StackRadar

CVE-2026-41706

Medium

Advisory

Published 10 Jun 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.002
12th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
119
of 17,792 indexed, latest versions
Container images
142
deployed by those charts
Fix available
1 of 1
affected package

Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache

Carried by container images the latest versions of 119 of 17,792 indexed charts deploy, on 142 images.

Affected packageAffected versionsFixed inImages
spring-security-webmaven3.2.10.RELEASE, 4.1.3.RELEASE, 4.1.4.RELEASE, 4.2.2.RELEASE+57 more6.5.11, 7.0.6142
OSV records
GHSA-x2r2-rvhq-2mqv

Charts affected

119 by stars
ChartLatestAffected imagesRadar Score
smartquerysearchhub0.1.01 of 1See more

smartquery searchhub 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41706.

Container imageDigestPackageFixed in
commerceexperts/smartquery-service:2.2.09e33ad89baf6
spring-security-web@5.7.10
no fix listed

Open the chart page →

1,529
seataseataVerified publisher0.1.01 of 1See more

seata seata 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41706.

Container imageDigestPackageFixed in
seataio/seata-server:latest703b5de7f1a6
spring-security-web@5.7.11
no fix listed

Open the chart page →

4,248
seldon-core-oauth-gatewayseldon0.3.11 of 2See more

seldon-core-oauth-gateway seldon 0.3.1

1 of the 2 container images this version deploys carry CVE-2026-41706.

Container imageDigestPackageFixed in
seldonio/apife:0.3.1eea0d3f578ca
spring-security-web@4.2.9.RELEASE
no fix listed

Open the chart page →

8,101
shenyushenyu0.6.31 of 2See more

shenyu shenyu 0.6.3

1 of the 2 container images this version deploys carry CVE-2026-41706.

Container imageDigestPackageFixed in
apache/shenyu-bootstrap:2.5.11bd5756f6273
spring-security-web@5.6.5
no fix listed

Open the chart page →

8,807
shenyushenyu-helm-chart-test2.4.271 of 2See more

shenyu shenyu-helm-chart-test 2.4.27

1 of the 2 container images this version deploys carry CVE-2026-41706.

Container imageDigestPackageFixed in
apache/shenyu-bootstrap:2.4.20bd3b25c4be4
spring-security-web@5.2.1.RELEASE
no fix listed

Open the chart page →

12,517
sistas-chatbotsistas-chatbot5.0.21 of 6See more

sistas-chatbot sistas-chatbot 5.0.2

1 of the 6 container images this version deploys carry CVE-2026-41706.

Container imageDigestPackageFixed in
jhipster/jhipster-registry:latest7184525acd4d
spring-security-web@5.7.3
no fix listed

Open the chart page →

5,908
umsappstacksimplifyVerified publisher1.0.01 of 3See more

umsapp stacksimplify 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41706.

Container imageDigestPackageFixed in
ghcr.io/stacksimplify/kube-usermgmt-webapp:1.0.0-mysqldb41b45003c6b6
spring-security-web@5.1.5.RELEASE
no fix listed

Open the chart page →

6,105
static-src-people-detector-appstatic-src-people-detector-chartVerified publisher1.5.51 of 6See more

static-src-people-detector-app static-src-people-detector-chart 1.5.5

1 of the 6 container images this version deploys carry CVE-2026-41706.

Container imageDigestPackageFixed in
fimperato/detected-info-notification:1.2.6-RELEASE6441f6545613
spring-security-web@5.7.5
no fix listed

Open the chart page →

13,704
streamastreama1.0.11 of 2See more

streama streama 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-41706.

Container imageDigestPackageFixed in
just1not2/streama:1.10.48a2305192dec
spring-security-web@4.1.4.RELEASE
no fix listed

Open the chart page →

8,557
sn-consolestreamnative1.13.01 of 1See more

sn-console streamnative 1.13.0

1 of the 1 container images this version deploys carry CVE-2026-41706.

