StackRadar

CVE-2026-41479

Medium

Advisory

Published 8 Jun 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.4
base score, highest
EPSS
0.002
8th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
48
of 17,781 indexed, latest versions
Container images
47
deployed by those charts
Fix available
1 of 1
affected package

Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type

Carried by container images the latest versions of 48 of 17,781 indexed charts deploy, on 47 images.

Affected packageAffected versionsFixed inImages
authlibpypi0.12.1, 0.15, 0.15.2, 0.15.4+15 more1.6.10, 1.7.147
OSV records
GHSA-w8p2-r796-3vmq
Also known as
PYSEC-2026-2119

Charts affected

48 by stars
ChartLatestAffected imagesRadar Score
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
authlib@1.3.0
1.6.10

Open the chart page →

11,367
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
authlib@0.15.5
1.6.10

Open the chart page →

7,705
synapsehalkeye0.40.01 of 2See more

synapse halkeye 0.40.0

1 of the 2 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
authlib@1.3.1
1.6.10

Open the chart page →

6,543
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
authlib@0.15.5
1.6.10

Open the chart page →

5,987
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
authlib@1.3.0
1.6.10

Open the chart page →

6,041
openshift-secured-pgadmineximiaitVerified publisher0.2.01 of 2See more

openshift-secured-pgadmin eximiait 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
dpage/pgadmin4:7.537946e4f3e7b
authlib@1.2.1
1.6.10

Open the chart page →

14,546
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
authlib@1.6.9
1.6.10

Open the chart page →

4,634
mealieth-chartsVerified publisher0.5.11 of 1See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
authlib@1.6.5
1.6.10

Open the chart page →

3,804
powerdnsadminhalkeye0.3.11 of 1See more

powerdnsadmin halkeye 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
ngoduykhanh/powerdns-admin:0.2.3099371dd9ba6
authlib@0.15
1.6.10

Open the chart page →

3,345
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
authlib@1.3.1
1.6.10

Open the chart page →

20,403
mealiertomik-helm-chartsVerified publisher0.0.21 of 1See more

mealie rtomik-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
authlib@1.6.3
1.6.10

Open the chart page →

3,929
synapsesudermanjr1.1.51 of 1See more

synapse sudermanjr 1.1.5

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.53.0cb89c0f17ba1
authlib@0.15.5
1.6.10

Open the chart page →

3,332
pgadminappscodeVerified publisher2026.3.301 of 1See more

pgadmin appscode 2026.3.30

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
dpage/pgadmin4:9.11.050700ac17936
authlib@1.6.5
1.6.10

Open the chart page →

1,565
pgadminarunalakmalVerified publisher0.1.01 of 1See more

pgadmin arunalakmal 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
dpage/pgadmin4:6.12781369df9994
authlib@0.15.5
1.6.10

Open the chart page →

2,418
swdpgadminarunalakmalVerified publisher0.1.01 of 1See more

swdpgadmin arunalakmal 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
dpage/pgadmin4:6.12781369df9994
authlib@0.15.5
1.6.10

Open the chart page →

2,418
locationprocessingassist-iot-location-processing1.0.01 of 3See more

locationprocessing assist-iot-location-processing 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
dpage/pgadmin4:6.12781369df9994
authlib@0.15.5
1.6.10

Open the chart page →

10,061
csghubcsghubVerified publisher2.4.32 of 34See more

csghub csghub 2.4.3

2 of the 34 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
authlib@1.3.1
1.6.10
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
authlib@1.6.6
1.6.10

Open the chart page →

58,897
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
authlib@1.2.1
1.6.10

Open the chart page →

6,179
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
authlib@0.15.5
1.6.10

Open the chart page →

5,062
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
authlib@1.3.1
1.6.10

Open the chart page →

19,224
helpdeskdoubanVerified publisher0.3.31 of 2See more

helpdesk douban 0.3.3

1 of the 2 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
douz/helpdesk:latest4384103d0219
authlib@0.15.5
1.6.10

Open the chart page →

4,550
rommernail-romm1.0.11 of 1See more

romm ernail-romm 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
rommapp/romm:4.4.1b909e95d1aab
authlib@1.6.5
1.6.10

Open the chart page →

2,896
infrafibonacci-cluster-infraVerified publisher1.0.01 of 4See more

infra fibonacci-cluster-infra 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
dpage/pgadmin4:8.418cd5711fc9a
authlib@1.2.1
1.6.10

