StackRadar

CVE-2026-41726

Medium

Advisory

Published 10 Jun 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.003
22nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
37
of 17,781 indexed, latest versions
Container images
41
deployed by those charts
Fix available
1 of 1
affected package

In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header

Carried by container images the latest versions of 37 of 17,781 indexed charts deploy, on 41 images.

Affected packageAffected versionsFixed inImages
spring-kafkamaven1.1.4.RELEASE, 2.2.9.RELEASE, 2.8.0, 2.8.4+6 more3.3.16, 4.0.641
OSV records
GHSA-xvfq-4q6q-gxx7

Charts affected

37 by stars
ChartLatestAffected imagesRadar Score
flowableflowable-oss7.1.01 of 2See more

flowable flowable-oss 7.1.0

1 of the 2 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
flowable/flowable-rest:7.1.0b7ae287502cd
spring-kafka@3.2.4
no fix listed

Open the chart page →

2,784
kafdroplsst-sqre0.1.31 of 1See more

kafdrop lsst-sqre 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
obsidiandynamics/kafdrop:3.30.05337c9e0e2de
spring-kafka@2.8.4
no fix listed

Open the chart page →

7,901
firehoseblip-firehoseVerified publisher0.0.181 of 11See more

firehose blip-firehose 0.0.18

1 of the 11 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
obsidiandynamics/kafdrop:3.30.05337c9e0e2de
spring-kafka@2.8.4
no fix listed

Open the chart page →

13,459
event-store-servicechoerodon0.8.01 of 2See more

event-store-service choerodon 0.8.0

1 of the 2 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
choerodon/event-store-service:0.8.03c94c97f6f69
spring-kafka@1.1.4.RELEASE
no fix listed

Open the chart page →

9,808
eoloPlanteolo-plannerVerified publisher0.1.01 of 7See more

eoloPlant eolo-planner 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
mastercloudapps/planner:v1.2340a950b311b2
spring-kafka@2.8.0
no fix listed

Open the chart page →

27,537
eoloplannereoloplannerVerified publisher0.1.01 of 7See more

eoloplanner eoloplanner 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
codeurjc/planner:v1.0800cf520c245
spring-kafka@2.8.0
no fix listed

Open the chart page →

32,205
eoloPlannerCommunicationsKubernetes3eoloplannercommunicationskuberneteshelmVerified publisher0.1.01 of 7See more

eoloPlannerCommunicationsKubernetes3 eoloplannercommunicationskuberneteshelm 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
mastercloudapps/planner:v1.2340a950b311b2
spring-kafka@2.8.0
no fix listed

Open the chart page →

27,537
eoloplannereoloplanner-molynx-gat0.1.01 of 7See more

eoloplanner eoloplanner-molynx-gat 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
molynx/planner:v1441c9f52f092
spring-kafka@2.8.0
no fix listed

Open the chart page →

28,482
eolo-plannereolo-planner-repo0.1.01 of 7See more

eolo-planner eolo-planner-repo 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
arturisimo/planner:v1.0fff9de644941
spring-kafka@2.8.0
no fix listed

Open the chart page →

27,096
eoloplanteoloplant1.0.01 of 7See more

eoloplant eoloplant 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
mastercloudapps/planner:v1.2340a950b311b2
spring-kafka@2.8.0
no fix listed

Open the chart page →

27,537
eoloplantseoloplants-urjcVerified publisher0.1.01 of 7See more

eoloplants eoloplants-urjc 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
lourdesmorente/new-planner:1.0.0608745878cdb
spring-kafka@2.8.0
no fix listed

Open the chart page →

27,721
servereoloserverVerified publisher0.1.01 of 7See more

server eoloserver 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
codeurjc/planner:v1.0800cf520c245
spring-kafka@2.8.0
no fix listed

Open the chart page →

32,205
fineractfineract-openshift0.1.11 of 4See more

fineract fineract-openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
apache/fineract:1.12.1a83cf1980609
spring-kafka@3.3.4
3.3.16

