CVE-2026-54272
MediumAdvisory
Published 3 Aug 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.9
- base score, highest
- EPSS
- 0.004
- 28th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 128
- of 17,781 indexed, latest versions
- Container images
- 116
- deployed by those charts
- Fix available
- 1 of 1
- affected package
ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks
Carried by container images the latest versions of 128 of 17,781 indexed charts deploy, on 116 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| ip-addressnpm | 10.1.1, 10.2.0 | 10.2.1 | 116 |
- OSV records
- GHSA-22jq-vg5j-6vgg
Charts affected
128 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| n8nopen-8gears | 2.1.1 | 1 of 1See more | 1,038 |
| uptime-kumauptime-kumaVerified publisher | 4.2.0 | 1 of 1See more | 30,159 |
| backstagebackstageOfficialVerified publisher | 2.10.1 | 1 of 1See more | 1,195 |
| rocketchatrocketchat-server | 7.0.2 | 4 of 12See more | 12,279 |
| opensearch-dashboardsopensearch-project-helm-chartsVerified publisher | 3.8.0 | 1 of 1See more | 280 |
| penpotpenpotOfficialVerified publisher | 1.9.0 | 2 of 4See more | 4,314 |
| actualbudgetcommunity-chartsVerified publisher | 1.9.4 | 1 of 1See more | 1,091 |
| lemmyananace-chartsVerified publisher | 0.6.15 | 1 of 5See more | 7,210 |
| localstacklocalstack | 0.7.0 | 1 of 1See more | 2,156 |
| oneuptimeoneuptimeOfficialVerified publisher | 13.0.4 | 3 of 7See more | 11,192 |
| openclawopenclaw-helmVerified publisher | 1.5.40 | 1 of 2See more | 5,660 |
| servarrkubitodevVerified publisher | 1.5.2 | 1 of 10See more | 3,004 |
| velero-uiotwldVerified publisher | 0.15.0 | 1 of 1See more | 1,332 |
| budibasebudibase | 0.0.0-master | 1 of 7See more | 10,775 |
| openclawopenclawVerified publisher | 1.91.3 | 1 of 2See more | 2,977 |
| hedgedocadfinisVerified publisher | 0.6.1 | 1 of 2See more | 2,938 |
| docmosthelmforgeVerified publisher | 1.2.11 | 1 of 4See more | 5,564 |
| kuttchristianhuthVerified publisher | 9.10.1 | 1 of 3See more | 454 |
| dialdialOfficialVerified publisher | 7.2.0 | 1 of 4See more | 2,163 |
| karakeephelmforgeVerified publisher | 1.2.9 | 2 of 3See more | 9,460 |
| libredb-studiolibredb-studioVerified publisher | 0.1.63 | 1 of 1See more | 1,222 |
| wg-easywg-easyVerified publisher | 0.1.6 | 1 of 1See more | 725 |
| duplistatusduplistatusVerified publisher | 1.2.0 | 1 of 2See more | 1,870 |
| rsshubgabe565Verified publisher | 0.8.0 | 1 of 3See more | 1,717 |
| kubebadgeskubebadges | 0.1.3 | 1 of 2See more | 1,798 |
| openclaw-with-brainopenclaw-with-brainVerified publisher | 0.1.67 | 1 of 3See more | 5,218 |
| hedgedocrobertobochetVerified publisher | 1.4.0 | 1 of 1See more | 977 |
| wgerwgerOfficialVerified publisher | 1.0.0 | 1 of 8See more | 8,491 |
| aapbaapbVerified publisher | 0.1.3 | 1 of 1See more | 1,044 |
| hermes-agentankra-chartsVerified publisher | 0.3.1 | 1 of 1See more | 5,880 |
| kinesisaws-kinesis-local | 0.8.0 | 1 of 1See more | 360 |
| seerrbdclark-helm-chartsVerified publisher | 0.1.5 | 1 of 1See more | 1,991 |
| home-assistant-matter-servercharts-derwitt-devVerified publisher | 4.2.1 | 1 of 2See more | 2,360 |
| node-redcharts-derwitt-devVerified publisher | 2.1.2 | 1 of 1See more | 101 |
| claude-code-hubclaude-code-hub | 0.1.0 | 1 of 4See more | 2,173 |
| data-fairdata354-helmVerified publisher | 1.1.2 | 1 of 12See more | 38,346 |
| kubedashdevopstalesOfficialVerified publisher | 4.0.0 | 1 of 8See more | 9,205 |
| directusdirectus-io | 2.1.0 | 1 of 3See more | 7,473 |
| jellystatdjjudas21Verified publisher | 0.1.12 | 1 of 1See more | 1,722 |