Open the chart page →

12,454
powerdnsfsdrw080.1.31 of 4See more

powerdns fsdrw08 0.1.3

1 of the 4 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
ngoduykhanh/powerdns-admin:latest9898a7cf37d2
authlib@0.15
1.6.10

Open the chart page →

1,958
powerdns-admingeek-cookbookVerified publisher1.2.21 of 1See more

powerdns-admin geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
ngoduykhanh/powerdns-admin:v0.2.4ba36ab196d3d
authlib@0.15
1.6.10

Open the chart page →

2,643
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
authlib@1.5.1
1.6.10

Open the chart page →

4,647
fastmcp-serverhelmforgeVerified publisher1.7.41 of 1See more

fastmcp-server helmforge 1.7.4

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.11.2fcb7017327d6
authlib@1.7.0
1.7.1

Open the chart page →

3,281
mcp-serverhelmforgeVerified publisher1.0.01 of 1See more

mcp-server helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.2.061f759a1421f
authlib@1.6.9
1.6.10

Open the chart page →

3,430
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
authlib@1.6.5
1.6.10

Open the chart page →

17,852
jx-app-anchorejenkins-x0.0.41 of 2See more

jx-app-anchore jenkins-x 0.0.4

1 of the 2 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
anchore/anchore-engine:v0.7.1ed9b3badd17c
authlib@0.12.1
1.6.10

Open the chart page →

9,854
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
authlib@1.2.1
1.6.10

Open the chart page →

6,447
mindsdbkronkltdVerified publisher0.1.01 of 1See more

mindsdb kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
mindsdb/mindsdb:latest163011c09299
authlib@1.7.0
1.7.1

Open the chart page →

9,620
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
authlib@1.6.0
1.6.10

Open the chart page →

8,405
anchore-engineopencloudcx1.13.01 of 2See more

anchore-engine opencloudcx 1.13.0

1 of the 2 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
anchore/anchore-engine:v0.10.0bde9eedf639d
authlib@0.15.2
1.6.10

Open the chart page →

18,023
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.02 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

2 of the 40 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
yetiplatform/yeti:2.9.09bcbe2650a14
authlib@1.5.2
1.6.10
ghcr.io/openrelik/openrelik-metrics:latest3d0f1ddeebf5
authlib@1.6.9
1.6.10

Open the chart page →

71,208
yetiosdfir-infrastructureVerified publisher1.0.51 of 4See more

yeti osdfir-infrastructure 1.0.5

1 of the 4 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
yetiplatform/yeti:latest9c3006cedcca
authlib@1.5.2
1.6.10

Open the chart page →

6,583
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
authlib@1.6.6
1.6.10

Open the chart page →

4,749
powerdnspuckpuck2.0.01 of 4See more

powerdns puckpuck 2.0.0

1 of the 4 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
pschiffe/pdns-admin:0.4.137ebba8c2b8f
authlib@1.2.0
1.6.10

Open the chart page →

4,616
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
authlib@1.3.2
1.6.10

Open the chart page →

21,211
matrix-stackrock8sVerified publisher0.8.11 of 7See more

matrix-stack rock8s 0.8.1

1 of the 7 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.127.1c3c4a9de2a0b
authlib@1.4.1
1.6.10

Open the chart page →

9,256
airflowsb-helm-charts0.3.01 of 1See more

airflow sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
apache/airflow:2.8.1e5560ad0b86e
authlib@1.3.0
1.6.10

Open the chart page →

10,209
pgadminsb-helm-charts0.3.01 of 1See more

pgadmin sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
dpage/pgadmin4:8.13561c1f8f99f2
authlib@1.3.2
1.6.10

Open the chart page →

1,713
seldon-deployseldon1.4.01 of 2See more

seldon-deploy seldon 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
seldonio/seldon-request-logger:1.11.24e985d2006a8
authlib@0.15.4
1.6.10

Open the chart page →

21,997
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
authlib@1.3.0
1.6.10

Open the chart page →

5,565
verbasubstratusVerified publisher0.4.01 of 1See more

verba substratus 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
substratusai/verba:v0.4.0-baseURL261695be635eb
authlib@1.3.0
1.6.10

Open the chart page →

13,390
synapsetranhailongVerified publisher0.1.01 of 2See more

synapse tranhailong 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.78.0def97fd537d8
authlib@1.2.0
1.6.10

Open the chart page →

3,164
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
dpage/pgadmin4:9.252cb72a9e3da
authlib@1.4.1
1.6.10

Open the chart page →

4,768
powerdnsadminwitcom-gmbh0.3.41 of 1See more

powerdnsadmin witcom-gmbh 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-41479.

