StackRadar

CVE-2026-41854

Medium

Advisory

Published 9 Jun 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.2
base score, highest
EPSS
0.001
2nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
60
of 17,781 indexed, latest versions
Container images
62
deployed by those charts
Fix available
1 of 1
affected package

Spring Framework Server-Side Request Forgery via UriComponentsBuilder

Carried by container images the latest versions of 60 of 17,781 indexed charts deploy, on 62 images.

Affected packageAffected versionsFixed inImages
spring-webmaven6.2.0, 6.2.1, 6.2.2, 6.2.3+14 more6.2.19, 7.0.862
OSV records
GHSA-7m2p-62gw-p8qq

Charts affected

60 by stars
ChartLatestAffected imagesRadar Score
fineractopenshift0.1.11 of 4See more

fineract openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-41854.

Container imageDigestPackageFixed in
apache/fineract:1.12.1a83cf1980609
spring-web@6.2.5
6.2.19

Open the chart page →

7,792
operatonoperatonVerified publisher1.0.51 of 1See more

operaton operaton 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-41854.

Container imageDigestPackageFixed in
operaton/operaton:1.0.0-beta-4b35867ffe4d8
spring-web@6.2.5
6.2.19

Open the chart page →

2,003
unifiqaoruVerified publisher1.1.21 of 2See more

unifi qaoru 1.1.2

1 of the 2 container images this version deploys carry CVE-2026-41854.

Container imageDigestPackageFixed in
linuxserver/unifi-network-application:10.6.101-ls144b6ce6968ee45
spring-web@6.2.18
6.2.19

Open the chart page →

3,642
stirling-pdfrubxkubeVerified publisher0.1.21 of 1See more

stirling-pdf rubxkube 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-41854.

Container imageDigestPackageFixed in
ghcr.io/stirling-tools/stirling-pdf:2.14.33b3670fce70b
spring-web@7.0.7
7.0.8

Open the chart page →

6,207
retail-store-sample-cart-chartstacksimplifyVerified publisher1.0.01 of 1See more

retail-store-sample-cart-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-41854.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-cart:1.3.05d767569c976
spring-web@6.2.10
6.2.19

Open the chart page →

1,068
retail-store-sample-orders-chartstacksimplifyVerified publisher2.0.01 of 1See more

retail-store-sample-orders-chart stacksimplify 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-41854.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-orders:1.3.0e85f034bcf48
spring-web@6.2.10
6.2.19

Open the chart page →

1,223
retail-store-sample-ui-chartstacksimplifyVerified publisher1.0.01 of 1See more

retail-store-sample-ui-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-41854.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-ui:1.3.0ce3f2e935eb3
spring-web@6.2.10
6.2.19

Open the chart page →

836
sn-consolestreamnative1.13.01 of 1See more

sn-console streamnative 1.13.0

1 of the 1 container images this version deploys carry CVE-2026-41854.

Container imageDigestPackageFixed in
streamnative/private-cloud-console:v2.3.27-all91e54375e154
spring-web@6.2.11
6.2.19

Open the chart page →

1,827
timetabletwomartensVerified publisher0.2.01 of 1See more

timetable twomartens 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-41854.

Container imageDigestPackageFixed in
2martens/timetable:latestbd1ba6ab84c9
spring-web@6.2.11
6.2.19

Open the chart page →

1,527
wahlrechttwomartensVerified publisher0.3.01 of 1See more

wahlrecht twomartens 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-41854.

Container imageDigestPackageFixed in
2martens/wahlrecht:latestba2c3040dab0
spring-web@6.2.9
6.2.19