Open the chart page →

7,792
scorpio-brokerfiware0.3.310 of 10See more

scorpio-broker fiware 0.3.3

10 of the 10 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
scorpiobroker/scorpio:RegistrySubscriptionManager_2.1.001e11d800459
spring-kafka@2.8.0
no fix listed
scorpiobroker/scorpio:eureka-server_2.1.03f05a113a4be
spring-kafka@2.8.0
no fix listed
scorpiobroker/scorpio:AtContextServer_2.1.05073ceef2fa0
spring-kafka@2.8.0
no fix listed
scorpiobroker/scorpio:gateway_2.1.062dae3dd0eeb
spring-kafka@2.8.0
no fix listed
scorpiobroker/scorpio:RegistryManager_2.1.0a2cfcf0947fd
spring-kafka@2.8.0
no fix listed
scorpiobroker/scorpio:QueryManager_2.1.0b742a53b2803
spring-kafka@2.8.0
no fix listed
scorpiobroker/scorpio:HistoryManager_2.1.0b7fe27a06ff5
spring-kafka@2.8.0
no fix listed
scorpiobroker/scorpio:config-server_1.1.0c46c1517e523
spring-kafka@2.2.9.RELEASE
no fix listed
scorpiobroker/scorpio:SubscriptionManager_2.1.0e08036670d66
spring-kafka@2.8.0
no fix listed
scorpiobroker/scorpio:EntityManager_2.1.0f02e8a429a08
spring-kafka@2.8.0
no fix listed

Open the chart page →

55,600
scorpiobrokerfiware0.1.210 of 10See more

scorpiobroker fiware 0.1.2

10 of the 10 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
scorpiobroker/scorpio:RegistrySubscriptionManager_2.1.001e11d800459
spring-kafka@2.8.0
no fix listed
scorpiobroker/scorpio:eureka-server_2.1.03f05a113a4be
spring-kafka@2.8.0
no fix listed
scorpiobroker/scorpio:AtContextServer_2.1.05073ceef2fa0
spring-kafka@2.8.0
no fix listed
scorpiobroker/scorpio:gateway_2.1.062dae3dd0eeb
spring-kafka@2.8.0
no fix listed
scorpiobroker/scorpio:RegistryManager_2.1.0a2cfcf0947fd
spring-kafka@2.8.0
no fix listed
scorpiobroker/scorpio:QueryManager_2.1.0b742a53b2803
spring-kafka@2.8.0
no fix listed
scorpiobroker/scorpio:HistoryManager_2.1.0b7fe27a06ff5
spring-kafka@2.8.0
no fix listed
scorpiobroker/scorpio:config-server_1.1.0c46c1517e523
spring-kafka@2.2.9.RELEASE
no fix listed
scorpiobroker/scorpio:SubscriptionManager_2.1.0e08036670d66
spring-kafka@2.8.0
no fix listed
scorpiobroker/scorpio:EntityManager_2.1.0f02e8a429a08
spring-kafka@2.8.0
no fix listed

Open the chart page →

55,600
scorpio-broker-aaiofiware0.4.151 of 1See more

scorpio-broker-aaio fiware 0.4.15

1 of the 1 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
scorpiobroker/scorpio:scorpio-aaio_2.1.0db55012043df
spring-kafka@2.8.0
no fix listed

Open the chart page →

5,286
mod-data-export-springfolio-org0.1.41 of 1See more

mod-data-export-spring folio-org 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
folioci/mod-data-export-spring:latestf1d7caf4544b
spring-kafka@4.0.2
4.0.6

Open the chart page →

1,253
mod-data-export-workerfolio-org0.1.151 of 1See more

mod-data-export-worker folio-org 0.1.15

1 of the 1 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
folioci/mod-data-export-worker:latest1ad1811c9b37
spring-kafka@4.0.2
4.0.6

Open the chart page →

1,214
eoloplanthttpd-eoloplant0.1.01 of 7See more

eoloplant httpd-eoloplant 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
codeurjc/planner:v1.0800cf520c245
spring-kafka@2.8.0
no fix listed

Open the chart page →

32,205
eoloserverihuertas2021-vmartinp2021-helm0.1.01 of 7See more

eoloserver ihuertas2021-vmartinp2021-helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
huertaslopez/i.huertas.2021-v.martinp.2021-planner:2.0.0e2c18bd65472
spring-kafka@2.8.0
no fix listed

Open the chart page →

27,721
eoloplantmca-eoloplaner0.1.01 of 7See more

eoloplant mca-eoloplaner 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
hugohg34/planner:0.0.2171f61e8d7e2
spring-kafka@2.8.0
no fix listed

Open the chart page →

29,588
Practica_4_helmmy-heml-appVerified publisher0.1.01 of 7See more

Practica_4_helm my-heml-app 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
adagber/planner:v1.0e5c1ed097752
spring-kafka@2.8.0
no fix listed

Open the chart page →

27,721
logic-ms-helm-chartnotesprojectchart0.1.01 of 2See more

logic-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
vlebediantsev/logic-ms:latestdf8bf38c535b
spring-kafka@2.8.7
no fix listed

