StackRadar

CVE-2026-41140

High

Advisory

Published 22 Apr 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.003
22nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
41
of 17,781 indexed, latest versions
Container images
56
deployed by those charts
Fix available
1 of 2
affected packages

Poetry has Path Traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4

Carried by container images the latest versions of 41 of 17,781 indexed charts deploy, on 56 images.

Affected packageAffected versionsFixed inImages
poetrydeb1.8.2+dfsg-1ubuntu2no fix listed5
poetrypypi1.0.5, 1.1.0, 1.1.4, 1.1.6+21 more2.3.456
OSV records
UBUNTU-CVE-2026-41140GHSA-73h3-mf4w-8647
Also known as
PYSEC-2026-2890

Charts affected

41 by stars
ChartLatestAffected imagesRadar Score
kube-downscalerdeliveryheroVerified publisher0.7.61 of 1See more

kube-downscaler deliveryhero 0.7.6

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
poetry@1.5.1
2.3.4

Open the chart page →

4,293
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
poetry@1.8.3
2.3.4

Open the chart page →

5,987
py-kube-downscalerpy-kube-downscalerVerified publisher0.3.121 of 1See more

py-kube-downscaler py-kube-downscaler 0.3.12

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
ghcr.io/caas-team/py-kube-downscaler:26.4.0af05a098b0d2
poetry@2.3.3
2.3.4

Open the chart page →

731
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
poetry@1.1.6
2.3.4

Open the chart page →

7,579
squestchristianhuthVerified publisher6.6.71 of 4See more

squest christianhuth 6.6.7

1 of the 4 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
poetry@1.8.0
2.3.4

Open the chart page →

9,971
kube-ops-viewgeek-cookbookVerified publisher1.2.21 of 1See more

kube-ops-view geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
hjacobs/kube-ops-view:20.4.058221b57d4d2
poetry@1.0.5
2.3.4

Open the chart page →

1,848
hpe-greenlake-file-csi-driverhpe-storageVerified publisher2.6.41 of 7See more

hpe-greenlake-file-csi-driver hpe-storage 2.6.4

1 of the 7 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
quay.io/hpestorage/filex-csi-driver:2.6.4b7f960bbf472
poetry@1.8.3
2.3.4

Open the chart page →

6,095
kuma-ingress-watcherkuma-ingress-watcherVerified publisher1.4.01 of 1See more

kuma-ingress-watcher kuma-ingress-watcher 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
ghcr.io/squent/kuma-ingress-watcher:1.7.014d45b2a1f00
poetry@2.0.1
2.3.4

Open the chart page →

2,662
locustlocustVerified publisher0.1.41 of 1See more

locust locust 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
hansehe/locust:1.1.0bc8e45262bc4
poetry@1.7.1
2.3.4

Open the chart page →

2,757
kube-resource-reportrlex0.10.11 of 2See more

kube-resource-report rlex 0.10.1

1 of the 2 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
hjacobs/kube-resource-report:22.11.0c173cd02f5af
poetry@1.2.2
2.3.4

Open the chart page →

1,266
kube-resource-reportslamdev0.1.31 of 2See more

kube-resource-report slamdev 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
hjacobs/kube-resource-report:21.2.145f93491c434
poetry@1.1.4
2.3.4

Open the chart page →

1,534
airbyteairbyte-v2Verified publisher2.2.01 of 10See more

airbyte airbyte-v2 2.2.0

1 of the 10 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
airbyte/manifest-server:7.23.73b3a670af168
poetry@2.0.1
2.3.4

Open the chart page →

12,473
shynetatrox0.1.11 of 1See more

shynet atrox 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.12.0e821e31140f7
poetry@1.1.7
2.3.4

Open the chart page →

5,507
camerahubcamerahub0.10.211 of 2See more

camerahub camerahub 0.10.21

1 of the 2 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
camerahub/camerahub:0.36.23a5af37dd6e1b
poetry@1.4.2
2.3.4

Open the chart page →

2,507
kube-ops-viewchristianhuthVerified publisher8.3.31 of 1See more

kube-ops-view christianhuth 8.3.3

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
hjacobs/kube-ops-view:23.5.0a4fae38f93d7
poetry@1.4.2
2.3.4

Open the chart page →

1,227
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
poetry@2.1.4
2.3.4

Open the chart page →

5,062
kube-web-viewdecayofmind0.0.41 of 1See more

kube-web-view decayofmind 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
hjacobs/kube-web-view:20.10.0b44a9cf81a2f
poetry@1.1.0
2.3.4

Open the chart page →

2,264
deployhubdeployhubVerified publisher10.0.4157 of 11See more

deployhub deployhub 10.0.415

7 of the 11 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
poetry@2.2.1
2.3.4
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
poetry@2.2.1
2.3.4
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
poetry@2.2.1
2.3.4
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
poetry@2.2.1
2.3.4
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
poetry@2.2.1
2.3.4
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
poetry@2.2.1
2.3.4
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
poetry@2.2.1
2.3.4

Open the chart page →

11,160
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
poetry@1.8.4
2.3.4

Open the chart page →

9,607
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
poetry@1.8.4
2.3.4

Open the chart page →

9,607
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
poetry@2.0.1
2.3.4

Open the chart page →

19,224
autonodelabeldjjudas21Verified publisher0.0.101 of 1See more

autonodelabel djjudas21 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
djjudas21/autonodelabel:0.0.6f17233350c4f
poetry@1.5.1
2.3.4

