StackRadar

CVE-2026-44503

High

Advisory

Published 7 May 2026In the index since 8 Sept 2026
Severity
High
worst across findings
CVSS
7.0
base score, highest
EPSS
0.005
42nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
19
of 17,781 indexed, latest versions
Container images
18
deployed by those charts
Fix available
4 of 4
affected packages

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

Carried by container images the latest versions of 19 of 17,781 indexed charts deploy, on 18 images.

Affected packageAffected versionsFixed inImages
github.com/microsoft/kiota-http-gogolangv1.1.0, v1.4.4, v1.5.2, v1.5.41.5.56
Microsoft.Kiota.Abstractionsnuget1.1.0, 1.17.11.22.06
microsoft-kiota-httppypi1.3.2, 1.3.3, 1.9.7, 1.9.81.9.94
microsoft-kiota-abstractionsmaven1.8.4, 1.8.101.9.12
OSV records
GHSA-7j59-v9qr-6fq9
Also known as
GO-2026-5224, PYSEC-2026-2647

Charts affected

19 by stars
ChartLatestAffected imagesRadar Score
vault-gcp-secretsvault-gcp-secrets1.19.51 of 1See more

vault-gcp-secrets vault-gcp-secrets 1.19.5

1 of the 1 container images this version deploys carry CVE-2026-44503.

Container imageDigestPackageFixed in
ghcr.io/tjm/vault-gcp-secrets:v1.19.59f157fe035f1
github.com/microsoft/kiota-http-go@v1.5.2
1.5.5

Open the chart page →

2,289
amorphieamorphie0.1.21 of 18See more

amorphie amorphie 0.1.2

1 of the 18 container images this version deploys carry CVE-2026-44503.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.26b4e5dadf082
github.com/microsoft/kiota-http-go@v1.1.0
1.5.5

Open the chart page →

28,131
azure-app-exporterazure-app-exporterVerified publisher0.4.21 of 2See more

azure-app-exporter azure-app-exporter 0.4.2

1 of the 2 container images this version deploys carry CVE-2026-44503.

Container imageDigestPackageFixed in
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter:0.1.38b472877847f5
microsoft-kiota-http@1.3.2
1.9.9

Open the chart page →

1,790
firehoseblip-firehoseVerified publisher0.0.181 of 11See more

firehose blip-firehose 0.0.18

1 of the 11 container images this version deploys carry CVE-2026-44503.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.26b4e5dadf082
github.com/microsoft/kiota-http-go@v1.1.0
1.5.5

Open the chart page →

13,459
bluerange-serverbluerangeOfficialVerified publisher1.3.11 of 1See more

bluerange-server bluerange 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-44503.

Container imageDigestPackageFixed in
bluerange/bluerange:26.1.307c8f73b55df
microsoft-kiota-abstractions@1.8.4
1.9.1

Open the chart page →

1,816
ms-emails-grpccodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-emails-grpc codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-44503.

Container imageDigestPackageFixed in
codedesignplus/ms-emails-grpc:lateste336012bc781
Microsoft.Kiota.Abstractions@1.17.1
1.22.0

Open the chart page →

9,367
ms-emails-restcodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-emails-rest codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-44503.

Container imageDigestPackageFixed in
codedesignplus/ms-emails-rest:latestac84661c605e
Microsoft.Kiota.Abstractions@1.17.1
1.22.0

Open the chart page →

9,367
ms-emails-workercodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-emails-worker codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-44503.

Container imageDigestPackageFixed in
codedesignplus/ms-emails-worker:latest48fe7e6ceaba
Microsoft.Kiota.Abstractions@1.17.1
1.22.0

Open the chart page →

247
ms-microsoftgraph-restcodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-microsoftgraph-rest codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-44503.

Container imageDigestPackageFixed in
codedesignplus/ms-microsoftgraph-rest:latestc314db2706e5
Microsoft.Kiota.Abstractions@1.17.1
1.22.0

Open the chart page →

247
ms-microsoftgraph-workercodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-microsoftgraph-worker codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-44503.

Container imageDigestPackageFixed in
codedesignplus/ms-microsoftgraph-worker:latestc3568b61d762
Microsoft.Kiota.Abstractions@1.17.1
1.22.0

Open the chart page →

247
ConvertServiceWeb-Helm-Buildconvertserviceweb-helm-build0.1.11 of 7See more

ConvertServiceWeb-Helm-Build convertserviceweb-helm-build 0.1.1

1 of the 7 container images this version deploys carry CVE-2026-44503.

