StackRadar

CVE-2026-49264

Medium

Advisory

Published 29 Sept 2026In the index since 30 Sept 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
549
of 17,957 indexed, latest versions
Container images
492
deployed by those charts
Fix available
1 of 1
affected package

Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Carried by container images the latest versions of 549 of 17,957 indexed charts deploy, on 492 images.

Affected packageAffected versionsFixed inImages
oauthlibpypi2.0.1, 2.0.7, 2.1.0, 3.0.1+7 more4.0.0492
OSV records
GHSA-hj66-6f7g-4r5v
Trending
Rank 28 in indexed charts, since 30 Sept 2026. See the ranking →

Charts affected

549 by stars
ChartLatestAffected imagesRadar Score
sdnc-promsmo-helm-chart6.0.01 of 2See more

sdnc-prom smo-helm-chart 6.0.0

1 of the 2 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.2875814cc853d
oauthlib@3.0.1
4.0.0

Open the chart page →

85,362
sdnc-websmo-helm-chart6.0.01 of 3See more

sdnc-web smo-helm-chart 6.0.0

1 of the 3 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.2875814cc853d
oauthlib@3.0.1
4.0.0

Open the chart page →

85,362
ueb-listenersmo-helm-chart6.0.01 of 3See more

ueb-listener smo-helm-chart 6.0.0

1 of the 3 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.2875814cc853d
oauthlib@3.0.1
4.0.0

Open the chart page →

86,389
tracing-stacksnubisks0.1.01 of 8See more

tracing-stack snubisks 0.1.0

1 of the 8 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.7.15bc0c5634d4a
oauthlib@3.3.1
4.0.0

Open the chart page →

5,819
cost-analyzersoftonic2.5.51 of 6See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
ghcr.io/kiwigrid/k8s-sidecar:1.29.142002d66ddb3
oauthlib@3.2.2
4.0.0

Open the chart page →

8,290
kube-prometheus-stacksoftonic81.5.11 of 6See more

kube-prometheus-stack softonic 81.5.1

1 of the 6 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
oauthlib@3.3.1
4.0.0

Open the chart page →

5,129
servicexssl-hep1.8.62 of 16See more

servicex ssl-hep 1.8.6

2 of the 16 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
sslhep/servicex_app:v1.8.6c935e123030d
oauthlib@3.3.1
4.0.0
sslhep/x509-secrets:v1.8.634e1c87cea8a
oauthlib@3.2.2
4.0.0

Open the chart page →

57,809
open-appsec-injectorstartechnicaVerified publisher1.1.21 of 3See more

open-appsec-injector startechnica 1.1.2

1 of the 3 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
ghcr.io/openappsec/openappsec-waf-webhook:1.1.345b979b962043
oauthlib@3.3.1
4.0.0

Open the chart page →

4,562
cost-analyzerstatcan1.82.21 of 9See more

cost-analyzer statcan 1.82.2

1 of the 9 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:1.12.089739be9ff38
oauthlib@3.1.0
4.0.0

Open the chart page →

16,586
prometheus-operatorstatcan0.2.21 of 7See more

prometheus-operator statcan 0.2.2

1 of the 7 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:0.1.1517b98eecdf6d1
oauthlib@3.1.0
4.0.0

Open the chart page →

12,275
storageclass-routerstorageclass-routerVerified publisher0.4.11 of 1See more

storageclass-router storageclass-router 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
quay.io/maxiv/storageclass-router:0.4.160725dab588c
oauthlib@3.2.2
4.0.0

Open the chart page →

1,081
substra-backendsubstraVerified publisher26.15.31 of 7See more

substra-backend substra 26.15.3

1 of the 7 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
ghcr.io/substra/substra-backend:1.0.121967f54ec86
oauthlib@3.2.2
4.0.0

Open the chart page →

4,782
uptime-kumasupporttools2.6.01 of 3See more

uptime-kuma supporttools 2.6.0

1 of the 3 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
supporttools/uptime-kuma:v2.6f8a49ed65809
oauthlib@2.1.0
4.0.0

