StackRadar

CVE-2026-40895

Medium

Advisory

Published 14 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.005
40th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
352
of 17,781 indexed, latest versions
Container images
344
deployed by those charts
Fix available
1 of 1
affected package

follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

Carried by container images the latest versions of 352 of 17,781 indexed charts deploy, on 344 images.

Affected packageAffected versionsFixed inImages
follow-redirectsnpm1.0.0, 1.2.5, 1.5.10, 1.6.1+26 more1.16.0344
OSV records
GHSA-r4q5-vmmm-2653

Charts affected

352 by stars
ChartLatestAffected imagesRadar Score
skoonerxdVerified publisher1.1.01 of 1See more

skooner xd 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-40895.

Container imageDigestPackageFixed in
ymuski/skooner:latest67819ca511b5
follow-redirects@1.14.8
1.16.0

Open the chart page →

1,752
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-40895.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
follow-redirects@1.15.6
1.16.0

Open the chart page →

9,381

Container images carrying it

344 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
arfath29/3-tier-app-frontend:latest384b3e377f47
follow-redirects@1.14.1
1.16.0
1
arturisimo/server-urjc:v1.0d8dc4430531e
follow-redirects@1.14.9
1.16.0
1
assistiot/composite-services-manager_agent-http-mqtt:latest16d21bc5e42e
follow-redirects@1.15.6
1.16.0
1
assistiot/composite-services-manager_agent-mqtt-http:latest27d58b8911cd
follow-redirects@1.15.6
1.16.0
1
assistiot/cybersecurity-monitoring_id-kbn:latest2297b4350211
follow-redirects@1.14.5
1.16.0
1
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
follow-redirects@1.13.0
1.16.0
1
assistiot/dlt_api:2.1.0c8a170683be7
follow-redirects@1.15.4
1.16.0
1
assistiot/fl_orchestrator:api-latest7473d77448e1
follow-redirects@1.5.10
1.16.0
1
assistiot/monitoring_notifying:2.0.068324d0fa5bb
follow-redirects@1.15.5
1.16.0
1
assistiot/multi-link_client:latestcf048365d042
follow-redirects@1.15.2
1.16.0
1
assistiot/open_api_frontend:1.0.1f11d82defc70
follow-redirects@1.14.9
1.16.0
1
assistiot/smart-orchestrator_cluster:latest4f41e1defe99
follow-redirects@1.15.0
1.16.0
1
assistiot/smart-orchestrator_enabler:latest89f37e88c871
follow-redirects@1.15.0
1.16.0
1
assistiot/smart-orchestrator_repository:latesta8b8dbed04a4
follow-redirects@1.15.0
1.16.0
1
automatischio/automatisch:0.15.03bace7a12d5f
follow-redirects@1.15.9
1.16.0
1
baserow/baserow:1.30.1df0c42eb67e8
follow-redirects@1.15.8
1.16.0
1
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
follow-redirects@1.15.2
1.16.0
1
blockscout/blockscout:5.1.5c365a8f2dc12
follow-redirects@1.14.8
1.16.0
1
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
follow-redirects@1.14.3
1.16.0
1
carbonetes/carbonetes-analyzer:1.0.31b9b93c9a37f
follow-redirects@1.14.4
1.16.0
1
catalysm/csmm:latestf003b35f54d9
follow-redirects@1.14.5
1.16.0
1
ccjacobs14/amazon:59a9b14a6f09e
follow-redirects@1.15.2
1.16.0
1
chainsafe/lodestar:latest5593f6e97912
follow-redirects@1.15.11
1.16.0
1
chainsafe/lodestar:v1.27.07b9fe4aa8073
follow-redirects@1.15.6
1.16.0
1
chatwoot/chatwoot:v4.15.167ebc751c171
follow-redirects@1.14.0
1.16.0
1
codercom/code-server:4.11.0-debian1e2cc688008e
follow-redirects@1.14.8
1.16.0
1
codercom/code-server:3.10.247605610ad8d
follow-redirects@1.13.0
1.16.0
1
codetogether/codetogether:latest4348c8a38752
follow-redirects@1.15.6
1.16.0
1
coldatom/containers-security-front:latest7c2fbbb41bcf
follow-redirects@1.15.2
1.16.0
1
conduction/conduction-ui-app:devd591f5e6f2a9
follow-redirects@1.13.2
1.16.0
1
cortezaproject/corteza-server-corredor:2024.9.44ea78dfe5364
follow-redirects@1.15.9
1.16.0
1
countly/api:25.05.4f4cc7447c4f5
follow-redirects@1.15.6
1.16.0
1
countly/countly-server:25.05.4e3c238248f99
follow-redirects@1.15.6
1.16.0
1
countly/frontend:25.05.42acbc11499b6
follow-redirects@1.15.6
1.16.0
1
cryptexlabs/authf:0.12.11189c07411d7c
follow-redirects@1.5.10
1.16.0
1
defactops/defactops-backend:1.0.2307b663c0092a
follow-redirects@1.15.2
1.16.0
1
dessalines/lemmy-ui:0.19.20ee4c620d8e93
follow-redirects@1.15.6
1.16.0
1
directus/directus:11.1.0e3c8bb975350
follow-redirects@1.15.8
1.16.0
1
documenso/documenso:v1.8.17f16a9449f18
follow-redirects@1.15.3
1.16.0
1
eclipseaerios/benchmarking-tool:1.0.0a4b4c2e7fe62
follow-redirects@1.15.6
1.16.0
1
eclipseaerios/self-orchestrator:1.2.08b123bec5679
follow-redirects@1.15.11
1.16.0
1
enketo/enketo-express:3.0.4dcad9c2273f6
follow-redirects@1.14.5
1.16.0
1
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
follow-redirects@1.14.8
1.16.0
1
ethersphere/bzz-token-service:latest7624f11a72ad
follow-redirects@1.14.1
1.16.0
1
ethersphere/multichain-proxy:0.0.261f5419afbcd
follow-redirects@1.15.9
1.16.0
1
ethpandaops/blobscan-indexer:latestc58eb9ffe446
follow-redirects@1.15.2
1.16.0
1
evoapicloud/evolution-api:latest966625532d90
follow-redirects@1.15.11
1.16.0
1
f3ktech/recaptcha-v3-verifier:1.1.048e78987cf91
follow-redirects@1.15.11
1.16.0
1
factly/mande-web:0.34.1742355964b0e
follow-redirects@1.15.3
1.16.0
1
fallenbagel/jellyseerr:latest4538137bc5af
follow-redirects@1.15.9
1.16.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.