu4.8, 1.0.2g-1ubuntu4.9+94 more	1.0.2g-1ubuntu4.20+esm15, 1.1.1-1ubuntu2.1~18.04.23+esm8, 1.1.1f-1ubuntu2.24+esm3, 3.0.2-0ubuntu1.23+4 more	1,710
opensslapk	3.1.4-r2, 3.2.0-r0, 3.3.0-r2, 3.3.1-r0+22 more	3.3.7-r0, 3.5.6-r0, 3.6.2-r0	927
opensslrpm	1:1.1.1-8.el8, 1:1.1.1c-2.el8, 1:1.1.1c-2.el8_1.1, 1:1.1.1c-15.el8+33 more	1:1.1.1k-17.el8_6, 1:1.1.1k-17.el8_10, 1:3.5.5-3.el9_8, 1:3.5.5-3.el10_2+1 more	333
nodejsdeb	4.2.6~dfsg-1ubuntu4.1, 7.10.1-2nodesource1~xenial1, 8.9.4-1nodesource1, 8.10.0~dfsg-2ubuntu0.4+13 more	no fix listed	22
openssl1.0deb	1.0.2n-1ubuntu5.3, 1.0.2n-1ubuntu5.4, 1.0.2n-1ubuntu5.6, 1.0.2n-1ubuntu5.7+5 more	1.0.2n-1ubuntu5.13+esm4	20

OSV records: ALPINE-CVE-2026-28390 CGA-8g7f-wxpv-r4x7 DEBIAN-CVE-2026-28390 RHSA-2026:22312 RHSA-2026:38503 RLSA-2026:22312 RLSA-2026:22314 RLSA-2026:38503 UBUNTU-CVE-2026-28390 AZL-82070 ECHO-9d88-691e-4e0f
Also known as: CGA-9w5g-cc3c-h84f, CGA-c8f9-m6q4-pf8c, CGA-r9mm-rw3c-wqh3, RHSA-2026:38804, RHSA-2026:38805, RHSA-2026:43513, USN-8155-1, USN-8155-2

Charts affected

2,601 by stars

Chart

Latest

Affected images

Radar Score

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-28390.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	openssl@3.0.2-0ubuntu1.26	no fix listed