Open the chart page →

4,465
tarkatarkaOfficialVerified publisher0.4.11 of 4See more

tarka tarka 0.4.1

1 of the 4 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
ghcr.io/tarkyaio/tarka:0.4.1e8d3f1512f06
oauthlib@3.3.1
4.0.0

Open the chart page →

3,446
chatqnatest-opea1.0.01 of 11See more

chatqna test-opea 1.0.0

1 of the 11 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
opea/chatqna:1.038c51b791efa
oauthlib@3.2.2
4.0.0

Open the chart page →

41,947
codegentest-opea1.0.01 of 5See more

codegen test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
opea/codegen:1.058f91683892d
oauthlib@3.2.2
4.0.0

Open the chart page →

30,663
codetranstest-opea1.0.01 of 5See more

codetrans test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
opea/codetrans:1.0e2436483b73d
oauthlib@3.2.2
4.0.0

Open the chart page →

30,231
docsumtest-opea1.0.01 of 5See more

docsum test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
opea/docsum:1.03eaa91849512
oauthlib@3.2.2
4.0.0

Open the chart page →

30,712
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
oauthlib@3.2.2
4.0.0

Open the chart page →

5,774
the0the0Verified publisher0.9.101 of 9See more

the0 the0 0.9.10

1 of the 9 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
ghcr.io/alexanderwanyoike/the0/runtime:1.14.9e301fbb8fae0
oauthlib@3.2.2
4.0.0

Open the chart page →

5,769
monitoringthl-chartsVerified publisher0.1.11 of 10See more

monitoring thl-charts 0.1.1

1 of the 10 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:1.15.61f025ae37b7b
oauthlib@3.2.0
4.0.0

Open the chart page →

18,985
jenkinstnh2.7.11 of 2See more

jenkins tnh 2.7.1

1 of the 2 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:0.1.193170069ff0976
oauthlib@3.1.0
4.0.0

Open the chart page →

4,738
traefik-external-dns-controllertraefik-external-dns-operator2.2.01 of 1See more

traefik-external-dns-controller traefik-external-dns-operator 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
ybucci/traefik-external-dns-controller:2.2.08d27ad8b5f73
oauthlib@3.3.1
4.0.0

Open the chart page →

1,676
traefik-external-dns-operatortraefik-external-dns-operator1.0.11 of 1See more

traefik-external-dns-operator traefik-external-dns-operator 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
ybucci/traefik-external-dns-operator:1.0.0f1fcc7c8d9fd
oauthlib@3.2.2
4.0.0

Open the chart page →

1,317
tfy-grafanatruefoundryVerified publisher0.1.211 of 3See more

tfy-grafana truefoundry 0.1.21

1 of the 3 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.1.2716b0b33ff2d
oauthlib@3.3.1
4.0.0

Open the chart page →

1,151
truefoundry-monitoringtruefoundryVerified publisher0.1.61 of 8See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.1.2716b0b33ff2d
oauthlib@3.3.1
4.0.0

Open the chart page →

4,732
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
oauthlib@3.2.0
4.0.0

Open the chart page →

9,013
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
apache/tika:2.9.2.1-fullae0b86d3c4d0
oauthlib@3.2.2
4.0.0

Open the chart page →

46,735
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
dpage/pgadmin4:9.252cb72a9e3da
oauthlib@3.2.2
4.0.0

Open the chart page →

5,256
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
oauthlib@3.2.2
4.0.0

Open the chart page →

4,954
twenty-crmvictorlane0.0.11 of 3See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
twentycrm/twenty-postgres-spilo:latest2f78405a78be
oauthlib@3.2.0
4.0.0

Open the chart page →

74,963
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
oauthlib@3.3.1
4.0.0

Open the chart page →

8,381
waldur-site-agentwaldur-site-agentVerified publisher1.0.71 of 1See more

waldur-site-agent waldur-site-agent 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
opennode/waldur-site-agent:1.0.76d2e3b97c8d2
oauthlib@3.3.1
4.0.0

