StackRadar

CVE-2026-40355

High

Advisory

Published 28 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
47th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
914
of 17,787 indexed, latest versions
Container images
970
deployed by those charts
Fix available
1 of 1
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 914 of 17,787 indexed charts deploy, on 970 images.

Affected packageAffected versionsFixed inImages
krb5deb1.19.2-2, 1.19.2-2ubuntu0.1, 1.19.2-2ubuntu0.2, 1.19.2-2ubuntu0.3+20 more1.19.2-2ubuntu0.8, 1.20.1-2+deb12u5, 1.20.1-6ubuntu2.7, 1.21.3-5+deb13u1+2 more970
OSV records
DEBIAN-CVE-2026-40355UBUNTU-CVE-2026-40355ECHO-3921-9f59-f2e1
Also known as
USN-8585-1

Charts affected

914 by stars
ChartLatestAffected imagesRadar Score
welcome-elos-webappwelcome-elos-webappVerified publisher2.0.01 of 1See more

welcome-elos-webapp welcome-elos-webapp 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
pococze/python-hello-elos:2.0.07a1aab425e51
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5

Open the chart page →

2,538
giteawenerme12.7.02 of 4See more

gitea wenerme 12.7.0

2 of the 4 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
bitnamilegacy/pgpool:4.6.3-debian-12-r0d3bf3910f148
krb5@1.20.1-2+deb12u3
1.20.1-2+deb12u5
bitnamilegacy/postgresql-repmgr:17.6.0-debian-12-r2f12387ec882b
krb5@1.20.1-2+deb12u3
1.20.1-2+deb12u5

Open the chart page →

8,842
juicefs-csi-driverwenerme0.32.51 of 5See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.32.595008ba63318
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5

Open the chart page →

8,824
openebswenerme3.10.02 of 3See more

openebs wenerme 3.10.0

2 of the 3 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
openebs/node-disk-manager:2.1.0f6c18b0f8c8a
krb5@1.19.2-2ubuntu0.1
1.19.2-2ubuntu0.8
openebs/node-disk-operator:2.1.06afe2123c457
krb5@1.19.2-2ubuntu0.1
1.19.2-2ubuntu0.8

Open the chart page →

10,568
jaegerwikimedia3.1.21 of 4See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
jaegertracing/jaeger-cassandra-schema:1.53.0d48d6dab2c65
krb5@1.19.2-2ubuntu0.3
1.19.2-2ubuntu0.8

Open the chart page →

9,296
elasticsearchwiremindVerified publisher8.19.01 of 1See more

elasticsearch wiremind 8.19.0

1 of the 1 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
library/elasticsearch:8.19.1289729a95066a
krb5@1.20.1-6ubuntu2.6
1.20.1-6ubuntu2.7

Open the chart page →

2,229
keycloakwiremindVerified publisher25.3.11 of 2See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
ghcr.io/wiremind/bitnami/keycloak:26.5.0-debian-12-r38622ea9e43c0
krb5@1.20.1-2+deb12u4
1.20.1-2+deb12u5

Open the chart page →

7,643
marge-botwiremindVerified publisher1.4.41 of 1See more

marge-bot wiremind 1.4.4

1 of the 1 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
hiboxsystems/marge-bot:0.14.0dcffb926e563
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5

Open the chart page →

5,548
rabbitmqwiremindVerified publisher16.0.171 of 1See more

rabbitmq wiremind 16.0.17

1 of the 1 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
ghcr.io/wiremind/bitnami/rabbitmq:4.2.2-debian-12-r11572e12bc93c
krb5@1.20.1-2+deb12u4
1.20.1-2+deb12u5

Open the chart page →

2,383
wordpress-alpinewordpress-alpine1.5.181 of 6See more

wordpress-alpine wordpress-alpine 1.5.18

1 of the 6 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
library/mariadb:12.3.2628f228f0fd5
krb5@1.20.1-6ubuntu2.6
1.20.1-6ubuntu2.7

Open the chart page →

4,032
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
krb5@1.19.2-2ubuntu0.3
1.19.2-2ubuntu0.8

Open the chart page →

14,172
tabbyxdVerified publisher1.0.61 of 2See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
library/nginx:1.25a484819eb602
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5

Open the chart page →

7,685
xkopsxkops0.1.03 of 5See more

xkops xkops 0.1.0

3 of the 5 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
hamzaarshad10/querybackend:1.6.22c1c3b86a8e7
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
hamzaarshad10/querypodpy:1.7154f38e8668e
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
murtazashah46/helmfile:latest4d11726cf803
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5

Open the chart page →

13,197
xlinexline0.0.11 of 1See more

xline xline 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-40355.

Container imageDigestPackageFixed in
ghcr.io/liangyuanpeng/xline:latest3d2eceb44a3b
krb5@1.20.1-6ubuntu2
1.20.1-6ubuntu2.7

