StackRadar

CVE-2026-49265

Medium

Advisory

Published 29 Sept 2026In the index since 30 Sept 2026
Severity
Medium
worst across findings
CVSS
6.8
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
524
of 17,957 indexed, latest versions
Container images
471
deployed by those charts
Fix available
1 of 1
affected package

Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

Carried by container images the latest versions of 524 of 17,957 indexed charts deploy, on 471 images.

Affected packageAffected versionsFixed inImages
oauthlibpypi3.0.1, 3.0.2, 3.1.0, 3.1.1+4 more4.0.0471
OSV records
GHSA-xpv3-w29h-x7cv
Trending
Rank 25 in indexed charts, since 30 Sept 2026. See the ranking →

Charts affected

524 by stars
ChartLatestAffected imagesRadar Score
axosyslog-collectoraxosyslogVerified publisher0.8.11 of 1See more

axosyslog-collector axosyslog 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
ghcr.io/axoflow/axosyslog:4.5.0aa7831e207cd
oauthlib@3.2.2
4.0.0

Open the chart page →

1,539
azure-advanced-backupazure-advanced-backup0.4.11 of 1See more

azure-advanced-backup azure-advanced-backup 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
ghcr.io/dodevops/azure-advanced-backup:0.4.01041d4449e49
oauthlib@3.0.1
4.0.0

Open the chart page →

4,641
ambassadorazureorkestra6.7.91 of 2See more

ambassador azureorkestra 6.7.9

1 of the 2 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
datawire/aes:1.13.62beb65062c8b
oauthlib@3.1.0
4.0.0

Open the chart page →

5,620
pvc-exporterbalihb-pvc-exporterVerified publisher0.2.41 of 2See more

pvc-exporter balihb-pvc-exporter 0.2.4

1 of the 2 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
balihb/pod-pvc-mapping:0.2.4ee48e79f5d76
oauthlib@3.1.1
4.0.0

Open the chart page →

2,794
mealiebdclark-helm-chartsVerified publisher0.1.151 of 1See more

mealie bdclark-helm-charts 0.1.15

1 of the 1 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.25.16066c29eca95
oauthlib@3.3.1
4.0.0

Open the chart page →

4,622
nzbgetbdclark-helm-chartsVerified publisher0.1.171 of 1See more

nzbget bdclark-helm-charts 0.1.17

1 of the 1 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
linuxserver/nzbget:26.3.2026091124951ff9689d
oauthlib@3.3.1
4.0.0

Open the chart page →

27
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
oauthlib@3.2.2
4.0.0

Open the chart page →

10,708
bdbablackduck2026.9.01 of 9See more

bdba blackduck 2026.9.0

1 of the 9 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
blackducksoftware/bdba-frontend:2026.9.10afa8763ccb8
oauthlib@3.3.1
4.0.0

Open the chart page →

7,927
jenkinsbook-k8sinfra-v25.1.121 of 2See more

jenkins book-k8sinfra-v2 5.1.12

1 of the 2 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:1.26.2e271016441af
oauthlib@3.2.2
4.0.0

Open the chart page →

8,619
kube-prometheus-stackbook-k8sinfra-v265.5.11 of 6See more

kube-prometheus-stack book-k8sinfra-v2 65.5.1

1 of the 6 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:1.28.04166a019eeaf
oauthlib@3.2.2
4.0.0

Open the chart page →

6,165
sickchillbryanalves0.3.01 of 1See more

sickchill bryanalves 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
oauthlib@3.1.0
4.0.0

Open the chart page →

2,634
calibre-web-automatedcalibre-web-automated1.0.01 of 1See more

calibre-web-automated calibre-web-automated 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
crocodilestick/calibre-web-automated:v4.0.6c31a738b6d5e
oauthlib@3.3.1
4.0.0

Open the chart page →

6,904
prometheus-operatorcamptocamp35.15.11 of 5See more

prometheus-operator camptocamp3 5.15.1

1 of the 5 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:0.0.16899ccd0b1f54
oauthlib@3.0.1
4.0.0

Open the chart page →

2,551
tetragon-policy-buildercamptocamp30.1.11 of 1See more

tetragon-policy-builder camptocamp3 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
ghcr.io/camptocamp/tetragon-policy-builder:master0e99f12bb040
oauthlib@3.2.2
4.0.0

Open the chart page →

11,543
castai-hibernatecastaiVerified publisher0.2.121 of 1See more

castai-hibernate castai 0.2.12

1 of the 1 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
castai/hibernate:v0.14da62858c8381
oauthlib@3.3.1
4.0.0

Open the chart page →

1,364
catalyst-agentscatalyst-agents0.1.331 of 18See more

catalyst-agents catalyst-agents 0.1.33

1 of the 18 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:2.10.17eac5c4fed71
oauthlib@3.3.1
4.0.0