Open the chart page →

6,852
registration-ms-helm-chartnotesprojectchart0.1.01 of 2See more

registration-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
vlebediantsev/registration-ms-final:latest427af418b75e
spring-kafka@2.8.7
no fix listed

Open the chart page →

5,916
user-data-ms-helm-chartnotesprojectchart0.1.01 of 2See more

user-data-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
vlebediantsev/user-data-ms-final-final:latest9319437f3c8f
spring-kafka@2.8.7
no fix listed

Open the chart page →

5,873
bpjstk-serviceopenshift1.0.01 of 6See more

bpjstk-service openshift 1.0.0

1 of the 6 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
andrianrf/backoffice-be:latest6036614803d4
spring-kafka@2.8.11
no fix listed

Open the chart page →

34,671
fineractopenshift0.1.11 of 4See more

fineract openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
apache/fineract:1.12.1a83cf1980609
spring-kafka@3.3.4
3.3.16

Open the chart page →

7,792
smsf-configurationopenshift1.0.41 of 1See more

smsf-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
gurolakman/smsf-configuration:1.0.49abb3882bcbd
spring-kafka@2.8.4
no fix listed

Open the chart page →

13,607
smsf-dispatcheropenshift1.0.41 of 1See more

smsf-dispatcher openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
gurolakman/smsf-dispatcher:1.0.46537e8ed8de8
spring-kafka@2.8.4
no fix listed

Open the chart page →

11,738
smsf-momtopenshift1.0.41 of 1See more

smsf-momt openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
gurolakman/smsf-momt:1.0.4ce23b20a8a17
spring-kafka@2.8.4
no fix listed

Open the chart page →

13,568
smsf-registrationopenshift1.0.41 of 1See more

smsf-registration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
gurolakman/smsf-registration:1.0.4b22e746edd5d
spring-kafka@2.8.4
no fix listed

Open the chart page →

13,551
ussigw-configurationopenshift1.0.41 of 1See more

ussigw-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
gurolakman/ussigw-configuration:1.0.4bf18525c5ad9
spring-kafka@2.8.4
no fix listed

Open the chart page →

13,455
ussigw-coreopenshift1.0.41 of 1See more

ussigw-core openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
gurolakman/ussigw-core:1.0.48739565c3ea2
spring-kafka@2.8.4
no fix listed

Open the chart page →

13,100
p4p40.1.01 of 7See more

p4 p4 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
mastercloudapps/planner:v1.2340a950b311b2
spring-kafka@2.8.0
no fix listed

Open the chart page →

27,537
Practica_4_helmpr04helm0.1.01 of 7See more

Practica_4_helm pr04helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
pcarrascoponce/planner:v1.0981fc482442c
spring-kafka@2.8.0
no fix listed

Open the chart page →

27,558
static-src-people-detector-appstatic-src-people-detector-chartVerified publisher1.5.54 of 6See more

static-src-people-detector-app static-src-people-detector-chart 1.5.5

4 of the 6 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
fimperato/detected-info-notification:1.2.6-RELEASE6441f6545613
spring-kafka@2.8.11
no fix listed
fimperato/detected-info-store:1.1.0-RELEASEe32920eedd3a
spring-kafka@2.8.11
no fix listed
fimperato/static-src-info-data-transformation:1.0.5-RELEASEdf05c388ea6c
spring-kafka@2.8.11
no fix listed
fimperato/static-src-people-detection:1.1.5-RELEASEc0cfaca070d9
spring-kafka@2.8.11
no fix listed

Open the chart page →

13,646
configservertwomartensVerified publisher0.2.01 of 1See more

configserver twomartens 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-41726.

Container imageDigestPackageFixed in
2martens/configserver:latestbf1cdb80239d
spring-kafka@3.2.3
no fix listed