Open the chart page →

8,128

Container images carrying it

2,970 by charts deploying them

A fixed version is listed for 4 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/appscode/service-provider :v0.0.2	f6e481386d70	openssl@3.5.4-r0	3.5.6-r0	2
ghcr.io/astriaorg/astria-geth :latest	4249e403225a	openssl@3.5.0-r0	3.5.6-r0	2
ghcr.io/astriaorg/conductor :latest	3ea8164b0eae	openssl@3.0.17-1~deb12u2	3.0.19-1~deb12u2	2
ghcr.io/bryopsida/k8s-dev-pod :main	82d0b161161d	openssl@3.0.13-0ubuntu3.5	3.0.13-0ubuntu3.9	2
ghcr.io/celestiaorg/celestia-node :v0.27.5-mocha	4768ea1c5fd2	openssl@3.3.1-r3	3.3.7-r0	2
ghcr.io/codingducksrl/laravel :8.1	5be52524664c	nodejs@16.18.0-deb-1nodesource1 openssl@3.0.2-0ubuntu1.6	no fix listed 3.0.2-0ubuntu1.23	2
ghcr.io/cosmos/gaia :v25.1.0	f115777d1112	openssl@3.5.0-r0	3.5.6-r0	2
ghcr.io/cross-seed/cross-seed :6.13.3	81afafdd96a5	openssl@3.5.1-r0	3.5.6-r0	2
ghcr.io/danbooru/danbooru :9cab67c0ac72a8c52289302c519715ceec2372d9	5f545698e907	openssl@3.0.2-0ubuntu1.6	3.0.2-0ubuntu1.23	2
ghcr.io/flaresolverr/flaresolverr :v3.4.6	7962759d99d7	openssl@3.0.17-1~deb12u3	3.0.19-1~deb12u2	2
ghcr.io/games-on-whales/pulseaudio :1.0.0	f34f98405c10	openssl@1.1.1f-1ubuntu2.8	1.1.1f-1ubuntu2.24+esm3	2
ghcr.io/games-on-whales/retroarch :1.0.0	103fbcec2314	openssl@1.1.1f-1ubuntu2.8	1.1.1f-1ubuntu2.24+esm3	2
ghcr.io/games-on-whales/steam :1.0.0	9b6105be7ad0	openssl@1.1.1f-1ubuntu2.8	1.1.1f-1ubuntu2.24+esm3	2
ghcr.io/google/fleetspeak :v0.1.17	cd264d33efd4	openssl@3.0.13-1~deb12u1	3.0.19-1~deb12u2	2
ghcr.io/grafana/helm-chart-toolbox-kubectl :0.1.1	c137478627cc	openssl@3.5.1-r0	3.5.6-r0	2
ghcr.io/home-operations/readarr :0.4.18 :0.4.18.2805	8f7551205fbd	openssl@3.5.0-r0	3.5.6-r0	2
ghcr.io/immich-app/postgres :14-vectorchord0.4.3-pgvectors0.2.0	bcf63357191b	openssl@3.0.17-1~deb12u2	3.0.19-1~deb12u2	2
ghcr.io/kiwigrid/k8s-sidecar :1.29.1	42002d66ddb3	openssl@3.3.2-r4	3.3.7-r0	2
ghcr.io/kluster-manager/cluster-auth :v0.5.1	fba6fb872281	openssl@3.5.5-r0	3.5.6-r0	2
ghcr.io/linuxserver/openvpn-as :version-2.8.6-916f8e7d-ubuntu18	4ee0764310e7	openssl@1.1.1-1ubuntu2.1~18.04.6	1.1.1-1ubuntu2.1~18.04.23+esm8	2
ghcr.io/nginxinc/nginx-s3-gateway/nginx-oss-s3-gateway :unprivileged-oss :unprivileged-oss-20250331	3db8145349a3	openssl@3.0.14-1~deb12u2	3.0.19-1~deb12u2	2
ghcr.io/nucleuscloud/neosync/api :0.5.41	e2abb798f29f	openssl@3.0.16-1~deb12u1	3.0.19-1~deb12u2	2
ghcr.io/nucleuscloud/neosync/app :0.5.41	ca31ec35b829	openssl@3.5.0-r0	3.5.6-r0	2
ghcr.io/nucleuscloud/neosync/worker :0.5.41	96f42450c5b1	openssl@3.0.16-1~deb12u1	3.0.19-1~deb12u2	2
ghcr.io/postgresml/pgcat :main	245f9d2f5f5b	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	2
ghcr.io/postgresml/pgcat :v1.2.0	627761f6dcbc	openssl@3.0.13-1~deb12u1	3.0.19-1~deb12u2	2
ghcr.io/rss3-network/agentdata :0.1.0	fd8d3e6e4cdf	openssl@3.0.15-1~deb12u1	3.0.19-1~deb12u2	2
ghcr.io/salaboy/fmtok8s-agenda-service :v0.0.1-native	6c5efe150958	openssl@1.1.1-1ubuntu2.1~18.04.21	1.1.1-1ubuntu2.1~18.04.23+esm8	2
ghcr.io/salaboy/fmtok8s-c4p-service :v0.0.1-native	3f7cc45fd20b	openssl@1.1.1-1ubuntu2.1~18.04.21	1.1.1-1ubuntu2.1~18.04.23+esm8	2
ghcr.io/salaboy/fmtok8s-frontend :v0.1.1	03fd01b4f56e	openssl@3.0.2-0ubuntu1.2	3.0.2-0ubuntu1.23	2
ghcr.io/smarter-project/home-ha-mock :main	95ee018cf558	openssl@3.0.15-1~deb12u1	3.0.19-1~deb12u2	2
ghcr.io/smarter-project/hydra/isolated-vm :main	4457b79b24cd	openssl@3.0.18-1~deb12u2	3.0.19-1~deb12u2	2
ghcr.io/wg-easy/wg-easy :14	5f26407fd2ed	openssl@3.5.0-r0	3.5.6-r0	2
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	openssl@1.1.1f-1ubuntu2.19	1.1.1f-1ubuntu2.24+esm3	2
mcr.microsoft.com/mssql/server :2017-latest	fbf79e0fea59	openssl@1.1.1-1ubuntu2.1~18.04.23 openssl1.0@1.0.2n-1ubuntu5.13	1.1.1-1ubuntu2.1~18.04.23+esm8 1.0.2n-1ubuntu5.13+esm4	2
public.ecr.aws/aktosecurity/confluentinc-cp-kafka :8.1.1-1-ubi9	d20bd62f0182	openssl@1:3.5.1-4.el9_7	1:3.5.5-3.el9_8	2
public.ecr.aws/cloudnatix/llmariner/model-manager-loader :1.27.0	26ac7263a823	openssl@3.5.1-1	3.5.5-1~deb13u2	2
quay.io/argoproj/argocd :v2.14.11	5fc69e31c755	openssl@3.0.13-0ubuntu3.5	3.0.13-0ubuntu3.9	2
quay.io/cephcsi/cephcsi :v3.18.0	0a92e5c8c153	openssl@1:3.5.5-2.el10_2	1:3.5.5-3.el10_2	2
quay.io/curl/curl :8.16.0	b17b13321678	openssl@3.5.2-r0	3.5.6-r0	2
quay.io/flomesh/curl-ubi8 :7.84.0	bef31fa5f5f3	openssl@1:1.1.1k-12.el8_9	1:1.1.1k-17.el8_6	2
quay.io/frrouting/frr :10.4.3	8745af1f9bbb	openssl@3.5.5-r0	3.5.6-r0	2
quay.io/keycloak/keycloak :20.0	054ef67eb7da	openssl@1:1.1.1k-7.el8_6	1:1.1.1k-17.el8_6	2
quay.io/keycloak/keycloak :17.0.1-legacy	68f9f38c8f30	openssl@1:1.1.1k-6.el8_5	1:1.1.1k-17.el8_6	2
quay.io/kiwigrid/k8s-sidecar :2.1.2	716b0b33ff2d	openssl@3.5.4-r0	3.5.6-r0	2
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	openssl@3.3.0-r2	3.3.7-r0	2
quay.io/minio/mc :RELEASE.2023-09-29T16-41-22Z	a784ce6e3b1b	openssl@1:1.1.1k-9.el8_7	1:1.1.1k-17.el8_6	2
quay.io/minio/mc :RELEASE.2023-01-28T20-29-38Z	ad34abeba912	openssl@1:1.1.1k-7.el8_6	1:1.1.1k-17.el8_6	2
quay.io/minio/minio :RELEASE.2023-09-30T07-02-29Z	6262bc9a2730	openssl@1:1.1.1k-9.el8_7	1:1.1.1k-17.el8_6	2
quay.io/minio/minio :RELEASE.2023-07-21T21-12-44Z	8e5e9490cd50	openssl@1:1.1.1k-9.el8_7	1:1.1.1k-17.el8_6	2