StackRadar

CVE-2026-45363

High

Advisory

Published 18 May 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.4
base score, highest
EPSS
0.002
15th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
20
of 17,781 indexed, latest versions
Container images
24
deployed by those charts
Fix available
1 of 1
affected package

ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351

Carried by container images the latest versions of 20 of 17,781 indexed charts deploy, on 24 images.

Affected packageAffected versionsFixed inImages
jwtgem1.5.6, 2.1.0, 2.2.1, 2.2.2+8 more2.10.3, 3.2.024
OSV records
GHSA-c32j-vqhx-rx3x

Charts affected

20 by stars
ChartLatestAffected imagesRadar Score
puppetserverpuppetserver9.5.21 of 5See more

puppetserver puppetserver 9.5.2

1 of the 5 container images this version deploys carry CVE-2026-45363.

Container imageDigestPackageFixed in
ghcr.io/voxpupuli/container-puppetserver:7.17.0-v1.5.0916746209ac5
jwt@2.7.1
2.10.3

Open the chart page →

14,184
kubernetes-loggingkubernetes-logging4.8.01 of 6See more

kubernetes-logging kubernetes-logging 4.8.0

1 of the 6 container images this version deploys carry CVE-2026-45363.

Container imageDigestPackageFixed in
opensearchproject/logstash-oss-with-opensearch-output-plugin:8.9.043b0cdaf26ed
jwt@2.7.1
2.10.3

Open the chart page →

10,530
uffizzi-appuffizzi-app1.3.01 of 14See more

uffizzi-app uffizzi-app 1.3.0

1 of the 14 container images this version deploys carry CVE-2026-45363.

Container imageDigestPackageFixed in
uffizzi/app:latest66e9e3937c60
jwt@2.8.1
2.10.3

Open the chart page →

19,337
huginnutkuozdemirVerified publisher2.2.11 of 4See more

huginn utkuozdemir 2.2.1

1 of the 4 container images this version deploys carry CVE-2026-45363.

Container imageDigestPackageFixed in
huginn/huginn-single-process:4d17829cf6b15b004ad3f4be196303dca4944810c794eddc7b47
jwt@1.5.6
2.10.3

Open the chart page →

18,137
mastodondefault-ghVerified publisher0.3.11 of 3See more

mastodon default-gh 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-45363.

Container imageDigestPackageFixed in
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
jwt@2.5.0
2.10.3

Open the chart page →

5,056
zammaddevplayer0Verified publisher4.0.51 of 4See more

zammad devplayer0 4.0.5

1 of the 4 container images this version deploys carry CVE-2026-45363.

Container imageDigestPackageFixed in
zammad/zammad-docker-compose:zammad-4.1.0-312808e2dfa810
jwt@2.2.2
2.10.3

Open the chart page →

6,110
opennebulakvaps2.1.15 of 9See more

opennebula kvaps 2.1.1

5 of the 9 container images this version deploys carry CVE-2026-45363.

Container imageDigestPackageFixed in
ghcr.io/kvaps/opennebula:v5.12.0.4-1e28e0e7de11b
jwt@2.2.1
2.10.3
ghcr.io/kvaps/opennebula-exporter:v5.12.0.401563adc95fd
jwt@2.2.1
2.10.3
ghcr.io/kvaps/opennebula-exporter:v5.12.0.4-12b92df1143b9
jwt@2.2.1
2.10.3
ghcr.io/kvaps/opennebula-flow:v5.12.0.4-1600221f0f43f
jwt@2.2.1
2.10.3
ghcr.io/kvaps/opennebula-gate:v5.12.0.4-1a85e03d8bc1d
jwt@2.2.1
2.10.3

Open the chart page →

113,791
chatwootmaxcrm-chartsVerified publisher1.1.2011 of 4See more

chatwoot maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-45363.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
jwt@2.7.0
2.10.3

Open the chart page →

5,940
logstashromanow-helm-chartsVerified publisher1.5.01 of 1See more

logstash romanow-helm-charts 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-45363.

Container imageDigestPackageFixed in
library/logstash:7.17.817a4f64e9cf5
jwt@2.3.0
2.10.3

Open the chart page →

7,529
ansible-inspecansible-inspec0.2.171 of 2See more

ansible-inspec ansible-inspec 0.2.17

1 of the 2 container images this version deploys carry CVE-2026-45363.

Container imageDigestPackageFixed in
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
jwt@2.10.1
2.10.3

Open the chart page →

5,558
antigenic-docuseal-helm-chartantigenic-docuseal-helm-chartVerified publisher0.2.01 of 1See more

antigenic-docuseal-helm-chart antigenic-docuseal-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-45363.

Container imageDigestPackageFixed in
docuseal/docuseal:2.4.17493fd7f6728
jwt@3.1.2
3.2.0

Open the chart page →

2,766
puppetservercamptocamp31.0.11 of 2See more

puppetserver camptocamp3 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-45363.

