CVE-2026-54369

High

Advisory

Published 29 Jun 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.4; base score, highest
EPSS: 0.002; 5th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,570; of 17,821 indexed, latest versions
Container images: 2,580; deployed by those charts
Fix available: 2 of 2; affected packages

Red Hat Security Advisory: acl security update

Carried by container images the latest versions of 2,570 of 17,821 indexed charts deploy, on 2,580 images.

Affected package	Affected versions	Fixed in	Images
acldeb	2.2.52-1, 2.2.52-3, 2.2.52-3build1, 2.2.53-6+8 more	2.4.0-1	2,537
aclrpm	2.3.1-2.azl3, 2.3.1-3.el9, 2.3.1-4.el9	0:2.4.0-0.el9_2.1, 0:2.4.0-0.el9_4.1, 0:2.4.0-0.el9_6.1, 2.4.0-1	43

OSV records: DEBIAN-CVE-2026-54369 RHSA-2026:67140 RHSA-2026:67142 RHSA-2026:67144 UBUNTU-CVE-2026-54369 AZL-91397 ECHO-b5ce-94bd-9b5b

Charts affected

2,570 by stars

Chart

Latest

Affected images

Radar Score

wordpress-alpinewordpress-alpine

1.5.18

2 of 6 See more

wordpress-alpine wordpress-alpine 1.5.18

2 of the 6 container images this version deploys carry CVE-2026-54369.

Container image	Digest	Package	Fixed in
library/mariadb :12.3.2	628f228f0fd5	acl@2.3.2-1build1.1	no fix listed
library/memcached :1.6.45	dc561d52bb8a	acl@2.3.2-2+b1	no fix listed

Open the chart page →

4,124

Wordpresswordpress-mariadb

1.0.2

2 of 2 See more

Wordpress wordpress-mariadb 1.0.2

2 of the 2 container images this version deploys carry CVE-2026-54369.

Container image	Digest	Package	Fixed in
library/mariadb :lts	dd9b303aed4f	acl@2.3.2-1build1.1	no fix listed
library/wordpress :latest	5a93c470ae82	acl@2.3.2-2+b1	no fix listed

Open the chart page →

5,783

wordpresswordpress-ng

1.0.9

1 of 2 See more

wordpress wordpress-ng 1.0.9

1 of the 2 container images this version deploys carry CVE-2026-54369.

Container image	Digest	Package	Fixed in
cloudtooling/wordpress :7.1.1	db89d95f1d14	acl@2.3.1-3	no fix listed

Open the chart page →

3,976

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-54369.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	acl@2.3.1-1	no fix listed

Open the chart page →

14,259

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-54369.

Container image	Digest	Package	Fixed in
ghcr.io/bat-bs/bitnami-pgvector :pg16	19ebe07b4daf	acl@2.3.1-3	no fix listed

Open the chart page →

11,563

tabbyxd

1.0.6

1 of 2 See more

7,770

xkopsxkops

0.1.0

4 of 5 See more

xkops xkops 0.1.0

4 of the 5 container images this version deploys carry CVE-2026-54369.

Container image	Digest	Package	Fixed in
hamzaarshad10/querybackend :1.6.2	2c1c3b86a8e7	acl@2.3.1-3	no fix listed
hamzaarshad10/querypodpy :1.7	154f38e8668e	acl@2.3.1-3	no fix listed
library/mongo :latest	5211c51171f5	acl@2.3.2-1build1.1	no fix listed
murtazashah46/helmfile :latest	4d11726cf803	acl@2.3.1-3	no fix listed

Open the chart page →

13,925

xlinexline

0.0.1

1 of 1 See more

xline xline 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-54369.

Container image	Digest	Package	Fixed in
ghcr.io/liangyuanpeng/xline :latest	3d2eceb44a3b	acl@2.3.2-1build1	no fix listed

Open the chart page →

2,166

cloudeye-exporterxxl-job-admin

0.1.2

1 of 1 See more

cloudeye-exporter xxl-job-admin 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-54369.

Container image	Digest	Package	Fixed in
dellnoantechnp/cloudeye-exporter :v2.0.31	6873356c882d	acl@2.3.1-3	no fix listed

Open the chart page →

2,698

dingtalk-botxxl-job-admin

0.1.2

1 of 2 See more

dingtalk-bot xxl-job-admin 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-54369.

Container image	Digest	Package	Fixed in
dellnoantechnp/dingtalk-bot :v1.0.1	034000bbcad5	acl@2.3.2-2+b1	no fix listed

Open the chart page →

3,186

nightingalexxl-job-admin

0.2.11

3 of 6 See more

nightingale xxl-job-admin 0.2.11

3 of the 6 container images this version deploys carry CVE-2026-54369.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	acl@2.3.2-1build1.1	no fix listed
flashcatcloud/nightingale :8.0.0-beta.11	ea1b0aaabe09	acl@2.3.1-3	no fix listed
library/redis :6.2	d2ad7b21cafa	acl@2.3.1-3	no fix listed

Open the chart page →

9,743

pgcatxxl-job-admin

0.3.3

1 of 1 See more

pgcat xxl-job-admin 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-54369.

