StackRadarChart IndexLive demo

CVE-2026-33175

High

Advisory

Published 3 Apr 2026In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 8.8; base score, highest
EPSS: 0.004; 37th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 7; of 17,781 indexed, latest versions
Container images: 9; deployed by those charts
Fix available: 1 of 1; affected package

Auth0OAuthenticator has an Authentication Bypass via Unverified Email Claims

Carried by container images the latest versions of 7 of 17,781 indexed charts deploy, on 9 images.

Affected package	Affected versions	Fixed in	Images
oauthenticatorpypi	0.12.3, 0.13.0, 14.2.0, 15.1.0+3 more	17.4.0	9

OSV records: GHSA-rrvg-cxh4-qhrv
Also known as: PYSEC-2026-2238

Charts affected

7 by stars

Chart

Latest

Affected images

Radar Score

fadicetic

1 of 25 See more

fadi cetic 0.3.1

1 of the 25 container images this version deploys carry CVE-2026-33175.

Container image	Digest	Package	Fixed in
jupyterhub/k8s-hub :0.11.1	b6b4a1a34bf0	oauthenticator@0.12.3	17.4.0

Open the chart page →

52,919

1 of 9 See more

daskhub dask 2024.1.1

1 of the 9 container images this version deploys carry CVE-2026-33175.

Container image	Digest	Package	Fixed in
quay.io/jupyterhub/k8s-hub :3.2.1	2528c6e57587	oauthenticator@16.2.1	17.4.0

Open the chart page →

14,094

1 of 7 See more

jupyterhub d4n 3.3.7

1 of the 7 container images this version deploys carry CVE-2026-33175.

Container image	Digest	Package	Fixed in
aristidetm/k8s-hub :3.3.7	ccb516cb8474	oauthenticator@16.3.0	17.4.0

Open the chart page →

16,604

ikigaiikigai-chart

1 of 58 See more

ikigai ikigai-chart 0.0.9

1 of the 58 container images this version deploys carry CVE-2026-33175.

Container image	Digest	Package	Fixed in
jupyterhub/k8s-hub :1.2.0	e4770285aaf7	oauthenticator@14.2.0	17.4.0

Open the chart page →

37,671

jupyterhubkubeblocks

1 of 7 See more

jupyterhub kubeblocks 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-33175.

Container image	Digest	Package	Fixed in
jupyterhub/k8s-hub :3.0.1-0.dev.git.6287.hbfb05cd6	5a0ceed1300a	oauthenticator@16.0.4	17.4.0

Open the chart page →

7,356

nubladolsst-sqre

3 of 5 See more

nublado lsst-sqre 0.9.23

3 of the 5 container images this version deploys carry CVE-2026-33175.

Container image	Digest	Package	Fixed in
lsstsqre/prepuller :latest	19c2dfc4e4ff	oauthenticator@0.13.0	17.4.0
lsstsqre/sciplat-hub :latest	5e0ade6bed1c	oauthenticator@0.13.0	17.4.0
lsstsqre/wfdispatcher :latest	e9feb99f524d	oauthenticator@0.13.0	17.4.0

Open the chart page →

5,786

jupyterhubuninettsigma2

1 of 5 See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2026-33175.

Container image	Digest	Package	Fixed in
quay.io/nird-toolkit/jupyterhub-server :20221215-e6aa80e	cae8c0622533	oauthenticator@15.1.0	17.4.0

Open the chart page →

8,607

Container images carrying it

9 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
aristidetm/k8s-hub :3.3.7	ccb516cb8474	oauthenticator@16.3.0	17.4.0	1
jupyterhub/k8s-hub :3.0.1-0.dev.git.6287.hbfb05cd6	5a0ceed1300a	oauthenticator@16.0.4	17.4.0	1
jupyterhub/k8s-hub :0.11.1	b6b4a1a34bf0	oauthenticator@0.12.3	17.4.0	1
jupyterhub/k8s-hub :1.2.0	e4770285aaf7	oauthenticator@14.2.0	17.4.0	1
lsstsqre/prepuller :latest	19c2dfc4e4ff	oauthenticator@0.13.0	17.4.0	1
lsstsqre/sciplat-hub :latest	5e0ade6bed1c	oauthenticator@0.13.0	17.4.0	1
lsstsqre/wfdispatcher :latest	e9feb99f524d	oauthenticator@0.13.0	17.4.0	1
quay.io/jupyterhub/k8s-hub :3.2.1	2528c6e57587	oauthenticator@16.2.1	17.4.0	1
quay.io/nird-toolkit/jupyterhub-server :20221215-e6aa80e	cae8c0622533	oauthenticator@15.1.0	17.4.0	1