CVE-2026-31789

Critical

Advisory

Published 7 Apr 2026In the index since 5 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.8; base score, highest
EPSS: 0.002; 16th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,858; of 17,790 indexed, latest versions
Container images: 2,128; deployed by those charts
Fix available: 3 of 3; affected packages

CVE-2026-31789 affecting package openssl for versions less than 3.3.5-5

Carried by container images the latest versions of 1,858 of 17,790 indexed charts deploy, on 2,128 images.

Affected package	Affected versions	Fixed in	Images
openssldeb	3.0.2-0ubuntu1, 3.0.2-0ubuntu1.2, 3.0.2-0ubuntu1.5, 3.0.2-0ubuntu1.6+44 more	3.0.2-0ubuntu1.23, 3.0.13-0ubuntu3.9, 3.0.19-1~deb12u2, 3.5.3-1ubuntu3.3+1 more	1,223
opensslapk	3.1.4-r2, 3.2.0-r0, 3.3.0-r2, 3.3.1-r0+22 more	3.3.7-r0, 3.5.6-r0, 3.6.2-r0	902
opensslrpm	3.3.5-1.azl3, 3.3.5-3.azl3	3.3.5-5	3

OSV records: ALPINE-CVE-2026-31789 DEBIAN-CVE-2026-31789 UBUNTU-CVE-2026-31789 CGA-4pxx-5wwr-cqff AZL-81944 ECHO-f779-bf6a-ba8e
Also known as: CGA-mfrg-992g-qvmr, CGA-mhv9-p53w-vxw8, CGA-x4mm-f7hr-pgvx, USN-8155-1

Charts affected

1,858 by stars

Chart

Latest

Affected images

Radar Score

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-31789.

Container image	Digest	Package	Fixed in
library/nginx :1.25	a484819eb602	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2

Open the chart page →

7,697

xkopsxkops

0.1.0

4 of 5 See more

xkops xkops 0.1.0

4 of the 5 container images this version deploys carry CVE-2026-31789.

Container image	Digest	Package	Fixed in
hamzaarshad10/querybackend :1.6.2	2c1c3b86a8e7	openssl@3.0.14-1~deb12u2	3.0.19-1~deb12u2
hamzaarshad10/queryfrontend :1.1.5.14	cd359d9a78c3	openssl@3.3.2-r0	3.3.7-r0
hamzaarshad10/querypodpy :1.7	154f38e8668e	openssl@3.0.14-1~deb12u2	3.0.19-1~deb12u2
murtazashah46/helmfile :latest	4d11726cf803	openssl@3.0.14-1~deb12u2	3.0.19-1~deb12u2

Open the chart page →

13,783

xlinexline

0.0.1

1 of 1 See more

xline xline 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-31789.

Container image	Digest	Package	Fixed in
ghcr.io/liangyuanpeng/xline :latest	3d2eceb44a3b	openssl@3.0.13-0ubuntu3	3.0.13-0ubuntu3.9

Open the chart page →

2,142

ygdrassil-monitoringygdrassil

0.4.0

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-31789.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	openssl@3.3.2-r0	3.3.7-r0

Open the chart page →

9,395

api-snapyoukadev

0.1.1

1 of 1 See more

api-snap youkadev 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-31789.

Container image	Digest	Package	Fixed in
youkadev/api-snap :0.1.1	4db0f9428e67	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2

Open the chart page →

2,684

language-toolzekker6

1.12.1

1 of 2 See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-31789.

Container image	Digest	Package	Fixed in
erikvl87/languagetool :6.7-dockerupdate-3	e1ea6a975388	openssl@3.5.5-r0	3.5.6-r0

Open the chart page →

1,571

zipkinzipkin

0.5.0

1 of 1 See more

zipkin zipkin 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-31789.