Container imageDigestPackageFixed in
streamnative/private-cloud-console:v2.3.27-all91e54375e154
spring-security-web@6.3.8
no fix listed

Open the chart page →

1,830
rundecksvtech-public-helm-charts1.0.01 of 2See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-41706.

Container imageDigestPackageFixed in
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
spring-security-web@5.8.3
no fix listed

Open the chart page →

18,853
shenyutest-helm2.4.211 of 2See more

shenyu test-helm 2.4.21

1 of the 2 container images this version deploys carry CVE-2026-41706.

Container imageDigestPackageFixed in
apache/shenyu-bootstrap:2.4.20bd3b25c4be4
spring-security-web@5.2.1.RELEASE
no fix listed

Open the chart page →

12,517
thingsboardthingsboardVerified publisher0.1.31 of 12See more

thingsboard thingsboard 0.1.3

1 of the 12 container images this version deploys carry CVE-2026-41706.

Container imageDigestPackageFixed in
thingsboard/tb-node:3.4.1645f43b688f7
spring-security-web@5.7.1
no fix listed

Open the chart page →

25,447
timetabletwomartensVerified publisher0.2.01 of 1See more

timetable twomartens 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-41706.

Container imageDigestPackageFixed in
2martens/timetable:latestbd1ba6ab84c9
spring-security-web@6.5.5
6.5.11

Open the chart page →

1,530
wahlrechttwomartensVerified publisher0.3.01 of 1See more

wahlrecht twomartens 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-41706.

Container imageDigestPackageFixed in
2martens/wahlrecht:latestba2c3040dab0
spring-security-web@6.5.2
6.5.11

Open the chart page →

1,693
webhookiewebhookie0.1.21 of 1See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-41706.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
spring-security-web@5.6.1
no fix listed

Open the chart page →

14,438
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-41706.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
spring-security-web@5.6.1
no fix listed

Open the chart page →

28,729
hazelcastwenerme5.10.31 of 2See more

hazelcast wenerme 5.10.3

1 of the 2 container images this version deploys carry CVE-2026-41706.

Container imageDigestPackageFixed in
hazelcast/management-center:5.5.20095e0320623
spring-security-web@6.3.3
no fix listed

Open the chart page →

2,624
zahori-serverzahoriVerified publisher1.0.11 of 2See more

zahori-server zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-41706.

Container imageDigestPackageFixed in
zahoriaut/zahori-server:0.1.17b2de13916f3e
spring-security-web@5.7.6
no fix listed