Container imageDigestPackageFixed in
aidasi/swpidentity:v1-1-net6-k8s-test-betad433285c7d5a
Microsoft.Kiota.Abstractions@1.1.0
1.22.0

Open the chart page →

10,091
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-44503.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
microsoft-kiota-http@1.9.7
1.9.9

Open the chart page →

8,923
authentikkagiso-me0.1.11 of 1See more

authentik kagiso-me 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-44503.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
microsoft-kiota-http@1.9.8
1.9.9

Open the chart page →

4,568
vaultkubeblocksVerified publisher0.30.01 of 2See more

vault kubeblocks 0.30.0

1 of the 2 container images this version deploys carry CVE-2026-44503.

Container imageDigestPackageFixed in
hashicorp/vault:1.19.0bbb7f98dc67d
github.com/microsoft/kiota-http-go@v1.4.4
1.5.5

Open the chart page →

2,742
kb-cloud-installeropenshift2.1.351 of 1See more

kb-cloud-installer openshift 2.1.35

1 of the 1 container images this version deploys carry CVE-2026-44503.

Container imageDigestPackageFixed in
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
github.com/microsoft/kiota-http-go@v1.5.2
1.5.5

Open the chart page →

4,127
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-44503.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
microsoft-kiota-http@1.3.3
1.9.9

Open the chart page →

21,211
retail-store-sample-ui-chartstacksimplifyVerified publisher1.0.01 of 1See more

retail-store-sample-ui-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-44503.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-ui:1.3.0ce3f2e935eb3
microsoft-kiota-abstractions@1.8.10
1.9.1

Open the chart page →

836
azure-resourcemanager-exporterwebdevopsVerified publisher1.3.61 of 1See more

azure-resourcemanager-exporter webdevops 1.3.6

1 of the 1 container images this version deploys carry CVE-2026-44503.

Container imageDigestPackageFixed in
webdevops/azure-resourcemanager-exporter:26.1.0d3e1842ad419
github.com/microsoft/kiota-http-go@v1.5.4
1.5.5

Open the chart page →

536
wexa-studiowexa-studio1.2.01 of 15See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2026-44503.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.40b01ed3924e6
github.com/microsoft/kiota-http-go@v1.1.0
1.5.5

Open the chart page →

14,983

Container images carrying it

18 by charts deploying them

A fixed version is listed for 4 of the 4 affected packages.

Container imageDigestPackageFixed inUsed by
hashicorp/vault:1.15.26b4e5dadf082
github.com/microsoft/kiota-http-go@v1.1.0
1.5.5
2
aidasi/swpidentity:v1-1-net6-k8s-test-betad433285c7d5a
Microsoft.Kiota.Abstractions@1.1.0
1.22.0
1
apache/airflow:2.10.2-python3.9ce90bdc3d2af
microsoft-kiota-http@1.3.3
1.9.9
1
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
github.com/microsoft/kiota-http-go@v1.5.2
1.5.5
1
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
microsoft-kiota-http@1.9.7
1.9.9
1
bluerange/bluerange:26.1.307c8f73b55df
microsoft-kiota-abstractions@1.8.4
1.9.1
1
codedesignplus/ms-emails-grpc:lateste336012bc781
Microsoft.Kiota.Abstractions@1.17.1
1.22.0
1
codedesignplus/ms-emails-rest:latestac84661c605e
Microsoft.Kiota.Abstractions@1.17.1
1.22.0
1
codedesignplus/ms-emails-worker:latest48fe7e6ceaba
Microsoft.Kiota.Abstractions@1.17.1
1.22.0
1
codedesignplus/ms-microsoftgraph-rest:latestc314db2706e5
Microsoft.Kiota.Abstractions@1.17.1
1.22.0
1
codedesignplus/ms-microsoftgraph-worker:latestc3568b61d762
Microsoft.Kiota.Abstractions@1.17.1
1.22.0
1
hashicorp/vault:1.15.40b01ed3924e6
github.com/microsoft/kiota-http-go@v1.1.0
1.5.5
1
hashicorp/vault:1.19.0bbb7f98dc67d
github.com/microsoft/kiota-http-go@v1.4.4
1.5.5
1
webdevops/azure-resourcemanager-exporter:26.1.0d3e1842ad419
github.com/microsoft/kiota-http-go@v1.5.4
1.5.5
1
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter:0.1.38b472877847f5
microsoft-kiota-http@1.3.2
1.9.9
1
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
microsoft-kiota-http@1.9.8
1.9.9
1
ghcr.io/tjm/vault-gcp-secrets:v1.19.59f157fe035f1
github.com/microsoft/kiota-http-go@v1.5.2
1.5.5
1
public.ecr.aws/aws-containers/retail-store-sample-ui:1.3.0ce3f2e935eb3
microsoft-kiota-abstractions@1.8.10
1.9.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.