StackRadarChart IndexLive demo

CVE-2026-48523

Medium

Advisory

Published 28 May 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.4; base score, highest
EPSS: 0.001; 3rd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 115; of 17,781 indexed, latest versions
Container images: 117; deployed by those charts
Fix available: 1 of 2; affected packages

PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys

Carried by container images the latest versions of 115 of 17,781 indexed charts deploy, on 117 images.

Affected package	Affected versions	Fixed in	Images
pyjwtpypi	2.9.0, 2.10.1, 2.11.0, 2.12.0+1 more	2.13.0	91
pyjwtdeb	1.7.1-2ubuntu2.1, 2.3.0-1, 2.3.0-1ubuntu0.2, 2.3.0-1ubuntu0.3+3 more	no fix listed	28

OSV records: GHSA-jq35-7prp-9v3f UBUNTU-CVE-2026-48523
Also known as: PYSEC-2026-176

Charts affected

115 by stars

Chart

Latest

Affected images

Radar Score

vrisingryuunosukeds3

1 of 1 See more

vrising ryuunosukeds3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48523.

Container image	Digest	Package	Fixed in
trueosiris/vrising :latest	9356f98ad561	pyjwt@2.3.0-1ubuntu0.3	no fix listed

Open the chart page →

7,295

pgadminsb-helm-charts

1 of 1 See more

pgadmin sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-48523.

Container image	Digest	Package	Fixed in
dpage/pgadmin4 :8.13	561c1f8f99f2	pyjwt@2.9.0	2.13.0

Open the chart page →

1,713

showroom-docs-mcpshowroom-docs-mcp

1 of 4 See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-48523.

Container image	Digest	Package	Fixed in
litellm/litellm-non_root :v1.82.3-stable	09b217802ded	pyjwt@2.12.0	2.13.0

Open the chart page →

5,201

smtpsmtp

1 of 1 See more

smtp smtp 1.3.3

1 of the 1 container images this version deploys carry CVE-2026-48523.

Container image	Digest	Package	Fixed in
registry.gitlab.com/xrow-public/helm-smtp/postfix :1.3.3	7eea4f0883dd	pyjwt@2.10.1	2.13.0

Open the chart page →

1,437

srebotsrebot

1 of 2 See more

srebot srebot 0.14.0

1 of the 2 container images this version deploys carry CVE-2026-48523.

Container image	Digest	Package	Fixed in
ghcr.io/shadrus/srebot :0.14.0	9b4415e937b2	pyjwt@2.11.0	2.13.0

Open the chart page →

1,542

artifactory-cleanupsubshell

1 of 1 See more

artifactory-cleanup subshell 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-48523.

Container image	Digest	Package	Fixed in
devopshq/artifactory-cleanup :1.0.18	30e093bffa91	pyjwt@2.10.1	2.13.0

Open the chart page →

2,534

substra-backendsubstra

1 of 7 See more

substra-backend substra 26.15.3

1 of the 7 container images this version deploys carry CVE-2026-48523.

Container image	Digest	Package	Fixed in
ghcr.io/substra/substra-backend :1.0.1	21967f54ec86	pyjwt@2.9.0	2.13.0

Open the chart page →

4,731

tarkatarka

1 of 4 See more

tarka tarka 0.4.1

1 of the 4 container images this version deploys carry CVE-2026-48523.

Container image	Digest	Package	Fixed in
ghcr.io/tarkyaio/tarka :0.4.1	e8d3f1512f06	pyjwt@2.12.1	2.13.0

Open the chart page →

1,556

the0the0

1 of 9 See more

the0 the0 0.9.8

1 of the 9 container images this version deploys carry CVE-2026-48523.

Container image	Digest	Package	Fixed in
ghcr.io/alexanderwanyoike/the0/runtime :1.14.7	459010a02aff	pyjwt@2.7.0-1ubuntu0.1	no fix listed

Open the chart page →

7,248

opencloudunxwares

1 of 13 See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-48523.

Container image	Digest	Package	Fixed in
apache/tika :2.9.2.1-full	ae0b86d3c4d0	pyjwt@2.7.0-1	no fix listed

Open the chart page →

45,239

simple-prima-notavcnngr

1 of 4 See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-48523.

Container image	Digest	Package	Fixed in
dpage/pgadmin4 :9.2	52cb72a9e3da	pyjwt@2.10.1	2.13.0

Open the chart page →

4,768

browserlessvictorlane

1 of 1 See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-48523.

Container image	Digest	Package	Fixed in
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	pyjwt@2.7.0-1	no fix listed

Open the chart page →

4,305

twenty-crmvictorlane

1 of 3 See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-48523.

Container image	Digest	Package	Fixed in
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	pyjwt@2.3.0-1ubuntu0.2	no fix listed

Open the chart page →

13,459

wazuhwazuh-helm-eks

1 of 6 See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-48523.

Container image	Digest	Package	Fixed in
wazuh/wazuh-manager :4.14.4	5a065930682d	pyjwt@2.10.1	2.13.0

Open the chart page →

5,484

zoo-project-druzoo-project

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-48523.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	pyjwt@2.3.0-1ubuntu0.3	no fix listed

Open the chart page →

7,849

Container images carrying it

117 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/paperless-ngx/paperless-ngx :2.20.14	b89f83345532	pyjwt@2.10.1	2.13.0	1
ghcr.io/porelli/firefox-sync :syncstorage-rs-mysql-0.18.2	7d244e514216	pyjwt@2.10.1	2.13.0	1
ghcr.io/shadrus/srebot :0.14.0	9b4415e937b2	pyjwt@2.11.0	2.13.0	1
ghcr.io/sissbruecker/linkding :1.45.0	61b2eb9eed8e	pyjwt@2.10.1	2.13.0	1
ghcr.io/substra/substra-backend :1.0.1	21967f54ec86	pyjwt@2.9.0	2.13.0	1
ghcr.io/tandoorrecipes/recipes :1.5.31	063eb446e298	pyjwt@2.10.1	2.13.0	1
ghcr.io/tarkyaio/tarka :0.4.1	e8d3f1512f06	pyjwt@2.12.1	2.13.0	1
ghcr.io/vinny1892/octantis :latest	45459c0910fc	pyjwt@2.12.1	2.13.0	1
public.ecr.aws/datadog/agent :7.73.0	f4925b15ce94	pyjwt@2.10.1	2.13.0	1
public.ecr.aws/outerbounds/metaflow_metadata_service :v2.4.13	f7567ce3419d	pyjwt@2.9.0	2.13.0	1
quay.io/galaxyproject/galaxy-min :26.1.1	2c324c9789f5	pyjwt@2.12.1	2.13.0	1
quay.io/hewlettpackardenterprise/squest :2.8.4	65694109877e	pyjwt@2.10.1	2.13.0	1
quay.io/jupyterhub/k8s-hub :4.3.5	113e372cf71b	pyjwt@2.12.1	2.13.0	1
quay.io/jupyterhub/k8s-hub :4.3.4	92f883d09270	pyjwt@2.12.1	2.13.0	1
quay.io/ortelius/ms-validate-user :main-v10.0.1694-g98ed94	b5054bd4e97a	pyjwt@2.10.1	2.13.0	1
quay.io/stackgres/operator :1.19.1	f241b0b20326	pyjwt@2.9.0	2.13.0	1
registry.gitlab.com/xrow-public/helm-smtp/postfix :1.3.3	7eea4f0883dd	pyjwt@2.10.1	2.13.0	1