Open the chart page →

591
wasabi-s3-operatorwasabi-s3-operatorVerified publisher0.2.71 of 1See more

wasabi-s3-operator wasabi-s3-operator 0.2.7

1 of the 1 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
kenchrcum/wasabi-s3-operator:0.2.7ce657c622ce5
oauthlib@3.3.1
4.0.0

Open the chart page →

689
ambassadorwener6.9.51 of 2See more

ambassador wener 6.9.5

1 of the 2 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
oauthlib@3.1.0
4.0.0

Open the chart page →

4,185
juicefs-csi-driverwener0.33.01 of 5See more

juicefs-csi-driver wener 0.33.0

1 of the 5 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.33.0f918e7331c05
oauthlib@3.2.2
4.0.0

Open the chart page →

9,591
kube-prometheus-stackwener91.8.21 of 6See more

kube-prometheus-stack wener 91.8.2

1 of the 6 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.11.22912be006f62
oauthlib@3.3.1
4.0.0

Open the chart page →

357
victoria-metrics-k8s-stackwener0.95.01 of 7See more

victoria-metrics-k8s-stack wener 0.95.0

1 of the 7 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.11.22912be006f62
oauthlib@3.3.1
4.0.0

Open the chart page →

788
ambassadorwenerme6.9.51 of 2See more

ambassador wenerme 6.9.5

1 of the 2 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
oauthlib@3.1.0
4.0.0

Open the chart page →

4,185
juicefs-csi-driverwenerme0.33.01 of 5See more

juicefs-csi-driver wenerme 0.33.0

1 of the 5 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.33.0f918e7331c05
oauthlib@3.2.2
4.0.0

Open the chart page →

9,591
victoria-metrics-k8s-stackwenerme0.95.01 of 7See more

victoria-metrics-k8s-stack wenerme 0.95.0

1 of the 7 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.11.22912be006f62
oauthlib@3.3.1
4.0.0

Open the chart page →

788
ceph-csi-cephfswikimedia0.2.01 of 5See more

ceph-csi-cephfs wikimedia 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.14.2dc4bbac6efe1
oauthlib@3.1.1
4.0.0

Open the chart page →

4,205
ceph-csi-rbdwikimedia0.2.01 of 6See more

ceph-csi-rbd wikimedia 0.2.0

1 of the 6 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.14.2dc4bbac6efe1
oauthlib@3.1.1
4.0.0

Open the chart page →

4,782
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
hamzaarshad10/querybackend:1.6.22c1c3b86a8e7
oauthlib@3.2.2
4.0.0

Open the chart page →

14,050
kadalu-operatorxxl-job-adminVerified publisher1.2.41 of 4See more

kadalu-operator xxl-job-admin 1.2.4

1 of the 4 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
kadalu/kadalu-operator:1.2.03726d7a805f2
oauthlib@3.2.2
4.0.0

Open the chart page →

4,991
enterprise-gatewayzeet3.2.21 of 2See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
elyra/kernel-image-puller:3.2.2c922f1f1646a
oauthlib@3.2.2
4.0.0

Open the chart page →

2,242
changedetection-iozekker6Verified publisher1.102.01 of 1See more

changedetection-io zekker6 1.102.0

1 of the 1 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.7096dae27b5d6
oauthlib@3.3.1
4.0.0

Open the chart page →

2,916
zerossl-cert-managerzerossl-cert-manager0.1.01 of 2See more

zerossl-cert-manager zerossl-cert-manager 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
andreymileshin/zerossl-issuer:v1.0.0e0825acc9e48
oauthlib@3.2.2
4.0.0

Open the chart page →

597
zoo-project-druzoo-projectOfficialVerified publisher0.10.41 of 6See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-49264.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a9a507cb7e2dd
oauthlib@3.3.1
4.0.0

