StackRadar

CVE-2026-5078

Medium

Advisory

Published 10 Jul 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.003
26th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
79
of 17,781 indexed, latest versions
Container images
80
deployed by those charts
Fix available
1 of 1
affected package

morgan vulnerable to Log Forging via unneutralized control characters in :remote-user

Carried by container images the latest versions of 79 of 17,781 indexed charts deploy, on 80 images.

Affected packageAffected versionsFixed inImages
morgannpm1.6.1, 1.7.0, 1.9.0, 1.9.1+2 more1.11.080
OSV records
GHSA-4vj7-5mj6-jm8m

Charts affected

79 by stars
ChartLatestAffected imagesRadar Score
hello-kubernetes-chartjhidalgo3-githubVerified publisher3.0.01 of 1See more

hello-kubernetes-chart jhidalgo3-github 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
jhidalgo3/hello-kubernetes:1.0.0.1397bf5ddfa8628d79f5
morgan@1.10.0
1.11.0

Open the chart page →

914
yapijoelee2012Verified publisher0.2.01 of 1See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
jayfong/yapi:1.10.2163e5d621910
morgan@1.6.1
1.11.0

Open the chart page →

6,454
zwave-js-uik8sonlabVerified publisher0.7.121 of 1See more

zwave-js-ui k8sonlab 0.7.12

1 of the 1 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
zwavejs/zwave-js-ui:11.22.314d018bb689e
morgan@1.10.1
1.11.0

Open the chart page →

973
keycloak-multi-client-notifierkeycloak-multi-client-notifier2.1.21 of 2See more

keycloak-multi-client-notifier keycloak-multi-client-notifier 2.1.2

1 of the 2 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
ghcr.io/blessingnator/keycloak-mcn-backend:2.0.5967470f05472
morgan@1.10.1
1.11.0

Open the chart page →

1,473
kubevious-agentkubevious1.0.41 of 1See more

kubevious-agent kubevious 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
kubevious/parser:1.0.151acf1a1f0b47
morgan@1.10.0
1.11.0

Open the chart page →

1,927
workload-operatorkubevious0.0.31 of 1See more

workload-operator kubevious 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
kubevious/workload-operator:1.0.20b0f4c507eb6
morgan@1.10.0
1.11.0

Open the chart page →

2,008
backstagemcwarmanVerified publisher0.10.101 of 2See more

backstage mcwarman 0.10.10

1 of the 2 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
morgan@1.10.0
1.11.0

Open the chart page →

9,668
littlelink-servermhamzahkhanVerified publisher1.0.01 of 1See more

littlelink-server mhamzahkhan 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
ghcr.io/techno-tim/littlelink-server:latest735a1fcd078b
morgan@1.10.0
1.11.0

Open the chart page →

887
mongodb-admin-interfacemongo-db-admin-interfaceVerified publisher0.1.01 of 2See more

mongodb-admin-interface mongo-db-admin-interface 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
library/mongo-express:latest1b23d7976f02
morgan@1.10.0
1.11.0

Open the chart page →

5,179
tianjimsgbyte0.1.171 of 2See more

tianji msgbyte 0.1.17

1 of the 2 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
moonrailgun/tianji:1.11.2b528c8f8fcc4
morgan@1.10.0
1.11.0

Open the chart page →

4,560
cloudcmdmy0nVerified publisher0.0.31 of 1See more

cloudcmd my0n 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
coderaiser/cloudcmd:16.6.1b34a9775c7ce
morgan@1.10.0
1.11.0

Open the chart page →

3,128
smilencsaVerified publisher1.1.02 of 23See more

smile ncsa 1.1.0

2 of the 23 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
socialmediamacroscope/smile_graphql:0.3.1c5095e94bc65
morgan@1.7.0
1.11.0
socialmediamacroscope/smile_server:0.3.31a528c794270
morgan@1.9.1
1.11.0

Open the chart page →

109,294
node-hostnamenode-hostnameVerified publisher1.0.11 of 1See more

node-hostname node-hostname 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
christianhuth/node-hostname:1.0.1c07f414a3e4b
morgan@1.9.1
1.11.0

Open the chart page →

884
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
linuxserver/codimd:latestb801bbcf6386
morgan@1.10.0
1.11.0

Open the chart page →

27,465
example-idpory0.64.01 of 1See more

example-idp ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
oryd/hydra-login-consent-node:v26.2.06465e95993b5
morgan@1.10.0
1.11.0

Open the chart page →

838
codimdphntom0.1.121 of 3See more

codimd phntom 0.1.12

1 of the 3 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
phntom/codimd:2.4.31b9aafbb62e6
morgan@1.9.1
1.11.0

Open the chart page →

6,524
claude-relayrevolution10.1.371 of 4See more

claude-relay revolution1 0.1.37

1 of the 4 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
morgan@1.10.1
1.11.0

