StackRadar

CVE-2026-44307

High

Advisory

Published 6 May 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.006
47th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
110
of 17,781 indexed, latest versions
Container images
111
deployed by those charts
Fix available
1 of 1
affected package

Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup

Carried by container images the latest versions of 110 of 17,781 indexed charts deploy, on 111 images.

Affected packageAffected versionsFixed inImages
makopypi0.8.1, 1.0.2, 1.0.6.dev0, 1.0.7+25 more1.3.12111
OSV records
GHSA-2h4p-vjrc-8xpq
Also known as
PYSEC-2026-2617

Charts affected

110 by stars
ChartLatestAffected imagesRadar Score
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
mako@1.3.2
1.3.12

Open the chart page →

11,367
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
mako@1.3.9
1.3.12

Open the chart page →

5,987
supersetcloudposse1.2.01 of 1See more

superset cloudposse 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
amancevice/superset:0.35.212a0a9e66550
mako@1.0.14
1.3.12

Open the chart page →

5,851
fadicetic0.3.13 of 25See more

fadi cetic 0.3.1

3 of the 25 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
amancevice/superset:0.35.212a0a9e66550
mako@1.0.14
1.3.12
jupyterhub/k8s-hub:0.11.1b6b4a1a34bf0
mako@1.1.3
1.3.12
jupyterhub/k8s-singleuser-sample:0.11.1e3e6f3051df8
mako@1.1.3
1.3.12

Open the chart page →

52,919
daskhubdask2024.1.12 of 9See more

daskhub dask 2024.1.1

2 of the 9 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
mako@1.3.0
1.3.12
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
mako@1.3.0
1.3.12

Open the chart page →

14,094
openshift-secured-pgadmineximiaitVerified publisher0.2.01 of 2See more

openshift-secured-pgadmin eximiait 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
dpage/pgadmin4:7.537946e4f3e7b
mako@1.2.4
1.3.12

Open the chart page →

14,546
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
mako@1.2.0
1.3.12

Open the chart page →

7,579
mlflowgetindataVerified publisher0.1.21 of 1See more

mlflow getindata 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
gcr.io/getindata-images-public/mlflow:latest25d6975951f1
mako@1.3.3
1.3.12

Open the chart page →

2,452
mealieth-chartsVerified publisher0.5.11 of 1See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
mako@1.3.10
1.3.12

Open the chart page →

3,804
rommcrystalnetVerified publisher0.2.201 of 3See more

romm crystalnet 0.2.20

1 of the 3 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
zurdi15/romm:2.3.12db88fe44c89
mako@1.2.4
1.3.12

Open the chart page →

1,944
datacube-explorerdatacube-charts0.5.321 of 1See more

datacube-explorer datacube-charts 0.5.32

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
opendatacube/explorer:latest120457ffcd69
mako@1.3.10
1.3.12

Open the chart page →

4,854
kubedashdevopstalesOfficialVerified publisher4.0.01 of 8See more

kubedash devopstales 4.0.0

1 of the 8 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
devopstales/kubedash:3.1.08bb837da5aec
mako@1.3.10
1.3.12

Open the chart page →

9,205
dominodominoVerified publisher0.1.111 of 3See more

domino domino 0.1.11

1 of the 3 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
mako@1.3.2
1.3.12

Open the chart page →

8,823
pgadmin4folio-org1.2.301 of 1See more

pgadmin4 folio-org 1.2.30

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
dpage/pgadmin4:4.22b1f00b8163cf
mako@1.1.2
1.3.12

Open the chart page →

2,034
powerdnsadminhalkeye0.3.11 of 1See more

powerdnsadmin halkeye 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
ngoduykhanh/powerdns-admin:0.2.3099371dd9ba6
mako@1.1.3
1.3.12

Open the chart page →

3,345
harp-proxyharp0.8.11 of 1See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
makersquad/harp-proxy:0.8.1a40dd258c527
mako@1.3.10
1.3.12

Open the chart page →

6,374
hasher-matcher-actionerhasher-matcher-actioner1.0.01 of 1See more

hasher-matcher-actioner hasher-matcher-actioner 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
ghcr.io/facebook/threatexchange/hma:1.0.1784d09c6b75a7
mako@1.3.10
1.3.12

