StackRadar

CVE-2026-40355

High

Advisory

Published 28 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
47th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
914
of 17,787 indexed, latest versions
Container images
970
deployed by those charts
Fix available
1 of 1
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 914 of 17,787 indexed charts deploy, on 970 images.

Affected packageAffected versionsFixed inImages
krb5deb1.19.2-2, 1.19.2-2ubuntu0.1, 1.19.2-2ubuntu0.2, 1.19.2-2ubuntu0.3+20 more1.19.2-2ubuntu0.8, 1.20.1-2+deb12u5, 1.20.1-6ubuntu2.7, 1.21.3-5+deb13u1+2 more970
OSV records
DEBIAN-CVE-2026-40355UBUNTU-CVE-2026-40355ECHO-3921-9f59-f2e1
Also known as
USN-8585-1

Charts affected

914 by stars
ChartLatestAffected imagesRadar Score
welcome-elos-webappwelcome-elos-webappVerified publisher2.0.01 of 1See more

welcome-elos-webapp welcome-elos-webapp 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
pococze/python-hello-elos:2.0.07a1aab425e51
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5

Open the chart page →

2,538
giteawenerme12.7.02 of 4See more

gitea wenerme 12.7.0

2 of the 4 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
bitnamilegacy/pgpool:4.6.3-debian-12-r0d3bf3910f148
krb5@1.20.1-2+deb12u3
1.20.1-2+deb12u5
bitnamilegacy/postgresql-repmgr:17.6.0-debian-12-r2f12387ec882b
krb5@1.20.1-2+deb12u3
1.20.1-2+deb12u5

Open the chart page →

8,842
juicefs-csi-driverwenerme0.32.51 of 5See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.32.595008ba63318
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5

Open the chart page →

8,824
openebswenerme3.10.02 of 3See more

openebs wenerme 3.10.0

2 of the 3 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
openebs/node-disk-manager:2.1.0f6c18b0f8c8a
krb5@1.19.2-2ubuntu0.1
1.19.2-2ubuntu0.8
openebs/node-disk-operator:2.1.06afe2123c457
krb5@1.19.2-2ubuntu0.1
1.19.2-2ubuntu0.8

Open the chart page →

10,568
jaegerwikimedia3.1.21 of 4See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
jaegertracing/jaeger-cassandra-schema:1.53.0d48d6dab2c65
krb5@1.19.2-2ubuntu0.3
1.19.2-2ubuntu0.8

Open the chart page →

9,296
elasticsearchwiremindVerified publisher8.19.01 of 1See more

elasticsearch wiremind 8.19.0

1 of the 1 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
library/elasticsearch:8.19.1289729a95066a
krb5@1.20.1-6ubuntu2.6
1.20.1-6ubuntu2.7

Open the chart page →

2,229
keycloakwiremindVerified publisher25.3.11 of 2See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
ghcr.io/wiremind/bitnami/keycloak:26.5.0-debian-12-r38622ea9e43c0
krb5@1.20.1-2+deb12u4
1.20.1-2+deb12u5

Open the chart page →

7,643
marge-botwiremindVerified publisher1.4.41 of 1See more

marge-bot wiremind 1.4.4

1 of the 1 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
hiboxsystems/marge-bot:0.14.0dcffb926e563
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5

Open the chart page →

5,548
rabbitmqwiremindVerified publisher16.0.171 of 1See more

rabbitmq wiremind 16.0.17

1 of the 1 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
ghcr.io/wiremind/bitnami/rabbitmq:4.2.2-debian-12-r11572e12bc93c
krb5@1.20.1-2+deb12u4
1.20.1-2+deb12u5

Open the chart page →

2,383
wordpress-alpinewordpress-alpine1.5.181 of 6See more

wordpress-alpine wordpress-alpine 1.5.18

1 of the 6 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
library/mariadb:12.3.2628f228f0fd5
krb5@1.20.1-6ubuntu2.6
1.20.1-6ubuntu2.7

Open the chart page →

4,032
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
krb5@1.19.2-2ubuntu0.3
1.19.2-2ubuntu0.8

Open the chart page →

14,172
tabbyxdVerified publisher1.0.61 of 2See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
library/nginx:1.25a484819eb602
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5

Open the chart page →

7,685
xkopsxkops0.1.03 of 5See more

xkops xkops 0.1.0

3 of the 5 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
hamzaarshad10/querybackend:1.6.22c1c3b86a8e7
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
hamzaarshad10/querypodpy:1.7154f38e8668e
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
murtazashah46/helmfile:latest4d11726cf803
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5

Open the chart page →

13,197
xlinexline0.0.11 of 1See more

xline xline 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
ghcr.io/liangyuanpeng/xline:latest3d2eceb44a3b
krb5@1.20.1-6ubuntu2
1.20.1-6ubuntu2.7