Open the chart page →

8,586

Container images carrying it

492 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
oauthlib@2.1.0
4.0.0
1
public.ecr.aws/datadog/agent:7.73.0f4925b15ce94
oauthlib@3.3.1
4.0.0
1
public.ecr.aws/k6v9y5g3/cluster-agent:master.57536d051110158
oauthlib@3.2.2
4.0.0
1
public.ecr.aws/k6v9y5g3/cluster-agent:cost_k8s_process.5769e14a72b066d
oauthlib@3.2.2
4.0.0
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
oauthlib@3.2.2
4.0.0
1
quay.io/ansible/awx-operator:2.19.17302e0c8e5a7
oauthlib@3.2.2
4.0.0
1
quay.io/ceph/ceph:v21.1.05ff3692d2f3f
oauthlib@3.2.2
4.0.0
1
quay.io/cephcsi/cephcsi:v3.5.128a674af1df2
oauthlib@2.1.0
4.0.0
1
quay.io/cloudnativetoolkit/cli-tools:v1.1-v1.8.2d6fd2a9e3273
oauthlib@3.2.0
4.0.0
1
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
oauthlib@3.2.2
4.0.0
1
quay.io/clustersecret/clustersecret:0.0.14a9f835d1b241
oauthlib@3.2.2
4.0.0
1
quay.io/evl.ms/argocd-exporter:0.0.136ea8f34aa6b
oauthlib@3.1.1
4.0.0
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
oauthlib@3.3.1
4.0.0
1
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
oauthlib@3.2.2
4.0.0
1
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
oauthlib@3.2.0
4.0.0
1
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
oauthlib@3.3.1
4.0.0
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
oauthlib@3.3.1
4.0.0
1
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
oauthlib@3.2.2
4.0.0
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
oauthlib@3.3.1
4.0.0
1
quay.io/jupyterhub/k8s-singleuser-sample:4.4.265e1b09fc8c9
oauthlib@3.3.1
4.0.0
1
quay.io/k3rnel-pan1c/uptime-kuma:1.19.3f975fde9329b
oauthlib@3.1.0
4.0.0
1
quay.io/kiali/kiali-operator:v2.32.096c5264d54ab
oauthlib@3.2.2
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:1.10.718feb3906286
oauthlib@3.1.0
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:1.15.61f025ae37b7b
oauthlib@3.2.0
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:2.10.021b9fe7bb29d
oauthlib@3.3.1
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:1.30.349dcce269568
oauthlib@3.2.2
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:2.7.15bc0c5634d4a
oauthlib@3.3.1
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:2.7.3694950d736c8
oauthlib@3.3.1
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:1.21.0710e23b489c5
oauthlib@3.2.2
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:1.30.10835d79d8fbae
oauthlib@3.3.1
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:1.15.1a25886092fa4
oauthlib@3.1.1
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:2.6.0a6c101156d42
oauthlib@3.3.1
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:1.25.2cb4c638ffb1f
oauthlib@3.2.2
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:1.12.3eabdae16a5cc
oauthlib@3.1.1
4.0.0
1
quay.io/kubev2v/forklift-operator:release-2.1200312252b07e
oauthlib@3.3.1
4.0.0
1
quay.io/maxiv/storageclass-router:0.4.160725dab588c
oauthlib@3.2.2
4.0.0
1
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
oauthlib@3.2.0
4.0.0
1
quay.io/ocellusai/operator:v0.10.59ff01f642e2b
oauthlib@3.3.1
4.0.0
1
quay.io/opstree/k8s-sidecar:2.7.126aa9bb3386b
oauthlib@3.3.1
4.0.0
1
quay.io/opstree/k8s-sidecar:2.7.37075d455b219
oauthlib@3.3.1
4.0.0
1
quay.io/stackgres/operator:1.19.282f33ab3fb1e
oauthlib@3.3.1
4.0.0
1
registry.gitlab.com/dyff/dyff-orchestrator:0.22.199bd5d93aaff7
oauthlib@3.3.1
4.0.0
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.