CVE-2026-3731

High

Advisory

Published 8 Mar 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.006; 48th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 555; of 17,787 indexed, latest versions
Container images: 472; deployed by those charts
Fix available: 2 of 2; affected packages

Security update for libssh

Carried by container images the latest versions of 555 of 17,787 indexed charts deploy, on 472 images.

Affected package	Affected versions	Fixed in	Images
libsshdeb	0.6.3-4.3, 0.6.3-4.3ubuntu0.2, 0.8.0~20170825.94fa1e38-1ubuntu0.2, 0.8.0~20170825.94fa1e38-1ubuntu0.5+22 more	0.6.3-4.3ubuntu0.6+esm5, 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm7, 0.9.3-2ubuntu2.5+esm4, 0.9.6-2ubuntu0.22.04.7+4 more	469
libsshrpm	0.9.8-150600.11.3.1	0.9.8-150600.11.12.1	3

OSV records: DEBIAN-CVE-2026-3731 UBUNTU-CVE-2026-3731 SUSE-SU-2026:1310-1
Also known as: USN-8093-1, USN-8093-2

Charts affected

555 by stars

Chart

Latest

Affected images

Radar Score

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-3731.

Container image	Digest	Package	Fixed in
library/mongo :4.4	4be76f674fc4	libssh@0.9.3-2ubuntu2.5	0.9.3-2ubuntu2.5+esm4

Open the chart page →

28,605

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-3731.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	libssh@0.9.3-2ubuntu2.2	0.9.3-2ubuntu2.5+esm4

Open the chart page →

15,230

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-3731.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	libssh@0.9.6-2ubuntu0.22.04.1	0.9.6-2ubuntu0.22.04.7

Open the chart page →

9,248

kibanawiremind

8.5.23

1 of 2 See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-3731.

Container image	Digest	Package	Fixed in
library/kibana :8.18.0	04c0fc150f3a	libssh@0.9.3-2ubuntu2.5	0.9.3-2ubuntu2.5+esm4

Open the chart page →

6,285

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-3731.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	libssh@0.9.6-2ubuntu0.22.04.3	0.9.6-2ubuntu0.22.04.7