Open the chart page →

1,304
huntingfactlyVerified publisher0.4.141 of 1See more

hunting factly 0.4.14

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
poetry@1.2.0
2.3.4

Open the chart page →

4,085
kodiakfikaworks1.1.41 of 2See more

kodiak fikaworks 1.1.4

1 of the 2 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
cdignam/kodiak:v0.54.05a6a55b39cee
poetry@1.1.13
2.3.4

Open the chart page →

3,892
kube-ops-viewfluent-operatorVerified publisher0.1.21 of 1See more

kube-ops-view fluent-operator 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
hjacobs/kube-ops-view:20.4.058221b57d4d2
poetry@1.0.5
2.3.4

Open the chart page →

1,848
kube-downscalerhelm-charts-nr0.7.61 of 1See more

kube-downscaler helm-charts-nr 0.7.6

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
poetry@1.5.1
2.3.4

Open the chart page →

4,293
shynetjuniorjpdj0.1.301 of 1See more

shynet juniorjpdj 0.1.30

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.13.1ba54f7797a6b
poetry@1.2.2
2.3.4

Open the chart page →

2,581
lnbitskronkltdVerified publisher0.1.01 of 1See more

lnbits kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
lnbitsdocker/lnbits-legend:latest26fae6327477
poetry@1.7.1
2.3.4

Open the chart page →

1,444
kube-janitorkube-janitor0.3.31 of 1See more

kube-janitor kube-janitor 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
hjacobs/kube-janitor:23.7.0fbb303ed463c
poetry@1.5.1
2.3.4

Open the chart page →

4,293
lnbitslnbits0.2.11 of 1See more

lnbits lnbits 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
lnbitsdocker/lnbits-legend:0.10.6a11aaa6d2b21
poetry@1.4.2
2.3.4

Open the chart page →

1,949
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.05 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

5 of the 40 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
poetry@1.8.2+dfsg-1ubuntu2
poetry@1.8.2
no fix listed
2.3.4
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestb175cc61959a
poetry@1.8.2+dfsg-1ubuntu2
poetry@1.8.2
no fix listed
2.3.4
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
poetry@1.8.2+dfsg-1ubuntu2
poetry@1.8.2
no fix listed
2.3.4
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
poetry@1.8.2+dfsg-1ubuntu2
poetry@1.8.2
no fix listed
2.3.4
ghcr.io/openrelik/openrelik-worker-plaso:latest75537ea8c851
poetry@1.8.2+dfsg-1ubuntu2
poetry@1.8.2
no fix listed
2.3.4

Open the chart page →

71,208
phronetisphronetis0.1.271 of 2See more

phronetis phronetis 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
knspar/phronetis:0.1.4609499d2dc91a
poetry@2.1.3
2.3.4

Open the chart page →

16,196
kubecostradar-baseVerified publisher1.0.01 of 7See more

kubecost radar-base 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
gcr.io/kubecost1/kubecost-modeling:v0.1.22a461dc5cb96a
poetry@2.0.1
2.3.4

Open the chart page →

9,355
kube-web-viewrlex0.5.01 of 1See more

kube-web-view rlex 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
hjacobs/kube-web-view:23.8.0431f1bf013d0
poetry@1.6.1
2.3.4

Open the chart page →

4,908
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
poetry@1.8.4
2.3.4

Open the chart page →

9,607
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
poetry@2.1.1
2.3.4

Open the chart page →

3,512
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
poetry@2.1.1
2.3.4

Open the chart page →

4,718
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
poetry@1.3.1
2.3.4

Open the chart page →

5,565
cost-analyzersoftonic2.5.51 of 6See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
gcr.io/kubecost1/kubecost-modeling:v0.1.24a2259b098b13
poetry@2.1.1
2.3.4

Open the chart page →

7,901
downscalersqream-chartsVerified publisher1.0.01 of 1See more

downscaler sqream-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.05d328c003efe
poetry@1.3.2
2.3.4

Open the chart page →

1,009
servicexssl-hep1.8.511 of 16See more

servicex ssl-hep 1.8.5

11 of the 16 container images this version deploys carry CVE-2026-41140.

Container imageDigestPackageFixed in
sslhep/servicex_app:v1.8.51d12f943cec5
poetry@2.1.1
2.3.4
sslhep/servicex_code_gen_atlas_xaod:v1.8.5e7aff7f97b89
poetry@2.1.1
2.3.4
sslhep/servicex_code_gen_func_adl_uproot:v1.8.5b01b8ee966ed
poetry@2.1.1
2.3.4
sslhep/servicex_code_gen_python:v1.8.50e4175a4e1eb
poetry@2.1.1
2.3.4
sslhep/servicex_code_gen_raw_uproot:v1.8.5671980005c57
poetry@2.1.1
2.3.4
sslhep/servicex_code_gen_topcp:v1.8.5596db2abdd09
poetry@2.1.1
2.3.4
sslhep/servicex-did-finder:v1.8.5ab0090083567
poetry@2.1.1
2.3.4
sslhep/servicex-did-finder-atlasopenmagic:v1.8.554aaf1721d03
poetry@2.3.0
2.3.4
sslhep/servicex-did-finder-cernopendata:v1.8.52cb88ceab5bb
poetry@2.1.1
2.3.4
sslhep/servicex-did-finder-xrootd:v1.8.5c284442b44e3
poetry@2.1.1
2.3.4
sslhep/x509-secrets:v1.8.5d9e9ecb12d59
poetry@2.1.1
2.3.4

Open the chart page →

66,266

Container images carrying it

56 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
poetry@2.2.1
2.3.4
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
poetry@2.2.1
2.3.4
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
poetry@2.2.1
2.3.4
1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
poetry@2.2.1
2.3.4
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
poetry@2.2.1
2.3.4
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
poetry@2.2.1
2.3.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.