CVE-2026-54272
MediumAdvisory
Published 3 Aug 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.9
- base score, highest
- EPSS
- 0.004
- 28th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 128
- of 17,781 indexed, latest versions
- Container images
- 116
- deployed by those charts
- Fix available
- 1 of 1
- affected package
ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks
Carried by container images the latest versions of 128 of 17,781 indexed charts deploy, on 116 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| ip-addressnpm | 10.1.1, 10.2.0 | 10.2.1 | 116 |
- OSV records
- GHSA-22jq-vg5j-6vgg
Charts affected
128 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| tenuretenureVerified publisher | 1.0.6 | 1 of 2See more | 2,522 |
| wikiwenerme | 2.2.0 | 1 of 2See more | 3,833 |
| discord-botxxczakiVerified publisher | 0.27.5 | 1 of 2See more | 474 |
| crowdsec-web-uizekker6Verified publisher | 0.51.0 | 1 of 1See more | 1,411 |
| lhciadnoctemVerified publisher | 0.1.0 | 1 of 1See more | 1,248 |
| outlineadnoctemVerified publisher | 0.1.2 | 1 of 1See more | 1,216 |
| turborepo-remote-cacheadriantr | 1.1.1 | 1 of 1See more | 523 |
| pangolinbdcode | 0.14.1 | 1 of 1See more | 1,901 |
| node-appbryopsida | 0.5.1 | 1 of 2See more | 14,352 |
| stocksalescluster-deploy | 0.1.3 | 1 of 1See more | 408 |
| kuberay-dashboarddanchevVerified publisher | 0.0.5 | 1 of 1See more | 551 |
| dial-admindialVerified publisher | 0.18.0 | 1 of 3See more | 4,046 |
| adventurelogdjjudas21Verified publisher | 0.1.1 | 1 of 3See more | 7,459 |
| clickhouse-monitoringduyet | 0.1.2 | 1 of 2See more | 1,049 |
| benchmarking-tooleclipse-aeriosVerified publisher | 1.0.0 | 1 of 1See more | 687 |
| node-redegebackVerified publisher | 2.0.13 | 1 of 1See more | 975 |
| uptime-kumaegebackVerified publisher | 2.0.12 | 1 of 1See more | 30,159 |
| edp-installepmdedpOfficialVerified publisher | 3.15.0 | 1 of 7See more | 2,033 |
| krci-portalepmdedpVerified publisher | 0.8.0 | 1 of 1See more | 839 |
| assertoorethereum-helm-chartsVerified publisher | 1.2.0 | 1 of 1See more | 2,891 |
| lodestarethereum-helm-chartsVerified publisher | 1.2.2 | 1 of 2See more | 2,522 |
| beeport-uiethersphereVerified publisher | 0.76.2 | 1 of 3See more | 7,368 |
| multichain-uiethersphereVerified publisher | 0.73.1 | 1 of 3See more | 7,368 |
| static-siteethersphereVerified publisher | 0.73.1 | 1 of 2See more | 6,851 |
| redis-uigin | 0.0.1 | 1 of 1See more | 1,053 |
| web-checkhajowielandVerified publisher | 1.0.1 | 1 of 1See more | 9,047 |
| archiveboxhelmforgeVerified publisher | 1.1.12 | 1 of 1See more | 7,633 |
| bytestashhelmforgeVerified publisher | 1.0.0 | 1 of 1See more | 739 |
| homarrhelmforgeVerified publisher | 1.2.8 | 1 of 1See more | 435 |
| matterbridgehelmforgeVerified publisher | 1.0.2 | 1 of 1See more | 895 |
| memoshelmforgeVerified publisher | 2.0.0 | 1 of 2See more | 792 |
| opencuthelmforgeVerified publisher | 1.1.9 | 1 of 5See more | 3,726 |
| paprahelmforgeVerified publisher | 1.0.0 | 1 of 1See more | 2,538 |
| pocket-idhelmforgeVerified publisher | 1.0.0 | 1 of 2See more | 453 |
| reactive-resumehelmforgeVerified publisher | 1.0.0 | 2 of 4See more | 3,025 |
| twentyhelmforgeVerified publisher | 1.0.0 | 1 of 5See more | 2,818 |
| bluesky-pdsijmacd | 1.0.0 | 1 of 2See more | 8,967 |
| ghostjanip81-helm-chartsVerified publisher | 0.1.2 | 1 of 1See more | 3,436 |
| zomboid-serverjanip81-helm-chartsVerified publisher | 0.1.21 | 1 of 3See more | 424 |
| homebridgejespernohrVerified publisher | 0.2.0 | 1 of 1See more | 2,149 |
| ghostk8s-home-lab-repo | 4.1.0 | 1 of 1See more | 3,092 |