Container imageDigestPackageFixed in
ghcr.io/voxpupuli/puppetserver:8.7.0-main63873f3f698e
jwt@2.10.1
2.10.3

Open the chart page →

5,886
octoboxhalkeye0.1.11 of 1See more

octobox halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-45363.

Container imageDigestPackageFixed in
octoboxio/octobox:latestd909041c46eb
jwt@3.1.2
3.2.0

Open the chart page →

3,255
gitlabkubesphereVerified publisher4.2.33 of 17See more

gitlab kubesphere 4.2.3

3 of the 17 container images this version deploys carry CVE-2026-45363.

Container imageDigestPackageFixed in
mirrorgitlabcontainers/gitlab-sidekiq-ce:v13.2.294d1431683fa
jwt@2.1.0
2.10.3
mirrorgitlabcontainers/gitlab-task-runner-ce:v13.2.29efd73993c34
jwt@2.1.0
2.10.3
mirrorgitlabcontainers/gitlab-webservice-ce:v13.2.230393f990f5c
jwt@2.1.0
2.10.3

Open the chart page →

38,133
maxcrm-chartsmaxcrm-chartsVerified publisher1.1.2011 of 4See more

maxcrm-charts maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-45363.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
jwt@2.7.0
2.10.3

Open the chart page →

5,940
danboorumy0nVerified publisher0.0.21 of 1See more

danbooru my0n 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-45363.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
jwt@2.4.1
2.10.3

Open the chart page →

12,791
danbooru-stackmy0nVerified publisher0.0.31 of 4See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2026-45363.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
jwt@2.4.1
2.10.3

Open the chart page →

12,791
mastodonrivals-spaceVerified publisher3.1.21 of 3See more

mastodon rivals-space 3.1.2

1 of the 3 container images this version deploys carry CVE-2026-45363.

Container imageDigestPackageFixed in
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
jwt@2.5.0
2.10.3

Open the chart page →

6,026
fluentd-operatorstatcan0.5.11 of 1See more

fluentd-operator statcan 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-45363.

Container imageDigestPackageFixed in
vmware/kube-fluentd-operator:latestf028c138a5f4
jwt@2.7.1
2.10.3

Open the chart page →

1,955
maybe-financevicsuferVerified publisher0.2.71 of 3See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-45363.

Container imageDigestPackageFixed in
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
jwt@2.10.1
2.10.3

Open the chart page →

10,795

Container images carrying it

24 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
chatwoot/chatwoot:v3.1.0d530ab8c1753
jwt@2.7.0
2.10.3
2
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
jwt@2.4.1
2.10.3
2
docuseal/docuseal:2.4.17493fd7f6728
jwt@3.1.2
3.2.0
1
huginn/huginn-single-process:4d17829cf6b15b004ad3f4be196303dca4944810c794eddc7b47
jwt@1.5.6
2.10.3
1
library/logstash:7.17.817a4f64e9cf5
jwt@2.3.0
2.10.3
1
mirrorgitlabcontainers/gitlab-sidekiq-ce:v13.2.294d1431683fa
jwt@2.1.0
2.10.3
1
mirrorgitlabcontainers/gitlab-task-runner-ce:v13.2.29efd73993c34
jwt@2.1.0
2.10.3
1
mirrorgitlabcontainers/gitlab-webservice-ce:v13.2.230393f990f5c
jwt@2.1.0
2.10.3
1
octoboxio/octobox:latestd909041c46eb
jwt@3.1.2
3.2.0
1
opensearchproject/logstash-oss-with-opensearch-output-plugin:8.9.043b0cdaf26ed
jwt@2.7.1
2.10.3
1
uffizzi/app:latest66e9e3937c60
jwt@2.8.1
2.10.3
1
vmware/kube-fluentd-operator:latestf028c138a5f4
jwt@2.7.1
2.10.3
1
zammad/zammad-docker-compose:zammad-4.1.0-312808e2dfa810
jwt@2.2.2
2.10.3
1
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
jwt@2.10.1
2.10.3
1
ghcr.io/kvaps/opennebula:v5.12.0.4-1e28e0e7de11b
jwt@2.2.1
2.10.3
1
ghcr.io/kvaps/opennebula-exporter:v5.12.0.401563adc95fd
jwt@2.2.1
2.10.3
1
ghcr.io/kvaps/opennebula-exporter:v5.12.0.4-12b92df1143b9
jwt@2.2.1
2.10.3
1
ghcr.io/kvaps/opennebula-flow:v5.12.0.4-1600221f0f43f
jwt@2.2.1
2.10.3
1
ghcr.io/kvaps/opennebula-gate:v5.12.0.4-1a85e03d8bc1d
jwt@2.2.1
2.10.3
1
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
jwt@2.5.0
2.10.3
1
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
jwt@2.10.1
2.10.3
1
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
jwt@2.5.0
2.10.3
1
ghcr.io/voxpupuli/container-puppetserver:7.17.0-v1.5.0916746209ac5
jwt@2.7.1
2.10.3
1
ghcr.io/voxpupuli/puppetserver:8.7.0-main63873f3f698e
jwt@2.10.1
2.10.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.