Open the chart page →

2,136

Container images carrying it

970 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
apache/airflow:2.8.1e5560ad0b86e
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5
1
apache/gravitino-iceberg-rest:1.3.080136ae753ee
krb5@1.19.2-2ubuntu0.7
1.19.2-2ubuntu0.8
1
apache/hertzbeat:1.8.075d48a62748f
krb5@1.20.1-6ubuntu2.6
1.20.1-6ubuntu2.7
1
apache/hertzbeat-collector:1.8.0a2bab1be574c
krb5@1.20.1-6ubuntu2.6
1.20.1-6ubuntu2.7
1
apache/nifi-registry:1.27.063b8e3e40742
krb5@1.19.2-2ubuntu0.3
1.19.2-2ubuntu0.8
1
apachepulsar/pulsar:3.1.016f9fdab3fa6
krb5@1.19.2-2ubuntu0.2
1.19.2-2ubuntu0.8
1
apachepulsar/pulsar:3.0.79c9947de139d
krb5@1.19.2-2ubuntu0.4
1.19.2-2ubuntu0.8
1
apache/ranger:2.7.076c176e8a0e4
krb5@1.19.2-2ubuntu0.7
1.19.2-2ubuntu0.8
1
apache/rocketmq:5.3.0434d8398f996
krb5@1.20.1-6ubuntu2
1.20.1-6ubuntu2.7
1
apache/rocketmq-exporter:0.0.2c8fb51195444
krb5@1.19.2-2ubuntu0.3
1.19.2-2ubuntu0.8
1
apache/skywalking-oap-server:9.2.0133d35d2c263
krb5@1.19.2-2
1.19.2-2ubuntu0.8
1
apache/skywalking-ui:9.2.0295f1dc87d98
krb5@1.19.2-2
1.19.2-2ubuntu0.8
1
apache/superset:4.0.1ab9467fd712c
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5
1
apache/tika:2.9.0.092d055a84e9e
krb5@1.19.2-2ubuntu0.1
1.19.2-2ubuntu0.8
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
krb5@1.21.3-5
1.21.3-5+deb13u1
1
archivebox/archivebox:0.7.41a5a37331091
krb5@1.20.1-2+deb12u4
1.20.1-2+deb12u5
1
aristidetm/basic-notebook:3.6.5469dbc951224
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
1
arthurjguerra18/revwallet:v0.7.12f540af20b307
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
1
artur9010/wait-for:v1.0.06b4de3ce8b0e
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5
1
arunvelsriram/utils:latest655ad18fd8d6
krb5@1.20.1-6ubuntu2.6
1.20.1-6ubuntu2.7
1
assistiot/identity-manager_db:latest0d3e6d35f168
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5
1
assistiot/location_processing:lateste9bae124095f
krb5@1.19.2-2
1.19.2-2ubuntu0.8
1
assistiot/open_api_backend:1.1.230812ba93555
krb5@1.19.2-2ubuntu0.3
1.19.2-2ubuntu0.8
1
assistiot/smart-orchestrator_mcs:latest7d6a0d534c7f
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5
1
assistiot/smart-orchestrator_scheduler:latest38b003e55ff3
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5
1
assistiot/smart-orchestrator_scheduler_mc:latestb1dbe4d62a03
krb5@1.20.1-2
1.20.1-2+deb12u5
1
atlassian/confluence-server:7.10.03b9222ab32ef
krb5@1.19.2-2
1.19.2-2ubuntu0.8
1
atlassian/jira-software:8.14.037bc46cbec1a
krb5@1.19.2-2ubuntu0.3
1.19.2-2ubuntu0.8
1
atlassian/jira-software:9.7.264a75aa4ec4e
krb5@1.20.1-6ubuntu2.5
1.20.1-6ubuntu2.7
1
avinash263/pyredis263:latestaa2b8727f1a6
krb5@1.20.1-2
1.20.1-2+deb12u5
1
avzini/web-app:latestf40b30210ed0
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5
1
baserow/backend:1.31.1e0b3c8130b91
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
1
baserow/baserow:1.30.1df0c42eb67e8
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
1
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
krb5@1.21.3-5
1.21.3-5+deb13u1
1
beyzkaya/blog-backend:v1.0.112a6a3d1c5f9
krb5@1.20.1-2+deb12u3
1.20.1-2+deb12u5
1
bitnamilegacy/cassandra:4.1.7-debian-12-r32b7a217999a1
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
1
bitnamilegacy/consul:1.21.4-debian-12-r133ae872fc99d
krb5@1.20.1-2+deb12u3
1.20.1-2+deb12u5
1
bitnamilegacy/elasticsearch:8.12.215d4647fd491
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5
1
bitnamilegacy/elasticsearch:9.0.1-debian-12-r0e6f6ddcce2f1
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
1
bitnamilegacy/git:latest4b08d0c5af8d
krb5@1.20.1-2+deb12u3
1.20.1-2+deb12u5
1
bitnamilegacy/grafana:11.4.0-debian-12-r0cb8ab5515676
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
1
bitnamilegacy/keycloak:24.0.4cc599cbd15ff
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5
1
bitnamilegacy/keycloak:26.3.3-debian-12-r0da3df0976a9f
krb5@1.20.1-2+deb12u3
1.20.1-2+deb12u5
1
bitnamilegacy/kubectl:1.301249fc292e84
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
1
bitnamilegacy/kubectl:1.3164614ef8290f
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
1
bitnamilegacy/kubectl:1.30.5744f84cf7493
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
1
bitnamilegacy/kubectl:1.29.3f5fc0d561d9e
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5
1
bitnamilegacy/mariadb-galera:11.3.2-debian-12-r9aee9c668098f
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5
1
bitnamilegacy/mariadb-galera:11.4.3-debian-12-r0cb8beb6dbb58
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
1
bitnamilegacy/matomo:5.3.2-debian-12-r13f02c000c54b1
krb5@1.20.1-2+deb12u3
1.20.1-2+deb12u5
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.