StackRadarChart IndexLive demo

CVE-2026-48526

High

Advisory

Published 28 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.4; base score, highest
EPSS: 0.004; 33rd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 262; of 17,781 indexed, latest versions
Container images: 255; deployed by those charts
Fix available: 1 of 2; affected packages

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

Carried by container images the latest versions of 262 of 17,781 indexed charts deploy, on 255 images.

Affected package	Affected versions	Fixed in	Images
pyjwtpypi	1.4.2, 1.5.3, 1.6.1, 1.6.4+16 more	2.13.0	254
pyjwtdeb	1.7.1-2ubuntu2.1, 2.3.0-1, 2.3.0-1ubuntu0.2, 2.3.0-1ubuntu0.3+5 more	no fix listed	37

OSV records: DEBIAN-CVE-2026-48526 GHSA-xgmm-8j9v-c9wx UBUNTU-CVE-2026-48526
Also known as: PYSEC-2026-179

Charts affected

262 by stars

Chart

Latest

Affected images

Radar Score

the0the0

1 of 9 See more

the0 the0 0.9.8

1 of the 9 container images this version deploys carry CVE-2026-48526.

Container image	Digest	Package	Fixed in
ghcr.io/alexanderwanyoike/the0/runtime :1.14.7	459010a02aff	pyjwt@2.7.0-1ubuntu0.1 pyjwt@2.7.0	no fix listed 2.13.0

Open the chart page →

7,248

jupyterhubuninettsigma2

1 of 5 See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2026-48526.

Container image	Digest	Package	Fixed in
quay.io/nird-toolkit/jupyterhub-server :20221215-e6aa80e	cae8c0622533	pyjwt@2.4.0	2.13.0

Open the chart page →

8,607

opencloudunxwares

1 of 13 See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-48526.

Container image	Digest	Package	Fixed in
apache/tika :2.9.2.1-full	ae0b86d3c4d0	pyjwt@2.7.0-1 pyjwt@2.7.0	no fix listed 2.13.0

Open the chart page →

45,239

simple-prima-notavcnngr

1 of 4 See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-48526.

Container image	Digest	Package	Fixed in
dpage/pgadmin4 :9.2	52cb72a9e3da	pyjwt@2.10.1	2.13.0

Open the chart page →

4,768

browserlessvictorlane

1 of 1 See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-48526.

Container image	Digest	Package	Fixed in
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	pyjwt@2.7.0-1 pyjwt@2.7.0	no fix listed 2.13.0

Open the chart page →

4,305

twenty-crmvictorlane

1 of 3 See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-48526.

Container image	Digest	Package	Fixed in
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	pyjwt@2.3.0-1ubuntu0.2 pyjwt@2.3.0	no fix listed 2.13.0

Open the chart page →

13,459

wazuhwazuh-helm-eks

1 of 6 See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-48526.

Container image	Digest	Package	Fixed in
wazuh/wazuh-manager :4.14.4	5a065930682d	pyjwt@2.10.1	2.13.0

Open the chart page →

5,484

supersetwbstack

1 of 1 See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48526.

Container image	Digest	Package	Fixed in
apache/superset :4.0.1	ab9467fd712c	pyjwt@2.4.0	2.13.0

Open the chart page →

7,085

juicefs-csi-driverwenerme

1 of 5 See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-48526.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.32.5	95008ba63318	pyjwt@2.6.0-1+deb12u1 pyjwt@2.6.0	no fix listed 2.13.0

Open the chart page →

9,117

ceph-csi-cephfswikimedia

1 of 5 See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2026-48526.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	pyjwt@1.6.1	2.13.0

Open the chart page →

10,285

ceph-csi-rbdwikimedia

1 of 6 See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2026-48526.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	pyjwt@1.6.1	2.13.0

Open the chart page →

11,784

zoo-project-druzoo-project

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-48526.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	pyjwt@2.3.0-1ubuntu0.3	no fix listed

Open the chart page →

7,849

Container images carrying it

255 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/stackgres/operator :1.19.1	f241b0b20326	pyjwt@2.9.0	2.13.0	1
registry.gitlab.com/crafty-controller/crafty-4 :latest	166a06f73d8c	pyjwt@2.8.0	2.13.0	1
registry.gitlab.com/open-forms/forms-catalogue :latest	4eaf9c911f33	pyjwt@1.7.1	2.13.0	1
registry.gitlab.com/open-forms/request-registry :latest	0886cbbc5f95	pyjwt@1.7.1	2.13.0	1
registry.gitlab.com/xrow-public/helm-smtp/postfix :1.3.3	7eea4f0883dd	pyjwt@2.10.1	2.13.0	1