Container imageDigestPackageFixed in
ngoduykhanh/powerdns-admin:v0.2.4ba36ab196d3d
authlib@0.15
1.6.10

Open the chart page →

2,643

Container images carrying it

47 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
dpage/pgadmin4:6.12781369df9994
authlib@0.15.5
1.6.10
3
ngoduykhanh/powerdns-admin:v0.2.4ba36ab196d3d
authlib@0.15
1.6.10
2
anchore/anchore-engine:v0.10.0bde9eedf639d
authlib@0.15.2
1.6.10
1
anchore/anchore-engine:v0.7.1ed9b3badd17c
authlib@0.12.1
1.6.10
1
apache/airflow:2.8.4-python3.964e58748b6b9
authlib@1.3.0
1.6.10
1
apache/airflow:2.10.2-python3.9ce90bdc3d2af
authlib@1.3.2
1.6.10
1
apache/airflow:2.8.1e5560ad0b86e
authlib@1.3.0
1.6.10
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
authlib@1.6.0
1.6.10
1
douz/helpdesk:latest4384103d0219
authlib@0.15.5
1.6.10
1
dpage/pgadmin4:8.418cd5711fc9a
authlib@1.2.1
1.6.10
1
dpage/pgadmin4:7.537946e4f3e7b
authlib@1.2.1
1.6.10
1
dpage/pgadmin4:9.11.050700ac17936
authlib@1.6.5
1.6.10
1
dpage/pgadmin4:9.252cb72a9e3da
authlib@1.4.1
1.6.10
1
dpage/pgadmin4:8.13561c1f8f99f2
authlib@1.3.2
1.6.10
1
helmforge/fastmcp-server:0.2.061f759a1421f
authlib@1.6.9
1.6.10
1
helmforge/fastmcp-server:0.11.2fcb7017327d6
authlib@1.7.0
1.7.1
1
homeassistant/home-assistant:2023.10.3021e2afc6e57
authlib@1.2.1
1.6.10
1
homeassistant/home-assistant:2023.12.48d000332b09b
authlib@1.3.0
1.6.10
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
authlib@1.6.5
1.6.10
1
langgenius/dify-api:1.0.0066035f93856
authlib@1.3.1
1.6.10
1
langgenius/dify-api:0.6.11fca918260dd6
authlib@1.3.1
1.6.10
1
matrixdotorg/synapse:v1.127.1c3c4a9de2a0b
authlib@1.4.1
1.6.10
1
matrixdotorg/synapse:v1.53.0cb89c0f17ba1
authlib@0.15.5
1.6.10
1
matrixdotorg/synapse:v1.78.0def97fd537d8
authlib@1.2.0
1.6.10
1
mindsdb/mindsdb:latest163011c09299
authlib@1.7.0
1.7.1
1
ngoduykhanh/powerdns-admin:0.2.3099371dd9ba6
authlib@0.15
1.6.10
1
ngoduykhanh/powerdns-admin:latest9898a7cf37d2
authlib@0.15
1.6.10
1
opencsghq/agenticflow:ee-v0.6-52f03fead54db
authlib@1.3.1
1.6.10
1
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
authlib@1.6.6
1.6.10
1
pschiffe/pdns-admin:0.4.137ebba8c2b8f
authlib@1.2.0
1.6.10
1
redash/redash:25.8.000d813437db5
authlib@0.15.5
1.6.10
1
redash/redash:26.3.0c5c9148f5c38
authlib@0.15.5
1.6.10
1
rommapp/romm:4.4.1b909e95d1aab
authlib@1.6.5
1.6.10
1
seldonio/seldon-request-logger:1.11.24e985d2006a8
authlib@0.15.4
1.6.10
1
substratusai/verba:v0.4.0-baseURL261695be635eb
authlib@1.3.0
1.6.10
1
yetiplatform/yeti:2.9.09bcbe2650a14
authlib@1.5.2
1.6.10
1
yetiplatform/yeti:latest9c3006cedcca
authlib@1.5.2
1.6.10
1
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
authlib@1.3.1
1.6.10
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
authlib@1.5.1
1.6.10
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
authlib@1.6.6
1.6.10
1
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
authlib@0.15.5
1.6.10
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
authlib@1.2.1
1.6.10
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
authlib@1.6.9
1.6.10
1
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
authlib@1.6.3
1.6.10
1
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
authlib@1.3.0
1.6.10
1
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
authlib@1.6.5
1.6.10
1
ghcr.io/openrelik/openrelik-metrics:latest3d0f1ddeebf5
authlib@1.6.9
1.6.10
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.