Open the chart page →

18,107
kube-ceemsceemsOfficialVerified publisher1.43.01 of 5See more

kube-ceems ceems 1.43.0

1 of the 5 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.11.22912be006f62
oauthlib@3.3.1
4.0.0

Open the chart page →

559
opencvecfi20170.1.21 of 7See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
ghcr.io/cfi2017/opencve-web:3.0.06961eab190a2
oauthlib@3.3.1
4.0.0

Open the chart page →

16,539
calibre-webcharts-derwitt-devVerified publisher1.1.31 of 1See more

calibre-web charts-derwitt-dev 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
ghcr.io/wittdennis/calibre-web:1.1.2953aa0935251
oauthlib@3.3.1
4.0.0

Open the chart page →

5,272
paperless-ngxcharts-derwitt-devVerified publisher2.1.51 of 1See more

paperless-ngx charts-derwitt-dev 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.2.15fa76604a81d
oauthlib@3.3.1
4.0.0

Open the chart page →

4,370
kube-ops-viewchristianhuthVerified publisher8.3.31 of 1See more

kube-ops-view christianhuth 8.3.3

1 of the 1 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
hjacobs/kube-ops-view:23.5.0a4fae38f93d7
oauthlib@3.2.2
4.0.0

Open the chart page →

1,254
kube-acp-stackcloudentity2.29.01 of 7See more

kube-acp-stack cloudentity 2.29.0

1 of the 7 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
oauthlib@3.2.0
4.0.0

Open the chart page →

21,883
prometheus-operatorcloudnativeapp6.4.01 of 7See more

prometheus-operator cloudnativeapp 6.4.0

1 of the 7 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:0.0.186eb52513d59e
oauthlib@3.0.2
4.0.0

Open the chart page →

3,013
sentry-kubernetescloudnativeapp0.2.01 of 1See more

sentry-kubernetes cloudnativeapp 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
getsentry/sentry-kubernetes:latest6ac37974fd2a
oauthlib@3.0.1
4.0.0

Open the chart page →

1,476
cp4d-deployercloud-native-toolkit1.0.01 of 1See more

cp4d-deployer cloud-native-toolkit 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
oauthlib@3.2.2
4.0.0

Open the chart page →

25,449
ibm-toolkit-installcloud-native-toolkit0.3.01 of 1See more

ibm-toolkit-install cloud-native-toolkit 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
oauthlib@3.2.0
4.0.0

Open the chart page →

6,793
iteration-zerocloud-native-toolkit0.2.01 of 1See more

iteration-zero cloud-native-toolkit 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
quay.io/cloudnativetoolkit/cli-tools:v1.1-v1.8.2d6fd2a9e3273
oauthlib@3.2.0
4.0.0

Open the chart page →

7,031
cloudlaunchcloudve0.6.01 of 5See more

cloudlaunch cloudve 0.6.0

1 of the 5 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
oauthlib@3.1.1
4.0.0

Open the chart page →

12,885
cloudlaunch-servercloudve0.2.01 of 5See more

cloudlaunch-server cloudve 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
oauthlib@3.1.1
4.0.0

Open the chart page →

12,444
cloudlaunchservercloudve0.6.01 of 4See more

cloudlaunchserver cloudve 0.6.0

1 of the 4 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
oauthlib@3.1.1
4.0.0

Open the chart page →

12,020
galaxycloudve6.8.81 of 3See more

galaxy cloudve 6.8.8

1 of the 3 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
oauthlib@3.3.1
4.0.0

Open the chart page →

6,006
galaxykubemancloudve2.10.11 of 7See more

galaxykubeman cloudve 2.10.1

1 of the 7 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
galaxy/cloudman-server:lateste5c265fe9fcd
oauthlib@3.2.1
4.0.0

Open the chart page →

16,579
authentikcluster-deploy0.2.01 of 1See more

authentik cluster-deploy 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
oauthlib@3.3.1
4.0.0

Open the chart page →

2,886
metaflowcluster-deploy0.2.21 of 1See more

metaflow cluster-deploy 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
oauthlib@3.2.2
4.0.0

Open the chart page →

8,557
monitoringcluster-deploy0.3.01 of 11See more

monitoring cluster-deploy 0.3.0

1 of the 11 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
oauthlib@3.3.1
4.0.0

Open the chart page →

8,404
clusterfactoryclusterfactory0.2.01 of 5See more

clusterfactory clusterfactory 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
oauthlib@3.3.1
4.0.0

Open the chart page →

7,603
gitea-jenkinsclusterfactory0.1.11 of 5See more

gitea-jenkins clusterfactory 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
oauthlib@3.3.1
4.0.0

Open the chart page →

7,377
codehubcodehubVerified publisher6.2.181 of 5See more

codehub codehub 6.2.18

1 of the 5 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
jupyterhub/jupyterhub:5.4.63974ba945e65
oauthlib@3.3.1
4.0.0