Open the chart page →

2,144

Container images carrying it

41 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
mastercloudapps/planner:v1.2340a950b311b2
spring-kafka@2.8.0
no fix listed
4
codeurjc/planner:v1.0800cf520c245
spring-kafka@2.8.0
no fix listed
3
apache/fineract:1.12.1a83cf1980609
spring-kafka@3.3.4
3.3.16
2
obsidiandynamics/kafdrop:3.30.05337c9e0e2de
spring-kafka@2.8.4
no fix listed
2
scorpiobroker/scorpio:RegistrySubscriptionManager_2.1.001e11d800459
spring-kafka@2.8.0
no fix listed
2
scorpiobroker/scorpio:eureka-server_2.1.03f05a113a4be
spring-kafka@2.8.0
no fix listed
2
scorpiobroker/scorpio:AtContextServer_2.1.05073ceef2fa0
spring-kafka@2.8.0
no fix listed
2
scorpiobroker/scorpio:gateway_2.1.062dae3dd0eeb
spring-kafka@2.8.0
no fix listed
2
scorpiobroker/scorpio:RegistryManager_2.1.0a2cfcf0947fd
spring-kafka@2.8.0
no fix listed
2
scorpiobroker/scorpio:QueryManager_2.1.0b742a53b2803
spring-kafka@2.8.0
no fix listed
2
scorpiobroker/scorpio:HistoryManager_2.1.0b7fe27a06ff5
spring-kafka@2.8.0
no fix listed
2
scorpiobroker/scorpio:config-server_1.1.0c46c1517e523
spring-kafka@2.2.9.RELEASE
no fix listed
2
scorpiobroker/scorpio:SubscriptionManager_2.1.0e08036670d66
spring-kafka@2.8.0
no fix listed
2
scorpiobroker/scorpio:EntityManager_2.1.0f02e8a429a08
spring-kafka@2.8.0
no fix listed
2
2martens/configserver:latestbf1cdb80239d
spring-kafka@3.2.3
no fix listed
1
adagber/planner:v1.0e5c1ed097752
spring-kafka@2.8.0
no fix listed
1
andrianrf/backoffice-be:latest6036614803d4
spring-kafka@2.8.11
no fix listed
1
arturisimo/planner:v1.0fff9de644941
spring-kafka@2.8.0
no fix listed
1
choerodon/event-store-service:0.8.03c94c97f6f69
spring-kafka@1.1.4.RELEASE
no fix listed
1
fimperato/detected-info-notification:1.2.6-RELEASE6441f6545613
spring-kafka@2.8.11
no fix listed
1
fimperato/detected-info-store:1.1.0-RELEASEe32920eedd3a
spring-kafka@2.8.11
no fix listed
1
fimperato/static-src-info-data-transformation:1.0.5-RELEASEdf05c388ea6c
spring-kafka@2.8.11
no fix listed
1
fimperato/static-src-people-detection:1.1.5-RELEASEc0cfaca070d9
spring-kafka@2.8.11
no fix listed
1
flowable/flowable-rest:7.1.0b7ae287502cd
spring-kafka@3.2.4
no fix listed
1
folioci/mod-data-export-spring:latestf1d7caf4544b
spring-kafka@4.0.2
4.0.6
1
folioci/mod-data-export-worker:latest1ad1811c9b37
spring-kafka@4.0.2
4.0.6
1
gurolakman/smsf-configuration:1.0.49abb3882bcbd
spring-kafka@2.8.4
no fix listed
1
gurolakman/smsf-dispatcher:1.0.46537e8ed8de8
spring-kafka@2.8.4
no fix listed
1
gurolakman/smsf-momt:1.0.4ce23b20a8a17
spring-kafka@2.8.4
no fix listed
1
gurolakman/smsf-registration:1.0.4b22e746edd5d
spring-kafka@2.8.4
no fix listed
1
gurolakman/ussigw-configuration:1.0.4bf18525c5ad9
spring-kafka@2.8.4
no fix listed
1
gurolakman/ussigw-core:1.0.48739565c3ea2
spring-kafka@2.8.4
no fix listed
1
huertaslopez/i.huertas.2021-v.martinp.2021-planner:2.0.0e2c18bd65472
spring-kafka@2.8.0
no fix listed
1
hugohg34/planner:0.0.2171f61e8d7e2
spring-kafka@2.8.0
no fix listed
1
lourdesmorente/new-planner:1.0.0608745878cdb
spring-kafka@2.8.0
no fix listed
1
molynx/planner:v1441c9f52f092
spring-kafka@2.8.0
no fix listed
1
pcarrascoponce/planner:v1.0981fc482442c
spring-kafka@2.8.0
no fix listed
1
scorpiobroker/scorpio:scorpio-aaio_2.1.0db55012043df
spring-kafka@2.8.0
no fix listed
1
vlebediantsev/logic-ms:latestdf8bf38c535b
spring-kafka@2.8.7
no fix listed
1
vlebediantsev/registration-ms-final:latest427af418b75e
spring-kafka@2.8.7
no fix listed
1
vlebediantsev/user-data-ms-final-final:latest9319437f3c8f
spring-kafka@2.8.7
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.