Open the chart page →

910
huehue1.0.31 of 3See more

hue hue 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
gethue/hue:latest7d5c1b9f8a79
mako@1.2.3
1.3.12

Open the chart page →

12,397
supersetinseefrlab1.4.01 of 4See more

superset inseefrlab 1.4.0

1 of the 4 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
mako@1.1.4
1.3.12

Open the chart page →

7,129
iris-webappiris-webapp0.2.41 of 2See more

iris-webapp iris-webapp 0.2.4

1 of the 2 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
mako@1.3.10
1.3.12

Open the chart page →

11,764
jessejesse-chartVerified publisher0.0.461 of 6See more

jesse jesse-chart 0.0.46

1 of the 6 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
salehmir/jesse:1.10.101afa95f979e9
mako@1.3.10
1.3.12

Open the chart page →

3,421
jupyterhub-outpostjupyter-jscVerified publisher2.4.11 of 1See more

jupyterhub-outpost jupyter-jsc 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
mako@1.3.11
1.3.12

Open the chart page →

1,678
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
mako@1.3.5
1.3.12

Open the chart page →

20,403
mlflow-controllermlflow-deployment-controller0.1.82 of 2See more

mlflow-controller mlflow-deployment-controller 0.1.8

2 of the 2 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
tachyongroup/mlflow-deployment-controller:mlflow-controller-0.1.87e79b9000856
mako@1.2.4
1.3.12
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
mako@1.2.4
1.3.12

Open the chart page →

8,957
mlflow-servermlflowserver0.1.91 of 3See more

mlflow-server mlflowserver 0.1.9

1 of the 3 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
buntha/mlflow:2.1.1154542cc3083
mako@1.2.4
1.3.12

Open the chart page →

5,804
opencveopencve1.2.01 of 3See more

opencve opencve 1.2.0

1 of the 3 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
cleveritcz/opencve:1.5.0c75c1636e0b7
mako@1.3.3
1.3.12

Open the chart page →

2,097
privacyideaprivacyidea1.0.61 of 2See more

privacyidea privacyidea 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
gpappsoft/privacyidea-docker:3.12.2af7841adad26
mako@1.3.9
1.3.12

Open the chart page →

5,440
mealiertomik-helm-chartsVerified publisher0.0.21 of 1See more

mealie rtomik-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
mako@1.2.4
1.3.12

Open the chart page →

3,929
delugerubxkubeVerified publisher1.2.11 of 1See more

deluge rubxkube 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
linuxserver/deluge:18.04.10ac871624394
mako@1.0.7
1.3.12

Open the chart page →

13,541
ckanstatcan0.0.351 of 8See more

ckan statcan 0.0.35

1 of the 8 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
statcan/ckan:2.93921305425b8
mako@1.1.0
1.3.12

Open the chart page →

24,930
radosgwananace-chartsVerified publisher0.3.41 of 1See more

radosgw ananace-charts 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
ceph/daemon:latest-nautilus90f30824a96e
mako@0.8.1
1.3.12

Open the chart page →

1,650
pgadminappscodeVerified publisher2026.3.301 of 1See more

pgadmin appscode 2026.3.30

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
dpage/pgadmin4:9.11.050700ac17936
mako@1.3.10
1.3.12

Open the chart page →

1,565
pgadminarunalakmalVerified publisher0.1.01 of 1See more

pgadmin arunalakmal 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
dpage/pgadmin4:6.12781369df9994
mako@1.2.1
1.3.12

Open the chart page →

2,418
swdpgadminarunalakmalVerified publisher0.1.01 of 1See more

swdpgadmin arunalakmal 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
dpage/pgadmin4:6.12781369df9994
mako@1.2.1
1.3.12

Open the chart page →

2,418
keystonearzu0.2.292 of 4See more

keystone arzu 0.2.29

2 of the 4 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
openstackhelm/heat:wallaby-ubuntu_focalf728510bab3c
mako@1.1.4
1.3.12
openstackhelm/keystone:wallaby-ubuntu_focale07d75953d2e
mako@1.1.4
1.3.12

Open the chart page →

22,568
locationprocessingassist-iot-location-processing1.0.01 of 3See more

locationprocessing assist-iot-location-processing 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
dpage/pgadmin4:6.12781369df9994
mako@1.2.1
1.3.12