Open the chart page →

14,240
loki-stackcommon-chartsVerified publisher1.0.32 of 12See more

loki-stack common-charts 1.0.3

2 of the 12 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.10.021b9fe7bb29d
oauthlib@3.3.1
4.0.0
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
oauthlib@3.3.1
4.0.0

Open the chart page →

5,794
opencloudcommunity-opencloud3.1.01 of 13See more

opencloud community-opencloud 3.1.0

1 of the 13 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
apache/tika:latest-full80072bb73dd3
oauthlib@3.3.1
4.0.0

Open the chart page →

10,169
couchbase-monitor-stackcouchbaseVerified publisher2.1.21 of 5See more

couchbase-monitor-stack couchbase 2.1.2

1 of the 5 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:1.12.3eabdae16a5cc
oauthlib@3.1.1
4.0.0

Open the chart page →

7,015
kfservingcowboysysopVerified publisher1.3.11 of 3See more

kfserving cowboysysop 1.3.1

1 of the 3 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
kfserving/models-web-app:v0.6.1f322d6ffdfa3
oauthlib@3.1.1
4.0.0

Open the chart page →

3,864
csghubcsghubVerified publisher2.5.02 of 34See more

csghub csghub 2.5.0

2 of the 34 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:1.30.2cdb361e67b1b
oauthlib@3.2.2
4.0.0
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
oauthlib@3.3.1
4.0.0

Open the chart page →

52,989
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
oauthlib@3.2.2
4.0.0

Open the chart page →

12,572
jupyterhubd4nVerified publisher3.3.72 of 7See more

jupyterhub d4n 3.3.7

2 of the 7 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
aristidetm/basic-notebook:3.6.5469dbc951224
oauthlib@3.2.2
4.0.0
aristidetm/k8s-hub:3.3.7ccb516cb8474
oauthlib@3.2.2
4.0.0

Open the chart page →

17,520
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
oauthlib@3.2.2
4.0.0

Open the chart page →

6,443
dapr-agentsdapr-agents-devVerified publisher0.1.52 of 31See more

dapr-agents dapr-agents-dev 0.1.5

2 of the 31 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:1.30.98c06e1ba643a
oauthlib@3.3.1
4.0.0
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
oauthlib@3.3.1
4.0.0

Open the chart page →

23,432
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
oauthlib@3.2.2
4.0.0

Open the chart page →

5,533
datagrokdatagrok1.0.31 of 7See more

datagrok datagrok 1.0.3

1 of the 7 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
datagrok/grok_spawner:latest8c2d48c1545c
oauthlib@3.3.1
4.0.0

Open the chart page →

2,512
mlflowdeliveryheroVerified publisher1.0.101 of 1See more

mlflow deliveryhero 1.0.10

1 of the 1 container images this version deploys carry CVE-2026-49265.

Container imageDigestPackageFixed in
larribas/mlflow:1.9.105ccb0b46bfb
oauthlib@3.1.0
4.0.0

Open the chart page →

4,535

Container images carrying it

471 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/kiali/kiali-operator:v2.32.096c5264d54ab
oauthlib@3.2.2
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:1.10.718feb3906286
oauthlib@3.1.0
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:1.15.61f025ae37b7b
oauthlib@3.2.0
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:2.10.021b9fe7bb29d
oauthlib@3.3.1
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:1.30.349dcce269568
oauthlib@3.2.2
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:2.7.15bc0c5634d4a
oauthlib@3.3.1
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:2.7.3694950d736c8
oauthlib@3.3.1
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:1.21.0710e23b489c5
oauthlib@3.2.2
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:1.30.10835d79d8fbae
oauthlib@3.3.1
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:1.15.1a25886092fa4
oauthlib@3.1.1
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:2.6.0a6c101156d42
oauthlib@3.3.1
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:1.25.2cb4c638ffb1f
oauthlib@3.2.2
4.0.0
1
quay.io/kiwigrid/k8s-sidecar:1.12.3eabdae16a5cc
oauthlib@3.1.1
4.0.0
1
quay.io/kubev2v/forklift-operator:release-2.1200312252b07e
oauthlib@3.3.1
4.0.0
1
quay.io/maxiv/storageclass-router:0.4.160725dab588c
oauthlib@3.2.2
4.0.0
1
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
oauthlib@3.2.0
4.0.0
1
quay.io/ocellusai/operator:v0.10.59ff01f642e2b
oauthlib@3.3.1
4.0.0
1
quay.io/opstree/k8s-sidecar:2.7.126aa9bb3386b
oauthlib@3.3.1
4.0.0
1
quay.io/opstree/k8s-sidecar:2.7.37075d455b219
oauthlib@3.3.1
4.0.0
1
quay.io/stackgres/operator:1.19.282f33ab3fb1e
oauthlib@3.3.1
4.0.0
1
registry.gitlab.com/dyff/dyff-orchestrator:0.22.199bd5d93aaff7
oauthlib@3.3.1
4.0.0
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.