| domain-lockerdomain-locker | 0.2.8 | 1 of 3See more | 1,882 |
| keycloak-reporterkeycloak-reporterVerified publisher | 1.4.15 | 1 of 1See more | 1,322 |
| actualbudgetm0nsterrr-actualbudgetVerified publisher | 2.10.0 | 1 of 1See more | 1,091 |
| n8nn8n-helm | 2.25.7 | 1 of 1See more | 2,575 |
| kuttone-acre-fundVerified publisher | 0.2.5 | 1 of 1See more | 454 |
| peertubepeertubeVerified publisher | 0.1.3 | 1 of 1See more | 7,035 |
| portraitportraitVerified publisher | 0.2.13 | 1 of 8See more | 31,844 |
| immichsecustorVerified publisher | 2.0.4 | 1 of 1See more | 3,059 |
| wg-easyslybase-wg-easyVerified publisher | 1.2.0 | 1 of 1See more | 725 |
| supabasesupabse | 0.8.0 | 1 of 11See more | 18,075 |
| switcher-apiswitcherapiOfficialVerified publisher | 1.3.5 | 2 of 3See more | 623 |
Container images carrying it
116 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| library/ | be23f54a88d3 | ip-address | 10.2.1 | 3 |
| localstack/ | 4aef81c53168 | ip-address | 10.2.1 | 3 |
| ghcr.io/ | f4768de5f616 | ip-address | 10.2.1 | 3 |
| quay.io/ | 89bd85d7817f | ip-address | 10.2.1 | 3 |
| actualbudget/ | 552beab3dec8 | ip-address | 10.2.1 | 2 |
| epamedp/ | 687acf641097 | ip-address | 10.2.1 | 2 |
| homebridge/ | 77c685a40911 | ip-address | 10.2.1 | 2 |
| kutt/ | fa3d24a89b04 | ip-address | 10.2.1 | 2 |
| library/ | 159fe6464903 | ip-address | 10.2.1 | 2 |
| library/ | be80f76cf40e | ip-address | 10.2.1 | 2 |
| louislam/ | 9aeb4e51d038 | ip-address | 10.2.1 | 2 |
| louislam/ | a8610b3b4c38 | ip-address | 10.2.1 | 2 |
| n8nio/ | 14c4285bc303 | ip-address | 10.2.1 | 2 |
| opensearchproject/ | ca28e40a095f | ip-address | 10.2.1 | 2 |
| patrikx3/ | f19eb45b0694 | ip-address | 10.2.1 | 2 |
| requarks/ | 68f0d1848261 | ip-address | 10.2.1 | 2 |
| siscc/ | 12c5048f7402 | ip-address | 10.2.1 | 2 |
| ghcr.io/ | 4b696f960ac1 | ip-address | 10.2.1 | 2 |
| ghcr.io/ | a4e021c0f6a9 | ip-address | 10.2.1 | 2 |
| ghcr.io/ | 0e7bc9d34e86 | ip-address | 10.2.1 | 2 |
| archivebox/ | 1a5a37331091 | ip-address | 10.2.1 | 1 |
| budibase/ | 44fe6feab985 | ip-address | 10.2.1 | 1 |
| chainsafe/ | 5593f6e97912 | ip-address | 10.2.1 | 1 |
| chocobozzz/ | 052712130691 | ip-address | 10.2.1 | 1 |
| continuoussecuritytooling/ | f04ecefab64e | ip-address | 10.2.1 | 1 |
| cyfershepard/ | c4e2dfa8bddf | ip-address | 10.2.1 | 1 |
| dessalines/ | ee4c620d8e93 | ip-address | 10.2.1 | 1 |
| directus/ | 9c8470ea465c | ip-address | 10.2.1 | 1 |
| diygod/ | 1d4b508b6357 | ip-address | 10.2.1 | 1 |
| docmost/ | 41c8d777cf23 | ip-address | 10.2.1 | 1 |
| ducktors/ | 31ec9e83c844 | ip-address | 10.2.1 | 1 |
| eclipseaerios/ | a4b4c2e7fe62 | ip-address | 10.2.1 | 1 |
| epam/ | 21d91ad74755 | ip-address | 10.2.1 | 1 |
| epam/ | bd6b13695cdc | ip-address | 10.2.1 | 1 |
| ethpandaops/ | 1efa2fba6711 | ip-address | 10.2.1 | 1 |
| foggbh/ | 8b7a2e5ecf4e | ip-address | 10.2.1 | 1 |
| fosrl/ | 83a55f933b4d | ip-address | 10.2.1 | 1 |
| haohanyang/ | f4f8fe4e21f1 | ip-address | 10.2.1 | 1 |
| helmforge/ | bf11156e0ab5 | ip-address | 10.2.1 | 1 |
| joplin/ | 3f7b852959aa | ip-address | 10.2.1 | 1 |
| journeyapps/ | bf46f66e5dcc | ip-address | 10.2.1 | 1 |
| kitware/ | d7767d9b9da4 | ip-address | 10.2.1 | 1 |
| langgenius/ | 8dd9de6b6190 | ip-address | 10.2.1 | 1 |
| langgenius/ | ba1dd1d0bcea | ip-address | 10.2.1 | 1 |
| library/ | 1ef2e532ca4d | ip-address | 10.2.1 | 1 |
| library/ | 29773d6be407 | ip-address | 10.2.1 | 1 |
| library/ | 77196da4b0df | ip-address | 10.2.1 | 1 |
| library/ | e67514e5d0f6 | ip-address | 10.2.1 | 1 |
| library/ | f5d1cc40abc1 | ip-address | 10.2.1 | 1 |
| lissy93/ | d3c95edc0a8b | ip-address | 10.2.1 | 1 |