CVE-2026-41989

High

Advisory

Published 23 Apr 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.002; 8th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,957; of 17,803 indexed, latest versions
Container images: 2,169; deployed by those charts
Fix available: 2 of 2; affected packages

Red Hat Security Advisory: libgcrypt security update

Carried by container images the latest versions of 1,957 of 17,803 indexed charts deploy, on 2,169 images.

Affected package	Affected versions	Fixed in	Images
libgcryptrpm	1.8.3-2.el8, 1.8.3-4.el8, 1.8.5-4.el8, 1.8.5-6.el8+7 more	0:1.8.5-8.el8_10, 0:1.10.0-13.el9_8, 1.11.0-150700.5.10.1, 1.12.1-160000.3.1	378
libgcrypt20deb	1.6.5-2ubuntu0.2, 1.6.5-2ubuntu0.3, 1.6.5-2ubuntu0.4, 1.6.5-2ubuntu0.5+18 more	1.9.4-3ubuntu3.2, 1.10.1-3+deb12u1, 1.10.3-2ubuntu0.1, 1.11.0-7+deb13u1+4 more	1,791

OSV records: RHSA-2026:47117 RHSA-2026:50147 RLSA-2026:47117 RLSA-2026:50147 DEBIAN-CVE-2026-41989 UBUNTU-CVE-2026-41989 ECHO-afba-f32f-e1d7 SUSE-SU-2026:22826-1 SUSE-SU-2026:3182-1
Also known as: RHSA-2026:52950, RHSA-2026:52952, RHSA-2026:52953, RHSA-2026:58977, RHSA-2026:58978, RHSA-2026:58979, USN-8319-1

Charts affected

1,957 by stars

Chart

Latest

Affected images

Radar Score

xkopsxkops

0.1.0

4 of 5 See more

xkops xkops 0.1.0

4 of the 5 container images this version deploys carry CVE-2026-41989.

Container image	Digest	Package	Fixed in
hamzaarshad10/querybackend :1.6.2	2c1c3b86a8e7	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1
hamzaarshad10/querypodpy :1.7	154f38e8668e	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1
library/mongo :latest	5211c51171f5	libgcrypt20@1.10.3-2ubuntu0.1	1.12.0-2ubuntu0.1~Fips1~rc11
murtazashah46/helmfile :latest	4d11726cf803	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1

Open the chart page →

13,875

xlinexline

0.0.1

1 of 1 See more

xline xline 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-41989.

Container image	Digest	Package	Fixed in
ghcr.io/liangyuanpeng/xline :latest	3d2eceb44a3b	libgcrypt20@1.10.3-2build1	1.10.3-2ubuntu0.1

Open the chart page →

2,156

api-snapyoukadev

0.1.1

1 of 1 See more

api-snap youkadev 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-41989.

Container image	Digest	Package	Fixed in
youkadev/api-snap :0.1.1	4db0f9428e67	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1

Open the chart page →

2,710

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-41989.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	libgcrypt@1.8.5-7.el8_6	0:1.8.5-8.el8_10

Open the chart page →

6,021

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2026-41989.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	libgcrypt@1.8.5-7.el8_6	0:1.8.5-8.el8_10

Open the chart page →

3,700

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-41989.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	libgcrypt20@1.8.1-4ubuntu1.3	no fix listed
yandex/clickhouse-server :21.3.20	4eccfffb01d7	libgcrypt20@1.8.5-5ubuntu1.1	no fix listed

Open the chart page →

9,280

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-41989.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	libgcrypt20@1.9.4-3ubuntu3.2	no fix listed