Open the chart page →

1,689

Container images carrying it

62 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
apache/fineract:1.12.1a83cf1980609
spring-web@6.2.5
6.2.19
2
apacherocketmq/rocketmq-dashboard:2.1.0ce78506bd6fe
spring-web@6.2.6
6.2.19
2
graviteeio/apim-management-api:4.12.19-debian27374522cd04
spring-web@6.2.18
6.2.19
2
jenkins/jenkins:2.541.3-jdk21c4098086090c
spring-web@6.2.14
6.2.19
2
nacos/nacos-server:latest1c191c30c8cd
spring-web@6.2.18
6.2.19
2
ghcr.io/kafbat/kafka-ui:v1.5.07cda86a33344
spring-web@6.2.17
6.2.19
2
2martens/timetable:latestbd1ba6ab84c9
spring-web@6.2.11
6.2.19
1
2martens/wahlrecht:latestba2c3040dab0
spring-web@6.2.9
6.2.19
1
adeptiainc/adeptia-connect-migration:5.2.98607f4f29732
spring-web@6.2.15
6.2.19
1
adeptiainc/adeptia-connect-migration:4.8.1f1087da3da0b
spring-web@6.2.17
6.2.19
1
alfio/alf.io:2.0-M5-26060c836a081446
spring-web@6.2.18
6.2.19
1
apache/hertzbeat:1.8.075d48a62748f
spring-web@6.2.2
6.2.19
1
apache/hertzbeat-collector:1.8.0a2bab1be574c
spring-web@6.2.2
6.2.19
1
bluerange/bluerange:26.1.307c8f73b55df
spring-web@6.2.6
6.2.19
1
castlemock/castlemock:latestb7f3f1527ba9
spring-web@6.2.5
6.2.19
1
cbioportal/cbioportal:6.4.1-web-shenandoah08debbd2dbf9
spring-web@6.2.11
6.2.19
1
erudikaltd/scoold:1.66.0949c56b57e8f
spring-web@7.0.3
7.0.8
1
fabioformosa/hello-world-api:latest063873af085c
spring-web@6.2.5
6.2.19
1
folioci/edge-rtac:latest15ef73b1abd0
spring-web@7.0.5
7.0.8
1
folioci/mod-data-export:latest0cc86bf09755
spring-web@7.0.3
7.0.8
1
folioci/mod-data-export-spring:latestf1d7caf4544b
spring-web@7.0.3
7.0.8
1
folioci/mod-data-export-worker:latest1ad1811c9b37
spring-web@7.0.3
7.0.8
1
folioci/mod-ebsconet:latest3ae8cb99daa3
spring-web@7.0.3
7.0.8
1
gotson/komga:1.22.0ba892ab3e082
spring-web@6.2.0
6.2.19
1
gridgain/cloud-connector:2025.5.15ab838d7d3cb
spring-web@6.2.15
6.2.19
1
krontechnology/aapm-agent:1.8.41cc7d5be6529
spring-web@6.2.18
6.2.19
1
krontechnology/aapm-service:1.1.39dd602db8baa
spring-web@6.2.18
6.2.19
1
linuxserver/unifi-network-application:10.6.101-ls144b6ce6968ee45
spring-web@6.2.18
6.2.19
1
nacos/nacos-server:v3.0.20e951a1d07bb
spring-web@6.2.5
6.2.19
1
nacos/nacos-server:v3.0.130a39cb0c54d
spring-web@6.2.5
6.2.19
1
operaton/operaton:1.0.0-beta-4b35867ffe4d8
spring-web@6.2.5
6.2.19
1
razzy10/product-service:latest702e411956db
spring-web@6.2.10
6.2.19
1
reportportal/service-jobs:5.15.299d27d58d6b4
spring-web@6.2.18
6.2.19
1
siakhooi/query:1.0.0f1f4b5b1b870
spring-web@7.0.6
7.0.8
1
streamnative/private-cloud-console:v2.3.27-all91e54375e154
spring-web@6.2.11
6.2.19
1
structurizr/onpremises:2025.11.094b5ffb5119c8
spring-web@6.2.7
6.2.19
1
sysnet4admin/colosseum-agg:logbc25b152d88e
spring-web@6.2.1
6.2.19
1
thingsboard/tb-postgres:latest2d17e4e36edc
spring-web@6.2.11
6.2.19
1
vincentgwzhang/k8sforjava:latesta9139f2cd98f
spring-web@6.2.1
6.2.19
1
gcr.io/spotinst-artifacts/spot-ocean-metric-exporter:1.0.5ae57b62291aa
spring-web@6.2.10
6.2.19
1
ghcr.io/eximeebpms/eximeebpms-bpm-platform:run-1.3.0acb8dbce38fd
spring-web@7.0.5
7.0.8
1
ghcr.io/gla-rad/enav-api-gateway:latest8f4345c77dda
spring-web@7.0.6
7.0.8
1
ghcr.io/gla-rad/enav-aton-admin-service:latestcf85570b1324
spring-web@7.0.7
7.0.8
1
ghcr.io/gla-rad/enav-aton-service:latest3be878690629
spring-web@7.0.7
7.0.8
1
ghcr.io/gla-rad/enav-aton-service-client:latestf1629ac5f9ec
spring-web@7.0.7
7.0.8
1
ghcr.io/gla-rad/enav-ckeeper:latest415323ef112b
spring-web@7.0.6
7.0.8
1
ghcr.io/gla-rad/enav-eureka:latest05002092c621
spring-web@7.0.6
7.0.8
1
ghcr.io/gla-rad/enav-msg-broker:latest6fe372e4e481
spring-web@7.0.6
7.0.8
1
ghcr.io/gla-rad/enav-vdes-controller:latestc4c52955814f
spring-web@7.0.6
7.0.8
1
ghcr.io/gregperlinli/certvault:2.12.0a7d0cc9e260a
spring-web@6.2.14
6.2.19
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.