StackRadar

CVE-2026-34478

Medium

Advisory

Published 10 Apr 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.010
60th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
104
of 17,781 indexed, latest versions
Container images
99
deployed by those charts
Fix available
1 of 1
affected package

Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibility

Carried by container images the latest versions of 104 of 17,781 indexed charts deploy, on 99 images.

Affected packageAffected versionsFixed inImages
log4j-coremaven2.21.0, 2.21.1, 2.22.0, 2.22.1+11 more2.25.499
OSV records
GHSA-445c-vh5m-36rj

Charts affected

104 by stars
ChartLatestAffected imagesRadar Score
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-34478.

Container imageDigestPackageFixed in
wazuh/wazuh-indexer:4.14.49c344d2b1757
log4j-core@2.21.0
2.25.4

Open the chart page →

5,484
hazelcastwenerme5.10.22 of 2See more

hazelcast wenerme 5.10.2

2 of the 2 container images this version deploys carry CVE-2026-34478.

Container imageDigestPackageFixed in
hazelcast/hazelcast:5.5.05dd5d31c7a06
log4j-core@2.23.1
2.25.4
hazelcast/management-center:5.5.2991ddb27c251
log4j-core@2.23.1
2.25.4

Open the chart page →

2,634
elasticsearchwiremindVerified publisher8.19.01 of 1See more

elasticsearch wiremind 8.19.0

1 of the 1 container images this version deploys carry CVE-2026-34478.

Container imageDigestPackageFixed in
library/elasticsearch:8.19.1289729a95066a
log4j-core@2.25.0
2.25.4

Open the chart page →

2,191
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-34478.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.18.07f6fa1efee8f
log4j-core@2.21.0
2.25.4