Open the chart page →

10,061
huebigdata-chartsVerified publisher1.0.41 of 2See more

hue bigdata-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
gethue/hue:4.10.05702b2c37ff9
mako@1.1.4
1.3.12

Open the chart page →

22,891
sickchillbryanalves0.3.01 of 1See more

sickchill bryanalves 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
mako@1.1.3
1.3.12

Open the chart page →

2,504
opencvecfi20170.1.21 of 7See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
mako@1.3.8
1.3.12

Open the chart page →

15,371
kitchenowlchart-kitchenowl0.1.121 of 2See more

kitchenowl chart-kitchenowl 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
tombursch/kitchenowl-backend:v0.7.8b48e4ab727cd
mako@1.3.11
1.3.12

Open the chart page →

4,803
syncserverchristianhuthVerified publisher1.3.01 of 1See more

syncserver christianhuth 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
mozilla/syncserver:latest016162bf39d8
mako@1.0.9
1.3.12

Open the chart page →

1,382
daskcloudnativeapp2.2.11 of 2See more

dask cloudnativeapp 2.2.1

1 of the 2 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
daskdev/dask-notebook:1.1.0052630f5ca04
mako@1.0.7
1.3.12

Open the chart page →

29,901
supersetcloudnativeapp1.1.61 of 1See more

superset cloudnativeapp 1.1.6

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
amancevice/superset:0.28.1c8c04bfe3d66
mako@1.0.7
1.3.12

Open the chart page →

5,060
galaxy-stablecloudve2.0.01 of 5See more

galaxy-stable cloudve 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
galaxy/galaxy-init:v18.010267bad550e6
mako@1.0.2
1.3.12

Open the chart page →

70,895
csghubcsghubVerified publisher2.4.32 of 34See more

csghub csghub 2.4.3

2 of the 34 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
mako@1.3.10
1.3.12
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
mako@1.3.10
1.3.12

Open the chart page →

58,897
jupyterhubd4nVerified publisher3.3.72 of 7See more

jupyterhub d4n 3.3.7

2 of the 7 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
aristidetm/basic-notebook:3.6.5469dbc951224
mako@1.3.5
1.3.12
aristidetm/k8s-hub:3.3.7ccb516cb8474
mako@1.3.2
1.3.12

Open the chart page →

16,604
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
mako@1.3.9
1.3.12

Open the chart page →

5,062
datacube-indexdatacube-charts0.4.41 of 2See more

datacube-index datacube-charts 0.4.4

1 of the 2 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
opendatacube/ows:latest668cbb41473c
mako@1.3.8
1.3.12

Open the chart page →

6,123
datacube-owsdatacube-charts0.20.11 of 1See more

datacube-ows datacube-charts 0.20.1

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
opendatacube/ows:latest668cbb41473c
mako@1.3.8
1.3.12

Open the chart page →

5,974
datacube-wpsdatacube-charts0.9.01 of 1See more

datacube-wps datacube-charts 0.9.0

1 of the 1 container images this version deploys carry CVE-2026-44307.

Container imageDigestPackageFixed in
opendatacube/wps:latest80df355a660b
mako@1.3.9
1.3.12

Open the chart page →

6,172

Container images carrying it

111 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
mako@1.2.4
1.3.12
1
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
mako@1.2.4
1.3.12
1
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
mako@1.3.10
1.3.12
1
ghcr.io/mlops-for-all/mlflow-tracking-server:3.8-1.30.1-v1.0.0d30e631684c3
mako@1.2.4
1.3.12
1
ghcr.io/openrelik/openrelik-metrics:latest3d0f1ddeebf5
mako@1.3.10
1.3.12
1
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
mako@1.3.2
1.3.12
1
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
mako@1.3.0
1.3.12
1
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
mako@1.2.2
1.3.12
1
registry.gitlab.com/open-forms/forms-catalogue:latest4eaf9c911f33
mako@1.1.5
1.3.12
1
registry.gitlab.com/open-forms/request-registry:latest0886cbbc5f95
mako@1.1.5
1.3.12
1
registry.gitlab.com/radiology/infrastructure/study-governor:8.0.04e7faf6f8d5f
mako@1.3.0
1.3.12
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.