Container image	Digest	Package	Fixed in
openzipkin/zipkin-slim :3.6.0	a69e1057df36	openssl@3.5.5-r0	3.5.6-r0

Open the chart page →

1,159

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-31789.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	openssl@3.0.2-0ubuntu1.26	no fix listed

Open the chart page →

7,929

Container images carrying it

2,128 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
sysnet4admin/dashboard :blue	c5bd3bb1b5a6	openssl@3.3.3-r0	3.3.7-r0	2
timberio/vector :0.51.1-alpine	2d16ae87ec39	openssl@3.5.4-r0	3.5.6-r0	2
tzahi12345/youtubedl-material :4.3.2 :latest	2f943d584711	openssl@3.0.2-0ubuntu1.9	3.0.2-0ubuntu1.23	2
uffizzi/controller :latest	0344805f267b	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	2
uselagoon/docker-host :v3.6.1	2c89ed939b8b	openssl@3.3.3-r0	3.3.7-r0	2
valkey/valkey :7.2.11-alpine	10328d00120d	openssl@3.5.5-r0	3.5.6-r0	2
valkey/valkey :9.0.1	546304417fea	openssl@3.5.4-1~deb13u1	3.5.5-1~deb13u2	2
valkey/valkey :8.1.4	81db6d39e1bb	openssl@3.5.1-1+deb13u1	3.5.5-1~deb13u2	2
vdiogov/glpi-conteiner :latest	6945f84f0058	openssl@3.0.13-1~deb12u1	3.0.19-1~deb12u2	2
wolveix/satisfactory-server :latest :v1.9.10	e103700ae6ae	openssl@3.0.2-0ubuntu1.19	3.0.2-0ubuntu1.23	2
zabbix/zabbix-agent :ubuntu-6.4-latest	349b924472a7	openssl@3.0.13-0ubuntu3.4	3.0.13-0ubuntu3.9	2
ghcr.io/appscode/inbox-server :latest :postgres-latest	536358d7b17e	openssl@3.0.2-0ubuntu1.20	3.0.2-0ubuntu1.23	2
ghcr.io/appscode/license-proxyserver :v0.1.1	e192ad567e0b	openssl@3.5.5-r0	3.5.6-r0	2
ghcr.io/appscode/service-provider :v0.0.2	f6e481386d70	openssl@3.5.4-r0	3.5.6-r0	2
ghcr.io/astriaorg/astria-geth :latest	4249e403225a	openssl@3.5.0-r0	3.5.6-r0	2
ghcr.io/astriaorg/conductor :latest	3ea8164b0eae	openssl@3.0.17-1~deb12u2	3.0.19-1~deb12u2	2
ghcr.io/bryopsida/k8s-dev-pod :main	82d0b161161d	openssl@3.0.13-0ubuntu3.5	3.0.13-0ubuntu3.9	2
ghcr.io/celestiaorg/celestia-node :v0.27.5-mocha	4768ea1c5fd2	openssl@3.3.1-r3	3.3.7-r0	2
ghcr.io/codingducksrl/laravel :8.1	5be52524664c	openssl@3.0.2-0ubuntu1.6	3.0.2-0ubuntu1.23	2
ghcr.io/cosmos/gaia :v25.1.0	f115777d1112	openssl@3.5.0-r0	3.5.6-r0	2
ghcr.io/cross-seed/cross-seed :6.13.3	81afafdd96a5	openssl@3.5.1-r0	3.5.6-r0	2
ghcr.io/danbooru/danbooru :9cab67c0ac72a8c52289302c519715ceec2372d9	5f545698e907	openssl@3.0.2-0ubuntu1.6	3.0.2-0ubuntu1.23	2
ghcr.io/flaresolverr/flaresolverr :v3.4.6	7962759d99d7	openssl@3.0.17-1~deb12u3	3.0.19-1~deb12u2	2
