StackRadar

CVE-2026-40170

High

Advisory

Published 16 Apr 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.008
54th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
20
of 17,781 indexed, latest versions
Container images
21
deployed by those charts
Fix available
1 of 1
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 20 of 17,781 indexed charts deploy, on 21 images.

Affected packageAffected versionsFixed inImages
ngtcp2deb1.11.0-11.11.0-1+deb13u121
OSV records
DEBIAN-CVE-2026-40170

Charts affected

20 by stars
ChartLatestAffected imagesRadar Score
nautobotnautobotOfficialVerified publisher3.1.21 of 1See more

nautobot nautobot 3.1.2

1 of the 1 container images this version deploys carry CVE-2026-40170.

Container imageDigestPackageFixed in
networktocode/nautobot:3.0-py3.13ed484336b1ad
ngtcp2@1.11.0-1
1.11.0-1+deb13u1

Open the chart page →

4,332
dask-kubernetes-operatordask2026.3.01 of 1See more

dask-kubernetes-operator dask 2026.3.0

1 of the 1 container images this version deploys carry CVE-2026-40170.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
ngtcp2@1.11.0-1
1.11.0-1+deb13u1

Open the chart page →

9,316
coreinstill-aiOfficialVerified publisher0.1.753 of 15See more

core instill-ai 0.1.75

3 of the 15 container images this version deploys carry CVE-2026-40170.

Container imageDigestPackageFixed in
instill/artifact-backend:b28766ac4a393e601ed
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
instill/mgmt-backend:d0933d4ebe12f77a3f9
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
instill/model-backend:611f0f2e980125e5ba5
ngtcp2@1.11.0-1
1.11.0-1+deb13u1

Open the chart page →

30,816
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-40170.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
ngtcp2@1.11.0-1
1.11.0-1+deb13u1

Open the chart page →

12,037
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-40170.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
ngtcp2@1.11.0-1
1.11.0-1+deb13u1

Open the chart page →

11,205
iris-webappiris-webapp0.2.41 of 2See more

iris-webapp iris-webapp 0.2.4

1 of the 2 container images this version deploys carry CVE-2026-40170.

Container imageDigestPackageFixed in
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
ngtcp2@1.11.0-1
1.11.0-1+deb13u1

Open the chart page →

11,764
ansible-inspecansible-inspec0.2.171 of 2See more

ansible-inspec ansible-inspec 0.2.17

1 of the 2 container images this version deploys carry CVE-2026-40170.

Container imageDigestPackageFixed in
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
ngtcp2@1.11.0-1
1.11.0-1+deb13u1

Open the chart page →

5,558
clusterfactoryclusterfactory0.2.01 of 5See more

clusterfactory clusterfactory 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-40170.

Container imageDigestPackageFixed in
jenkins/jenkins:2.541.3-jdk21c4098086090c
ngtcp2@1.11.0-1
1.11.0-1+deb13u1

Open the chart page →

7,168
gitea-jenkinsclusterfactory0.1.11 of 5See more

gitea-jenkins clusterfactory 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-40170.

Container imageDigestPackageFixed in
jenkins/jenkins:2.541.3-jdk21c4098086090c
ngtcp2@1.11.0-1
1.11.0-1+deb13u1

Open the chart page →

5,238
iotaeclipse-aeriosVerified publisher1.0.21 of 4See more

iota eclipse-aerios 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-40170.

Container imageDigestPackageFixed in
eclipseaerios/iota-messages-api:lateste7f5ba0bc64d
ngtcp2@1.11.0-1
1.11.0-1+deb13u1

Open the chart page →

13,391
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-40170.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
ngtcp2@1.11.0-1
1.11.0-1+deb13u1

Open the chart page →

8,923
chiefonboardinghelmforgeVerified publisher1.1.141 of 3See more

chiefonboarding helmforge 1.1.14

1 of the 3 container images this version deploys carry CVE-2026-40170.

Container imageDigestPackageFixed in
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
ngtcp2@1.11.0-1
1.11.0-1+deb13u1

Open the chart page →

10,849
mcp-serverhelmforgeVerified publisher1.0.01 of 1See more

mcp-server helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-40170.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.2.061f759a1421f
ngtcp2@1.11.0-1
1.11.0-1+deb13u1

Open the chart page →

3,430
paperlessk8s-home-lab-repo11.0.11 of 1See more

paperless k8s-home-lab-repo 11.0.1

1 of the 1 container images this version deploys carry CVE-2026-40170.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
ngtcp2@1.11.0-1
1.11.0-1+deb13u1

Open the chart page →

9,103
kubiya-runnerkubiya-helm-chartsOfficialVerified publisher0.9.41 of 9See more

kubiya-runner kubiya-helm-charts 0.9.4

1 of the 9 container images this version deploys carry CVE-2026-40170.

Container imageDigestPackageFixed in
ghcr.io/kubiyabot/agent-manager:v0.4.13757bdd779345
ngtcp2@1.11.0-1
1.11.0-1+deb13u1

Open the chart page →

20,204
marge-botmarge-bot-helm1.3.51 of 1See more

marge-bot marge-bot-helm 1.3.5

1 of the 1 container images this version deploys carry CVE-2026-40170.

Container imageDigestPackageFixed in
hiboxsystems/marge-bot:0.16.0b59f01bc0418
ngtcp2@1.11.0-1
1.11.0-1+deb13u1

Open the chart page →

3,574
paperless-ngxmt1905027.6.141 of 4See more

paperless-ngx mt190502 7.6.14

1 of the 4 container images this version deploys carry CVE-2026-40170.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
ngtcp2@1.11.0-1
1.11.0-1+deb13u1

Open the chart page →

11,950
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-40170.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
ngtcp2@1.11.0-1
1.11.0-1+deb13u1

Open the chart page →

10,605
transmissionryuunosukeds31.6.21 of 2See more

transmission ryuunosukeds3 1.6.2

1 of the 2 container images this version deploys carry CVE-2026-40170.

Container imageDigestPackageFixed in
library/python:3.9da5aee29682d
ngtcp2@1.11.0-1
1.11.0-1+deb13u1

Open the chart page →

9,534
slothsloth0.16.01 of 2See more

sloth sloth 0.16.0

1 of the 2 container images this version deploys carry CVE-2026-40170.

Container imageDigestPackageFixed in
registry.k8s.io/git-sync/git-sync:v4.5.00e64aedb0d0a
ngtcp2@1.11.0-1
1.11.0-1+deb13u1

Open the chart page →

3,962

Container images carrying it

21 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
jenkins/jenkins:2.541.3-jdk21c4098086090c
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
2
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
1
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
1
eclipseaerios/iota-messages-api:lateste7f5ba0bc64d
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
1
helmforge/fastmcp-server:0.2.061f759a1421f
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
1
hiboxsystems/marge-bot:0.16.0b59f01bc0418
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
1
instill/artifact-backend:b28766ac4a393e601ed
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
1
instill/mgmt-backend:d0933d4ebe12f77a3f9
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
1
instill/model-backend:611f0f2e980125e5ba5
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
1
library/python:3.9da5aee29682d
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
1
networktocode/nautobot:3.0-py3.13ed484336b1ad
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
1
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
1
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
1
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
1
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
1
ghcr.io/kubiyabot/agent-manager:v0.4.13757bdd779345
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
1
registry.k8s.io/git-sync/git-sync:v4.5.00e64aedb0d0a
ngtcp2@1.11.0-1
1.11.0-1+deb13u1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.