Open the chart page →

14,100

Container images carrying it

472 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/k8s-at-home/haste-server :latest	827aa2f2389d	libssh@0.9.3-2ubuntu2.1	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/k8s-at-home/jackett :v0.20.1316	3a4715b46aa2	libssh@0.9.3-2ubuntu2.2	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/k8s-at-home/lidarr :v1.0.0.2255	54ebc1f90963	libssh@0.9.3-2ubuntu2.1	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/k8s-at-home/network-ups-tools :v2.7.4-2479-g86a32237	cbd5d4cc1245	libssh@0.9.3-2ubuntu2.1	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/k8s-at-home/nzbget :v21.1	e5571acd10ce	libssh@0.9.6-2build1	0.9.6-2ubuntu0.22.04.7	1
ghcr.io/k8s-at-home/nzbhydra2 :v3.14.2	ef3670f7e0a8	libssh@0.9.3-2ubuntu2.1	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/k8s-at-home/plex :v1.28.0.5999-97678ded3	ef756c7d784b	libssh@0.9.3-2ubuntu2.2	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/k8s-at-home/prowlarr :v0.3.0.1710	c863aa9875fa	libssh@0.9.3-2ubuntu2.2	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/k8s-at-home/qbittorrent :v4.4.2	61deadd1ec78	libssh@0.9.3-2ubuntu2.2	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/k8s-at-home/radarr :v4.1.0.6175	4273dfaf0295	libssh@0.9.6-2build1	0.9.6-2ubuntu0.22.04.7	1
ghcr.io/k8s-at-home/readarr :v0.1.0.715	ad943e9309e4	libssh@0.9.3-2ubuntu2.1	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/k8s-at-home/sabnzbd :v3.3.1	c2d6e775db5a	libssh@0.9.3-2ubuntu2.1	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/k8s-at-home/sonarr :v3.0.8.1507	0eb230e2381a	libssh@0.9.6-2build1	0.9.6-2ubuntu0.22.04.7	1
ghcr.io/k8s-at-home/tautulli :v2.7.7	4ea617c30397	libssh@0.9.3-2ubuntu2.2	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/k8s-at-home/transmission :v3.00	6011182e3946	libssh@0.9.3-2ubuntu2.2	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/k8s-at-home/wireguard :v1.0.20210424	448045c4270b	libssh@0.9.3-2ubuntu2.1	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/k8s-at-home/xteve :v2.2.0.200	292b3614670f	libssh@0.9.3-2ubuntu2.2	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/k8s-home-lab/wireguard :v1.0.20210914	779858b5e11d	libssh@0.9.3-2ubuntu2.3	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/kamu-data/kamu-api-server :0.89.0	4ed7a896dd2b	libssh@0.9.3-2ubuntu2.5	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/karakeep-app/karakeep :0.33.2	b069e4307dec	libssh@0.10.6-0+deb12u2	no fix listed	1
ghcr.io/kubeflow/spark-operator/controller :2.2.1	865ff4da5686	libssh@0.9.3-2ubuntu2.5	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/kvaps/kubefarm-ltsp :v0.13.4	24efef013a53	libssh@0.9.3-2ubuntu2.2	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/kvaps/opennebula :v5.12.0.4-1	e28e0e7de11b	libssh@0.9.3-2ubuntu2.1	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/kvaps/opennebula-exporter :v5.12.0.4	01563adc95fd	libssh@0.9.3-2ubuntu2.1	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/kvaps/opennebula-exporter :v5.12.0.4-1	2b92df1143b9	libssh@0.9.3-2ubuntu2.1	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/kvaps/opennebula-flow :v5.12.0.4-1	600221f0f43f	libssh@0.9.3-2ubuntu2.1	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/kvaps/opennebula-gate :v5.12.0.4-1	a85e03d8bc1d	libssh@0.9.3-2ubuntu2.1	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/linuxserver/booksonic-air :version-v2009.1.0	baa4fa9549dc	libssh@0.8.0~20170825.94fa1e38-1ubuntu0.7	0.8.0~20170825.94fa1e38-1ubuntu0.7+esm7	1
ghcr.io/linuxserver/ombi :4.16.12	4c1b67cf39af	libssh@0.9.6-2build1	0.9.6-2ubuntu0.22.04.7	1
ghcr.io/linuxserver/plex :version-1.41.4.9463-630c9f557	e6d2775e77ec	libssh@0.10.6-2build2	0.10.6-2ubuntu0.4	1
ghcr.io/maastrichtu-ids/rstudio :latest	981aa4c109e1	libssh@0.10.6-2build2	0.10.6-2ubuntu0.4	1
ghcr.io/mosn/htnn-controller :v0.3.1	c379e66246be	libssh@0.9.6-2ubuntu0.22.04.3	0.9.6-2ubuntu0.22.04.7	1
ghcr.io/music-assistant/server :2.7.5	3522e8a7a8f0	libssh@0.10.6-0+deb12u2	no fix listed	1
ghcr.io/music-assistant/server :2.9.9	50666a6f8d7f	libssh@0.10.6-0+deb12u2	no fix listed	1
ghcr.io/music-assistant/server :2.8.7	eef3ee7810d0	libssh@0.10.6-0+deb12u2	no fix listed	1
ghcr.io/open-telemetry/demo :1.12.0-adservice	a59e5eead495	libssh@0.10.6-2build2	0.10.6-2ubuntu0.4	1
ghcr.io/oznu/homebridge :2022-07-08	ff2af53897e7	libssh@0.9.3-2ubuntu2.2	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/paperless-ngx/paperless-ngx :2.13.1	0642357c5dbd	libssh@0.10.6-0+deb12u1	no fix listed	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.13	4b05bcd28e69	libssh@0.11.2-1+deb13u1	0.11.5-0+deb13u1	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.3	57ad9565bff3	libssh@0.11.2-1+deb13u1	0.11.5-0+deb13u1	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.5	665f2f5cc548	libssh@0.11.2-1+deb13u1	0.11.5-0+deb13u1	1
ghcr.io/paperless-ngx/paperless-ngx :2.0.1	ab255bea133e	libssh@0.10.5-2	no fix listed	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.14	b89f83345532	libssh@0.11.2-1+deb13u1	0.11.5-0+deb13u1	1
ghcr.io/radar-base/radar-upload-source-connector/radar-upload-connect-backend :0.6.4	6a04b43b8d9a	libssh@0.10.6-2ubuntu0.1	0.10.6-2ubuntu0.4	1
ghcr.io/samr037/node-debug-dashboard :0.3.0	c79b2e64a211	libssh@0.10.6-0+deb12u2	no fix listed	1
ghcr.io/sergelogvinov/mongosync :1.15.0	fa99ed475f03	libssh@0.10.6-2ubuntu0.1	0.10.6-2ubuntu0.4	1
ghcr.io/smarter-project/audio-client :v3.1.2	3c8375dc5487	libssh@0.9.3-2ubuntu2.2	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/smarter-project/gstreamer :v1.0.2	5ecb16015aa8	libssh@0.9.3-2ubuntu2.2	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/smarter-project/image-detector :v2.5.3	1dcca70c6446	libssh@0.9.3-2ubuntu2.2	0.9.3-2ubuntu2.5+esm4	1
ghcr.io/streamingfast/firehose-core :v1.12.3	91fca773a63f	libssh@0.10.6-2ubuntu0.2	0.10.6-2ubuntu0.4	1