Open the chart page →

9,381

Container images carrying it

99 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
folioci/mod-rtac:latestc959b2d6142f
log4j-core@2.24.3
2.25.4
1
folioci/mod-sender:latestd88a675dddf0
log4j-core@2.25.2
2.25.4
1
folioci/mod-template-engine:latestd105c585da30
log4j-core@2.24.3
2.25.4
1
folioci/mod-users-bl:latest4e2d96c9340d
log4j-core@2.25.2
2.25.4
1
fonoster/routr-edgeport:2.13.6d08a8a574a50
log4j-core@2.22.0
2.25.4
1
fonoster/routr-requester:2.13.6e0c823506eb2
log4j-core@2.22.0
2.25.4
1
geonode/geoserver:2.28.4-latest81b1d431b7e9
log4j-core@2.25.3
2.25.4
1
graylog/graylog:6.1.1019de1aff48c2
log4j-core@2.24.1
2.25.4
1
gridgain/cloud-connector:2025.5.15ab838d7d3cb
log4j-core@2.25.3
2.25.4
1
library/neo4j:2026.02.25ab4ab0358cf
log4j-core@2.25.3
2.25.4
1
metabase/metabase:v0.53.4.17807bc5cad17
log4j-core@2.24.2
2.25.4
1
opennms/sentinel:36.0.288869082a14f
log4j-core@2.24.3
2.25.4
1
opensearchproject/data-prepper:2.8.057c25fa01d3c
log4j-core@2.23.1
2.25.4
1
opensearchproject/opensearch:2.15.01963b3ece46d
log4j-core@2.21.0
2.25.4
1
opensearchproject/opensearch:2.14.0466a49f379bb
log4j-core@2.21.0
2.25.4
1
opensearchproject/opensearch:3.1.0474ea3fdf25d
log4j-core@2.21.0
2.25.4
1
opensearchproject/opensearch:2.12.0645d3d9390ad
log4j-core@2.21.0
2.25.4
1
opensearchproject/opensearch:2.19.269588c664014
log4j-core@2.21.0
2.25.4
1
opensearchproject/opensearch:3.3.2798cf28e226a
log4j-core@2.21.0
2.25.4
1
openzipkin/zipkin:2.24197a9692f6a9
log4j-core@2.22.0
2.25.4
1
penpotapp/backend:2.2.147853d9bb9dd
log4j-core@2.23.1
2.25.4
1
radarbase/radar-push-endpoint:0.4.0e1758508e033
log4j-core@2.23.0
2.25.4
1
resurfaceio/resurface:3.7.84d5cda2f64109
log4j-core@2.24.3
2.25.4
1
soldevelo/kafka:4.0.0-debian-12-r0cfdc08c2f577
log4j-core@2.24.3
2.25.4
1
stain/jena-fuseki:latestb1d0c96f19ad
log4j-core@2.23.1
2.25.4
1
structurizr/onpremises:2025.11.094b5ffb5119c8
log4j-core@2.24.3
2.25.4
1
treskon/portrait:DEV-latest88e813f22347
log4j-core@2.23.1
2.25.4
1
wazuh/wazuh-indexer:4.14.49c344d2b1757
log4j-core@2.21.0
2.25.4
1
wazuh/wazuh-indexer:4.11.1a7a2076b167e
log4j-core@2.21.0
2.25.4
1
wazuh/wazuh-indexer:4.14.3b149b30da686
log4j-core@2.21.0
2.25.4
1
gcr.io/spotinst-artifacts/spot-ocean-metric-exporter:1.0.5ae57b62291aa
log4j-core@2.24.3
2.25.4
1
ghcr.io/apache/flink-kubernetes-operator:c703255e9c2ce635b89
log4j-core@2.23.1
2.25.4
1
ghcr.io/devops-ia/cp-schema-registry:8.1.1-msk-iam-auth2.3.530d1a445acc7
log4j-core@2.24.3
2.25.4
1
ghcr.io/kenchrcum/tika:3.3.0-full708446bc6783
log4j-core@2.25.3
2.25.4
1
ghcr.io/openccu/openccu:3.89.8.20260719b2de2ff6e8e0
log4j-core@2.25.2
2.25.4
1
ghcr.io/open-telemetry/demo:1.12.0-frauddetectionservice77cefdab4d5c
log4j-core@2.21.1
2.25.4
1
ghcr.io/open-telemetry/demo:1.12.0-adservicea59e5eead495
log4j-core@2.23.1
2.25.4
1
ghcr.io/radar-base/radar-app-config/radar-app-config:0.6.24431db7b486b
log4j-core@2.23.1
2.25.4
1
ghcr.io/radar-base/radar-data-dashboard-backend/radar-data-dashboard-backend:0.2.4d1e55350923c
log4j-core@2.21.0
2.25.4
1
ghcr.io/radar-base/radar-gateway/radar-gateway:0.9.4219d894aa7a6
log4j-core@2.23.1
2.25.4
1
ghcr.io/radar-base/radar-output-restructure/radar-output-restructure:3.0.67fb9c70e96a4
log4j-core@2.21.0
2.25.4
1
ghcr.io/radar-base/radar-upload-source-connector/radar-upload-connect-backend:0.6.46a04b43b8d9a
log4j-core@2.21.1
2.25.4
1
public.ecr.aws/aktosecurity/akto-threat-detection:latest3f103ce347ce
log4j-core@2.24.2
2.25.4
1
public.ecr.aws/aktosecurity/akto-threat-detection:1.16.2a47eb6cc17ea
log4j-core@2.24.2
2.25.4
1
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.0-1-ubi99026dbbf280d
log4j-core@2.24.3
2.25.4
1
public.ecr.aws/aws-containers/retail-store-sample-cart:1.3.05d767569c976
log4j-core@2.24.3
2.25.4
1
public.ecr.aws/aws-containers/retail-store-sample-orders:1.3.0e85f034bcf48
log4j-core@2.24.3
2.25.4
1
public.ecr.aws/aws-containers/retail-store-sample-ui:1.3.0ce3f2e935eb3
log4j-core@2.24.3
2.25.4
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
log4j-core@3.0.0-beta3
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.