Open the chart page →

5,852

Container images carrying it

142 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
reportportal/service-api:5.15.4bf193091525a
spring-security-web@6.5.10
6.5.11
1
reportportal/service-authorization:5.15.16a954407b417
spring-security-web@6.5.10
6.5.11
1
reportportal/service-authorization:5.7.09e73114dbd15
spring-security-web@5.2.4.RELEASE
no fix listed
1
rundeck/rundeck:3.2.74d64fe56f767
spring-security-web@4.2.13.RELEASE
no fix listed
1
rundeck/rundeck:3.0.16b13e8059ad72
spring-security-web@4.2.7.RELEASE
no fix listed
1
scorpiobroker/scorpio:scorpio-aaio_2.1.0db55012043df
spring-security-web@5.6.0
no fix listed
1
seataio/seata-server:latest703b5de7f1a6
spring-security-web@5.7.11
no fix listed
1
seataio/seata-server:1.5.1ee1ed55f4144
spring-security-web@5.4.9
no fix listed
1
seldonio/apife:0.2.7ba81b17f00eb
spring-security-web@4.2.9.RELEASE
no fix listed
1
seldonio/apife:0.3.1eea0d3f578ca
spring-security-web@4.2.9.RELEASE
no fix listed
1
streamnative/private-cloud-console:v2.3.27-all91e54375e154
spring-security-web@6.3.8
no fix listed
1
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
spring-security-web@5.8.3
no fix listed
1
thingsboard/tb-node:3.4.1645f43b688f7
spring-security-web@5.7.1
no fix listed
1
thingsboard/tb-node:3.6.0f40a542832c4
spring-security-web@5.7.7
no fix listed
1
thmmniii/fbs-core:v1.27.15438517d9fc2
spring-security-web@5.7.8
no fix listed
1
treskon/portrait:DEV-latest88e813f22347
spring-security-web@6.3.5
no fix listed
1
vlebediantsev/file-system-ms-final:latest10393a89b4a8
spring-security-web@5.7.2
no fix listed
1
vlebediantsev/logic-ms:latestdf8bf38c535b
spring-security-web@5.7.2
no fix listed
1
vlebediantsev/registration-ms-final:latest427af418b75e
spring-security-web@5.7.2
no fix listed
1
vlebediantsev/user-data-ms-final-final:latest9319437f3c8f
spring-security-web@5.7.2
no fix listed
1
vrijbrp/haal-centraal-brp-bevragen:develop5c770c2ae48c
spring-security-web@5.7.8
no fix listed
1
zahoriaut/zahori-server:0.1.17b2de13916f3e
spring-security-web@5.7.6
no fix listed
1
zbalogh/reservation-api-server:1.0.97c247e399a1f
spring-security-web@5.7.3
no fix listed
1
gcr.io/spinnaker-marketplace/halyard:1.32.00ee5f968d2ab
spring-security-web@5.2.1.RELEASE
no fix listed
1
ghcr.io/gla-rad/enav-api-gateway:latest8f4345c77dda
spring-security-web@7.0.4
7.0.6
1
ghcr.io/gla-rad/enav-aton-admin-service:latestcf85570b1324
spring-security-web@7.0.5
7.0.6
1
ghcr.io/gla-rad/enav-aton-service:latest3be878690629
spring-security-web@7.0.5
7.0.6
1
ghcr.io/gla-rad/enav-aton-service-client:latestf1629ac5f9ec
spring-security-web@7.0.5
7.0.6
1
ghcr.io/gla-rad/enav-ckeeper:latest415323ef112b
spring-security-web@7.0.4
7.0.6
1
ghcr.io/gla-rad/enav-eureka:latest05002092c621
spring-security-web@7.0.4
7.0.6
1
ghcr.io/gla-rad/enav-msg-broker:latest6fe372e4e481
spring-security-web@7.0.4
7.0.6
1
ghcr.io/gla-rad/enav-vdes-controller:latestc4c52955814f
spring-security-web@7.0.4
7.0.6
1
ghcr.io/gregperlinli/certvault:2.12.0a7d0cc9e260a
spring-security-web@6.5.7
6.5.11
1
ghcr.io/it-at-m/kf-app-eai:1.0.65de339b3d537
spring-security-web@6.5.3
6.5.11
1
ghcr.io/k8s-at-home/nzbhydra2:v3.14.2ef3670f7e0a8
spring-security-web@5.3.3.RELEASE
no fix listed
1
ghcr.io/linuxserver/booksonic-air:version-v2009.1.0baa4fa9549dc
spring-security-web@5.2.4.RELEASE
no fix listed
1
ghcr.io/radar-base/managementportal/management-portal:3.0.0c1b37e821f72
spring-security-web@5.7.13
no fix listed
1
ghcr.io/stacksimplify/kube-usermgmt-webapp:1.0.0-mysqldb41b45003c6b6
spring-security-web@5.1.5.RELEASE
no fix listed
1
ghcr.io/star-whale/server:0.6.158368359c8dd0
spring-security-web@5.7.6
no fix listed
1
ghcr.io/stirling-tools/stirling-pdf:2.14.33b3670fce70b
spring-security-web@7.0.5
7.0.6
1
ghcr.io/streamvisor/streamvisor:4.1.40bc598b2ac9a
spring-security-web@6.5.10
6.5.11
1
public.ecr.aws/aktosecurity/akto-api-security-testing-db-layer:1.74.4_local1ed844ecab29
spring-security-web@5.6.2
no fix listed
1

syft 1.42.1 · advisories as of 17 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.