Open the chart page →

4,600
jsonplaceholderrgnu1.0.01 of 1See more

jsonplaceholder rgnu 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
svenwal/jsonplaceholder:latestba2f285af432
morgan@1.10.0
1.11.0

Open the chart page →

1,547
gristrlex0.1.01 of 1See more

grist rlex 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
gristlabs/grist:0.7.96e71b1914a7e
morgan@1.9.1
1.11.0

Open the chart page →

5,215
samplesample0.1.01 of 2See more

sample sample 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
library/mongo-express:1.0.2-20-alpine3.191aae00775251
morgan@1.10.0
1.11.0

Open the chart page →

2,309
hedgedocschmitzis0.1.121 of 1See more

hedgedoc schmitzis 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
morgan@1.10.0
1.11.0

Open the chart page →

3,118
wekanschmitzis1.1.11 of 1See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
quay.io/wekan/wekan:v5.65cb17600883a3
morgan@1.6.1
1.11.0

Open the chart page →

3,638
fdi-dotstatsuite-dlmstatcan0.3.11 of 1See more

fdi-dotstatsuite-dlm statcan 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
morgan@1.10.0
1.11.0

Open the chart page →

3,881
tensorzerotensorzero2026.6.01 of 2See more

tensorzero tensorzero 2026.6.0

1 of the 2 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
tensorzero/ui:2026.6.0f2563d54724e
morgan@1.10.1
1.11.0

Open the chart page →

3,972
csmmth-chartsVerified publisher0.1.01 of 3See more

csmm th-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
catalysm/csmm:latestf003b35f54d9
morgan@1.10.0
1.11.0

Open the chart page →

3,576
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
vcnngr/pnbackend:latesteaf44ad0ad1f
morgan@1.10.1
1.11.0

Open the chart page →

4,768
genievhdirkVerified publisher0.1.31 of 1See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
stanfordoval/almond-server:latest1a63cdccedaf
morgan@1.10.0
1.11.0

Open the chart page →

3,129
hedgedocvista0.1.11 of 1See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
morgan@1.10.0
1.11.0

Open the chart page →

3,118
workadventureworkadventure1.1.01 of 9See more

workadventure workadventure 1.1.0

1 of the 9 container images this version deploys carry CVE-2026-5078.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-uploader:v1.17.73ccd467543b3
morgan@1.10.0
1.11.0

Open the chart page →

16,083

Container images carrying it

80 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
thecodingmachine/workadventure-uploader:v1.17.73ccd467543b3
morgan@1.10.0
1.11.0
1
treskon/portrait-ui:DEV-lateste7970783bc8d
morgan@1.9.1
1.11.0
1
vcnngr/pnbackend:latesteaf44ad0ad1f
morgan@1.10.1
1.11.0
1
wekanteam/wekan:v4.2268a51f0327df
morgan@1.6.1
1.11.0
1
wiremind/scrapoxy:lateste7048929a676
morgan@1.9.1
1.11.0
1
zazuko/trifid:2.3.7054be137de70
morgan@1.10.0
1.11.0
1
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
morgan@1.10.0
1.11.0
1
zwavejs/zwave-js-ui:11.22.314d018bb689e
morgan@1.10.1
1.11.0
1
ghcr.io/blessingnator/keycloak-mcn-backend:2.0.5967470f05472
morgan@1.10.1
1.11.0
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
morgan@1.9.1
1.11.0
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
morgan@1.9.1
1.11.0
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
morgan@1.9.1
1.11.0
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
morgan@1.9.1
1.11.0
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
morgan@1.10.0
1.11.0
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
morgan@1.10.0
1.11.0
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
morgan@1.10.0
1.11.0
1
ghcr.io/hiteshnayak305/cors-proxy:1.2.0e6ff0a131556
morgan@1.10.1
1.11.0
1
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
morgan@1.10.1
1.11.0
1
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
morgan@1.10.0
1.11.0
1
ghcr.io/maastrichtu-ids/rstudio:latest981aa4c109e1
morgan@1.10.0
1.11.0
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
morgan@1.10.0
1.11.0
1
ghcr.io/techno-tim/littlelink-server:latest735a1fcd078b
morgan@1.10.0
1.11.0
1
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
morgan@1.10.1
1.11.0
1
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
morgan@1.10.1
1.11.0
1
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
morgan@1.10.0
1.11.0
1
quay.io/ctrontesting/iofog-controller:latest10df27bc5560
morgan@1.9.1
1.11.0
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
morgan@1.10.1
1.11.0
1
quay.io/wekan/wekan:v5.65cb17600883a3
morgan@1.6.1
1.11.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
morgan@1.10.0
1.11.0
1
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
morgan@1.9.0
1.11.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.