| k8s-jacoco-operatork8s-jacoco-operator | 0.4.0 | 1 of 4See more | 2,437 |
| cdashkitwareVerified publisher | 0.19.0 | 1 of 3See more | 12,062 |
| ghostkubernetes-homelab-helm-chartsVerified publisher | 0.1.2 | 1 of 2See more | 2,756 |
| homebridgelbenicio-communityVerified publisher | 0.1.15 | 1 of 1See more | 2,149 |
| uptime-kumalbenicio-communityVerified publisher | 0.1.1 | 1 of 1See more | 33,242 |
| libredb-studiolibredb-studio-oci | 0.1.63 | 1 of 1See more | 1,222 |
| node-redlmatfyVerified publisher | 0.1.6 | 1 of 1See more | 1,809 |
| uptime-kumaloeken-at-homeVerified publisher | 2.3.2 | 1 of 1See more | 33,242 |
| logtidelogtideVerified publisher | 2.1.14 | 2 of 4See more | 2,774 |
Container images carrying it
116 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| louislam/ | 91e963bfda56 | ip-address | 10.2.1 | 1 |
| luligu/ | 1ec50ecd0694 | ip-address | 10.2.1 | 1 |
| mautic/ | eb8cc73d97e1 | ip-address | 10.2.1 | 1 |
| n8nio/ | 761374d4eb84 | ip-address | 10.2.1 | 1 |
| n8nio/ | cfe2704ff858 | ip-address | 10.2.1 | 1 |
| nodered/ | 10f40d0a83e7 | ip-address | 10.2.1 | 1 |
| nodered/ | a649dd711d55 | ip-address | 10.2.1 | 1 |
| nodered/ | d73ae167cb9b | ip-address | 10.2.1 | 1 |
| nousresearch/ | e0df6adebddf | ip-address | 10.2.1 | 1 |
| oneuptime/ | 6da7de4fc0f3 | ip-address | 10.2.1 | 1 |
| oneuptime/ | 6b2d98713711 | ip-address | 10.2.1 | 1 |
| oneuptime/ | 4accc516d800 | ip-address | 10.2.1 | 1 |
| otwld/ | d1954b759e47 | ip-address | 10.2.1 | 1 |
| outlinewiki/ | 832051f039b4 | ip-address | 10.2.1 | 1 |
| penpotapp/ | 72a8061e8806 | ip-address | 10.2.1 | 1 |
| penpotapp/ | 84f3f07ead11 | ip-address | 10.2.1 | 1 |
| rocketchat/ | 44af8ac4e711 | ip-address | 10.2.1 | 1 |
| rocketchat/ | 6bc18fb5d0e5 | ip-address | 10.2.1 | 1 |
| rocketchat/ | 819771c4abe4 | ip-address | 10.2.1 | 1 |
| rocketchat/ | c1170bdfe797 | ip-address | 10.2.1 | 1 |
| saidsef/ | 67025e3a163e | ip-address | 10.2.1 | 1 |
| shieldsio/ | fa194b446e42 | ip-address | 10.2.1 | 1 |
| supabase/ | c8eb9858eafe | ip-address | 10.2.1 | 1 |
| supabase/ | f6c42a04163d | ip-address | 10.2.1 | 1 |
| tenureai/ | 5f5b222df9a5 | ip-address | 10.2.1 | 1 |
| trackerforce/ | 28ee0c4e0b88 | ip-address | 10.2.1 | 1 |
| trackerforce/ | 67e2c261f7b4 | ip-address | 10.2.1 | 1 |
| treskon/ | e7970783bc8d | ip-address | 10.2.1 | 1 |
| twentycrm/ | e7d9948bf284 | ip-address | 10.2.1 | 1 |
| veecode/ | c443520aebf7 | ip-address | 10.2.1 | 1 |
| wsjbr/ | 5e594f5f09f6 | ip-address | 10.2.1 | 1 |
| xxczaki/ | bb919aac45dc | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 19553e4b4033 | ip-address | 10.2.1 | 1 |
| ghcr.io/ | c487ec5edcfe | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 792e262ea504 | ip-address | 10.2.1 | 1 |
| ghcr.io/ | d95725b24dbe | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 2ed0183564d7 | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 8726533b9e69 | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 8b621866ceb2 | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 87f9e8a92bd7 | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 84edfe8a67a8 | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 046dfdb8550c | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 236faedcb68a | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 05e16dd56cfb | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 1f5b892aeef4 | ip-address | 10.2.1 | 1 |
| ghcr.io/ | f23ad77a681b | ip-address | 10.2.1 | 1 |
| ghcr.io/ | ae13784ffcfc | ip-address | 10.2.1 | 1 |
| ghcr.io/ | eb4f736b8cd4 | ip-address | 10.2.1 | 1 |
| ghcr.io/ | b069e4307dec | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 65463e02f887 | ip-address | 10.2.1 | 1 |