Open the chart page →

2,136

Container images carrying it

970 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
clickhouse/clickhouse-server:25.3.14.14b627d7a9bc0e
krb5@1.19.2-2ubuntu0.7
1.19.2-2ubuntu0.8
1
clickhouse/clickhouse-server:23.4.2.11dc5658853ce1
krb5@1.19.2-2ubuntu0.1
1.19.2-2ubuntu0.8
1
clickhouse/clickhouse-server:25.10.2.65e019438e1e05
krb5@1.19.2-2ubuntu0.7
1.19.2-2ubuntu0.8
1
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
krb5@1.20.1-2+deb12u4
1.20.1-2+deb12u5
1
clowder/clowder2-heartbeat:2.0.0-beta.414155326c7b9
krb5@1.20.1-2+deb12u4
1.20.1-2+deb12u5
1
clowder/clowder2-messages:2.0.0-beta.4bf146f1ca24f
krb5@1.20.1-2+deb12u4
1.20.1-2+deb12u5
1
cm2network/squad:latest8cba47f53df5
krb5@1.21.3-5
1.21.3-5+deb13u1
1
collabora/code:24.04.13.2.101dc4ab83977
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
1
collabora/code:23.05.10.1.105299b452f7f
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5
1
consensys/teku:25.4.1bf6ecd2ea716
krb5@1.20.1-6ubuntu2.5
1.20.1-6ubuntu2.7
1
contentsquareplatform/chproxy:v1.26.524555f22d4be
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
1
cortezaproject/corteza:2024.9.60bcdcbcd3c63
krb5@1.19.2-2ubuntu0.7
1.19.2-2ubuntu0.8
1
cortezaproject/corteza:2024.9.4cb9f200de5d2
krb5@1.19.2-2ubuntu0.7
1.19.2-2ubuntu0.8
1
cortezaproject/corteza-server-corredor:2024.9.44ea78dfe5364
krb5@1.20.1-2+deb12u3
1.20.1-2+deb12u5
1
coturn/coturn:4.10.0-r1f4c2af06c3c5
krb5@1.21.3-5
1.21.3-5+deb13u1
1
cspconsole/config-provider:1.0.365524a26a6c23
krb5@1.20.1-2+deb12u4
1.20.1-2+deb12u5
1
cspconsole/csp-control-center:1.0.1046dda4a31bd6
krb5@1.20.1-2+deb12u4
1.20.1-2+deb12u5
1
cspconsole/report-collector:1.0.15839750248193b
krb5@1.20.1-2+deb12u4
1.20.1-2+deb12u5
1
cybrarist/discount-bandit:v4.0.4e9e2447ac666
krb5@1.21.3-5
1.21.3-5+deb13u1
1
dachichang/basic-auth-s3-nginx:1.0.07ccac90a935e
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5
1
danialnabiyan1382/lsdisk:v2.0.8f96a7ebf1f42
krb5@1.20.1-2+deb12u4
1.20.1-2+deb12u5
1
dannielkil/book-frontend:latest937993927694
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
1
datadog/agent:6aad9994de6a7
krb5@1.20.1-6ubuntu2.2
1.20.1-6ubuntu2.7
1
datalayers/datalayers:v2.2.1017b292079239
krb5@1.19.2-2ubuntu0.4
1.19.2-2ubuntu0.8
1
datamate/seafile-professional:11.0.202dd66b722464
krb5@1.19.2-2ubuntu0.7
1.19.2-2ubuntu0.8
1
dbeaver/cloudbeaver:26.1.287ab86d00f8c
krb5@1.20.1-6ubuntu2.6
1.20.1-6ubuntu2.7
1
dblaci/ubuntu-ssh-rsync:20231020eea697611af4
krb5@1.19.2-2ubuntu0.2
1.19.2-2ubuntu0.8
1
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5
1
ddosify/selfhosted_backend:3.2.93c11e3182652
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5
1
ddosify/selfhosted_backend:2.6.11ac323d52bfb4
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5
1
ddosify/selfhosted_hammermanager:2.0.2b796b8c73011
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5
1
deconzcommunity/deconz:2.29.2062de2362641
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
1
deepflowce/deepflow-agent:v6.2.6.529332fee7fc2
krb5@1.19.2-2ubuntu0.1
1.19.2-2ubuntu0.8
1
dependencytrack/apiserver:4.14.21ba4f004e1ec
krb5@1.21.3-5
1.21.3-5+deb13u1
1
devopsgoofy/k8s-platform:latestad865312099f
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
1
devopshq/artifactory-cleanup:1.0.1830e093bffa91
krb5@1.20.1-2+deb12u3
1.20.1-2+deb12u5
1
dgraph/dgraph:v24.1.4b57fa31f9b7f
krb5@1.20.1-6ubuntu2.6
1.20.1-6ubuntu2.7
1
diygod/rsshub:2025-11-097a6312cac0d5
krb5@1.20.1-2+deb12u4
1.20.1-2+deb12u5
1
dobtc/bitcoin:25.1a870f7cb1105
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5
1
dokuwiki/dokuwiki:2025-05-14af08ecfdda239
krb5@1.21.3-5
1.21.3-5+deb13u1
1
dolibarr/dolibarr:22.0.47ad88fc9b13c
krb5@1.20.1-2+deb12u4
1.20.1-2+deb12u5
1
domainmod/domainmod:4.23.04017bfe4c597
krb5@1.20.1-2
1.20.1-2+deb12u5
1
dragonflyoss/client:v0.1.82edf3e921f4e0
krb5@1.20.1-2+deb12u1
1.20.1-2+deb12u5
1
dremio/dremio-oss:24.1.080ed2e3b7c43
krb5@1.19.2-2ubuntu0.2
1.19.2-2ubuntu0.8
1
drpcorg/dshackle:0.54.08858fae1859d
krb5@1.19.2-2ubuntu0.2
1.19.2-2ubuntu0.8
1
drumsergio/genieacs:1.2.16.028244054e1bf
krb5@1.20.1-2+deb12u4
1.20.1-2+deb12u5
1
dserio83/velero-api:0.3.16b3d9115fee2
krb5@1.20.1-2+deb12u3
1.20.1-2+deb12u5
1
dserio83/velero-watchdog:0.1.8d5deae589229
krb5@1.20.1-2+deb12u2
1.20.1-2+deb12u5
1
duck1123/cert-downloader:latest0e29f19fa67c
krb5@1.19.2-2ubuntu0.2
1.19.2-2ubuntu0.8
1
duck1123/lnd-fileserver:latest9d6fb247b714
krb5@1.19.2-2ubuntu0.2
1.19.2-2ubuntu0.8
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.