ghcr.io/google/fleetspeak :v0.1.17	cd264d33efd4	openssl@3.0.13-1~deb12u1	3.0.19-1~deb12u2	2
ghcr.io/grafana/helm-chart-toolbox-kubectl :0.1.1	c137478627cc	openssl@3.5.1-r0	3.5.6-r0	2
ghcr.io/home-operations/readarr :0.4.18 :0.4.18.2805	8f7551205fbd	openssl@3.5.0-r0	3.5.6-r0	2
ghcr.io/immich-app/postgres :14-vectorchord0.4.3-pgvectors0.2.0	bcf63357191b	openssl@3.0.17-1~deb12u2	3.0.19-1~deb12u2	2
ghcr.io/kiwigrid/k8s-sidecar :1.29.1	42002d66ddb3	openssl@3.3.2-r4	3.3.7-r0	2
ghcr.io/kluster-manager/cluster-auth :v0.5.1	fba6fb872281	openssl@3.5.5-r0	3.5.6-r0	2
ghcr.io/nginxinc/nginx-s3-gateway/nginx-oss-s3-gateway :unprivileged-oss :unprivileged-oss-20250331	3db8145349a3	openssl@3.0.14-1~deb12u2	3.0.19-1~deb12u2	2
ghcr.io/nucleuscloud/neosync/api :0.5.41	e2abb798f29f	openssl@3.0.16-1~deb12u1	3.0.19-1~deb12u2	2
ghcr.io/nucleuscloud/neosync/app :0.5.41	ca31ec35b829	openssl@3.5.0-r0	3.5.6-r0	2
ghcr.io/nucleuscloud/neosync/worker :0.5.41	96f42450c5b1	openssl@3.0.16-1~deb12u1	3.0.19-1~deb12u2	2
ghcr.io/postgresml/pgcat :main	245f9d2f5f5b	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	2
ghcr.io/rss3-network/agentdata :0.1.0	fd8d3e6e4cdf	openssl@3.0.15-1~deb12u1	3.0.19-1~deb12u2	2
ghcr.io/salaboy/fmtok8s-frontend :v0.1.1	03fd01b4f56e	openssl@3.0.2-0ubuntu1.2	3.0.2-0ubuntu1.23	2
ghcr.io/smarter-project/home-ha-mock :main	95ee018cf558	openssl@3.0.15-1~deb12u1	3.0.19-1~deb12u2	2
ghcr.io/smarter-project/hydra/isolated-vm :main	4457b79b24cd	openssl@3.0.18-1~deb12u2	3.0.19-1~deb12u2	2
ghcr.io/wg-easy/wg-easy :14	5f26407fd2ed	openssl@3.5.0-r0	3.5.6-r0	2
public.ecr.aws/cloudnatix/llmariner/model-manager-loader :1.27.0	26ac7263a823	openssl@3.5.1-1	3.5.5-1~deb13u2	2
quay.io/argoproj/argocd :v2.14.11	5fc69e31c755	openssl@3.0.13-0ubuntu3.5	3.0.13-0ubuntu3.9	2
quay.io/curl/curl :8.16.0	b17b13321678	openssl@3.5.2-r0	3.5.6-r0	2
quay.io/frrouting/frr :10.4.3	8745af1f9bbb	openssl@3.5.5-r0	3.5.6-r0	2
quay.io/kiwigrid/k8s-sidecar :2.1.2	716b0b33ff2d	openssl@3.5.4-r0	3.5.6-r0	2
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	openssl@3.3.0-r2	3.3.7-r0	2
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra :latest	b1198ea741d1	openssl@3.5.4-r0	3.5.6-r0	2
registry.gitlab.com/shortlink-org/shortlink/ui :main	9bdb1062d960	openssl@3.5.5-r0	3.5.6-r0	2
registry.k8s.io/ingress-nginx/controller :v1.11.8	695d79381ee6	openssl@3.5.0-r0	3.5.6-r0	2
registry.k8s.io/ingress-nginx/controller :v1.12.1	d2fbc4ec70d8	openssl@3.3.3-r0	3.3.7-r0	2
1dev/server :11.9.0	cd5b12fe5471	openssl@3.0.13-0ubuntu3.5	3.0.13-0ubuntu3.9	1