Open the chart page →

7,949

Container images carrying it

2,169 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/getsentry/sentry :26.7.2	7c5052aa4e3c	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1	1
ghcr.io/goauthentik/server :2026.2.1	46a71d75dfd3	libgcrypt20@1.11.0-7	1.11.0-7+deb13u1	1
ghcr.io/grafana/alloy-operator :1.3.0	2088dcb22aaa	libgcrypt@1.10.0-11.el9	0:1.10.0-13.el9_8	1
ghcr.io/grafana/alloy-operator :1.7.0	2ce23f948e02	libgcrypt@1.10.0-11.el9	0:1.10.0-13.el9_8	1
ghcr.io/grafana/alloy-operator :1.12.1	4ee4b71cf16a	libgcrypt@1.10.0-11.el9	0:1.10.0-13.el9_8	1
ghcr.io/grafana/alloy-operator :1.8.1	ae85d68749c7	libgcrypt@1.10.0-11.el9	0:1.10.0-13.el9_8	1
ghcr.io/graphprotocol/availability-oracle :sha-28312fd	472a25038957	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1	1
ghcr.io/gregperlinli/certvault :2.12.0	a7d0cc9e260a	libgcrypt20@1.10.3-2build1	1.10.3-2ubuntu0.1	1
ghcr.io/grycap/im :latest	06a16d4f279f	libgcrypt20@1.10.3-2build1	1.10.3-2ubuntu0.1	1
ghcr.io/haveagitgat/tdarr :2.00.18.2	3fbe4c29d14c	libgcrypt20@1.8.5-5ubuntu1.1	no fix listed	1
ghcr.io/hemslo/chat-search :latest	39d48995a5bd	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1	1
ghcr.io/home-operations/plex :1.43.1	a9c3723cb31c	libgcrypt20@1.10.3-2build1	1.10.3-2ubuntu0.1	1
ghcr.io/htunn/ansible-inspec :0.2.12	cd25a5cc3f1b	libgcrypt20@1.11.0-7	1.11.0-7+deb13u1	1
ghcr.io/huggingface/text-embeddings-inference :cpu-1.6	66db77d7856c	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1	1
ghcr.io/huggingface/text-embeddings-inference :cpu-1.9.3	ad950d30878e	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1	1
ghcr.io/huscker/townsquare-backend :2.15.2	e106681e7673	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1	1
ghcr.io/hypolia/kanri :0.1.2-rc4	fa7d5cc7fb7d	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1	1
ghcr.io/icegatetech/icegate-ingest :0.1.1	bae3c441894a	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1	1
ghcr.io/icegatetech/icegate-maintain :0.1.1	93e85b2b76ee	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1	1
ghcr.io/icegatetech/icegate-query :0.1.1	7542b4e7fff2	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1	1
ghcr.io/ignisda/ryot :v10.5.0	a752b6aee537	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1	1
ghcr.io/iisas/domino-frontend :k8s	8e53861be292	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1	1
ghcr.io/imgproxy/imgproxy :v3.30.0	74c1bee92e04	libgcrypt20@1.10.3-2build1	1.10.3-2ubuntu0.1	1
ghcr.io/immich-app/immich-machine-learning :v2.3.1	379e31b8c751	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1	1
ghcr.io/immich-app/immich-server :v2.3.1	f8d06a32b1b2	libgcrypt20@1.11.0-7	1.11.0-7+deb13u1	1
ghcr.io/interlink-hq/interlink/virtual-kubelet-inttw :latest	0e05a7b49c33	libgcrypt20@1.9.4-3ubuntu3.2	no fix listed	1
ghcr.io/invergent-ai/surogate-hub :latest	6d4106724d56	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1	1
ghcr.io/it-at-m/appswitcher-server :1.3.0	10006bc0f309	libgcrypt20@1.9.4-3ubuntu3	1.9.4-3ubuntu3.2	1
ghcr.io/it-at-m/dave-admin-portal/dave-adminportal :10.0.0	cbff8141302f	libgcrypt@1.10.0-11.el9	0:1.10.0-13.el9_8	1
ghcr.io/it-at-m/dave-backend/dave-backend :10.0.0	f66413e62afc	libgcrypt@1.10.0-11.el9	0:1.10.0-13.el9_8	1
ghcr.io/it-at-m/dave-document-storage/dave-document-storage :10.0.0	9c7fc07330c9	libgcrypt@1.10.0-11.el9	0:1.10.0-13.el9_8	1
ghcr.io/it-at-m/dave-eai/dave-eai :10.0.0	fd93e0d125b3	libgcrypt@1.10.0-11.el9	0:1.10.0-13.el9_8	1
ghcr.io/it-at-m/dave-frontend/dave-frontend :10.0.0	a49fdb8d6f1b	libgcrypt@1.10.0-11.el9	0:1.10.0-13.el9_8	1
ghcr.io/it-at-m/dave-geodata-eai/dave-geodata-eai :10.0.0	6a3fe3136856	libgcrypt@1.10.0-11.el9	0:1.10.0-13.el9_8	1
ghcr.io/it-at-m/dave-selfservice-portal/dave-selfserviceportal :10.0.0	d352df1b94b6	libgcrypt@1.10.0-11.el9	0:1.10.0-13.el9_8	1
ghcr.io/it-at-m/kf-app-eai :1.0.6	5de339b3d537	libgcrypt@1.10.0-11.el9	0:1.10.0-13.el9_8	1
ghcr.io/it-at-m/wjh-rechner :1.0.0	bc70cdb5a01a	libgcrypt@1.10.0-10.el9_2	0:1.10.0-13.el9_8	1
ghcr.io/it-at-m/zammad-ldap-sync :dev	10de22c8cbce	libgcrypt@1.10.0-11.el9	0:1.10.0-13.el9_8	1
ghcr.io/itzg/minecraft-server :latest	46919d151d39	libgcrypt20@1.10.3-2ubuntu0.2	1.12.0-2ubuntu0.1~Fips1~rc11	1
ghcr.io/jaydee94/kubeseal-webgui/api :4.5.3	3cceb9462ae1	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1	1
ghcr.io/jenkins-x/nexus :0.1.37	8caf5289fe73	libgcrypt@1.8.3-4.el8	0:1.8.5-8.el8_10	1
ghcr.io/jespernohr/dayz-dedicated-server :0.1.1	ec01d3ac7887	libgcrypt20@1.10.3-2build1	1.10.3-2ubuntu0.1	1
ghcr.io/jfwenisch/discord-experiencebot :latest	b52ff07f9f0c	libgcrypt20@1.8.1-4ubuntu1.3	no fix listed	1
ghcr.io/jfwenisch/steamcmd-manager :v0.4.5	dab685e668d9	libgcrypt20@1.10.3-2build1	1.10.3-2ubuntu0.1	1
ghcr.io/jfwenisch/webtools :v0.1.4	4569cae83c70	libgcrypt20@1.10.3-2build1	1.10.3-2ubuntu0.1	1
ghcr.io/jmberesford/retrom-service :retrom-v0.7.14	4d763d58f11d	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1	1
ghcr.io/jr0dd/puppeteer :v13.3.2	6047599cd78e	libgcrypt20@1.8.5-5ubuntu1.1	no fix listed	1
ghcr.io/juicerescue/juicepassproxy :0.5.1	984dc4f19162	libgcrypt20@1.10.1-3	1.10.1-3+deb12u1	1
ghcr.io/justarchinet/archisteamfarm :6.3.10.1	07286b8b41a1	libgcrypt20@1.10.3-2ubuntu0.2	1.12.0-2ubuntu0.1~Fips1~rc11	1
ghcr.io/k8s-at-home/apache-musicindex :v1.4.1-2	c9bd82dc5fda	libgcrypt20@1.8.5-5ubuntu1.1	no fix listed	1