Container image	Digest	Package	Fixed in
ghcr.io/postgresml/pgcat :v1.2.0	627761f6dcbc	acl@2.3.1-3	no fix listed

Open the chart page →

3,197

nginx-chartxxoznge-nginx

0.1.0

1 of 1 See more

nginx-chart xxoznge-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-54369.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	acl@2.3.2-2+b1	no fix listed

Open the chart page →

1,887

helm-demoyahoon-helm-demo

1.0.0

1 of 1 See more

helm-demo yahoon-helm-demo 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-54369.

Container image	Digest	Package	Fixed in
ghcr.io/yahoon/helm-demo :1.0.0	2930290a758c	acl@2.3.2-2+b1	no fix listed

Open the chart page →

1,257

my-nginx-appyasser-nginx-app

0.1.0

1 of 1 See more

my-nginx-app yasser-nginx-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-54369.

Container image	Digest	Package	Fixed in
library/nginx :stable	d5792f71a949	acl@2.3.2-2+b1	no fix listed

Open the chart page →

1,887

api-snapyoukadev

0.1.1

1 of 1 See more

api-snap youkadev 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-54369.

Container image	Digest	Package	Fixed in
youkadev/api-snap :0.1.1	4db0f9428e67	acl@2.3.1-3	no fix listed

Open the chart page →

2,638

changedetection-iozekker6

1.102.0

1 of 1 See more

changedetection-io zekker6 1.102.0

1 of the 1 container images this version deploys carry CVE-2026-54369.

Container image	Digest	Package	Fixed in
ghcr.io/dgtlmoon/changedetection.io :0.60.7	096dae27b5d6	acl@2.3.1-3	no fix listed

Open the chart page →

2,710

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-54369.

Container image	Digest	Package	Fixed in
library/nginx :latest	abe47724e466	acl@2.3.2-2+b1	no fix listed

Open the chart page →

1,593

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-54369.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	acl@2.2.52-3build1	no fix listed
yandex/clickhouse-server :21.3.20	4eccfffb01d7	acl@2.2.53-6	no fix listed

Open the chart page →

9,297

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-54369.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	acl@2.3.1-1	no fix listed

Open the chart page →

7,966

Container images carrying it

2,580 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/suwayomi/suwayomi-server :v2.3.2320	d2c3218c7f9f	acl@2.3.2-1build1.1	no fix listed	1
ghcr.io/tarampampam/video-dl-bot :1.4.3	6daa2dc7556b	acl@2.3.2-2+b1	no fix listed	1
ghcr.io/tauffer-consulting/domino-rest :latest	8bf880fe8c73	acl@2.3.1-3	no fix listed	1
ghcr.io/theduffman85/crowdsec-web-ui :2026.8.3	bfadbab9a72c	acl@2.3.2-2+b1	no fix listed	1
ghcr.io/toeverything/affine :0.27.4	b649f5ce2384	acl@2.3.1-3	no fix listed	1
ghcr.io/topolvm/pie :0.18.0	aa467443e407	acl@2.3.1-1	no fix listed	1
ghcr.io/topolvm/topolvm-with-sidecar :0.41.1	70548dbe0c6a	acl@2.3.1-1	no fix listed	1
ghcr.io/topolvm/topolvm-with-sidecar :0.35.0	b354978c440d	acl@2.3.1-1	no fix listed	1
ghcr.io/trow-registry/trow :0.10.0	75b7d2dcdb91	acl@2.3.2-2+b1	no fix listed	1
ghcr.io/turbot/guardrails-agent-kubernetes :0.3.0	9d01bf9c9224	acl@2.3.2-1build1.1	no fix listed	1
ghcr.io/twigex/cospace :latest	e5ecfd607e42	acl@2.3.1-3	no fix listed	1
ghcr.io/unique-ag/ai/search-proxy :2026.38.0	aa6699b027bb	acl@2.3.2-2+b1	no fix listed	1
ghcr.io/utkuozdemir/nvidia_gpu_exporter :1.5.0	d75967a4dd72	acl@2.3.2-2	no fix listed	1
ghcr.io/vinny1892/octantis :latest	45459c0910fc	acl@2.3.2-2+b1	no fix listed	1
ghcr.io/virtuos/librechat_exporter :2.0.0	50ea1cf0086f	acl@2.3.1-3	no fix listed	1
ghcr.io/voxpupuli/container-puppetdb :7.18.0-v1.5.0	a56dfe91f5b1	acl@2.3.1-1	no fix listed	1
ghcr.io/voxpupuli/container-puppetserver :7.17.0-v1.5.0	916746209ac5	acl@2.3.1-1	no fix listed	1
ghcr.io/voxpupuli/puppetserver :8.7.0-main	63873f3f698e	acl@2.3.1-1	no fix listed	1
ghcr.io/vshn/haproxy-with-mysql :1.0.0	a3c27ee3fb2f	acl@2.3.1-3	no fix listed	1
ghcr.io/wearefrank/frank-gateway :1.0.0	5ccf797ccdf1	acl@2.3.2-1build1.1	no fix listed	1
ghcr.io/wekan/ferretdb :latest	ebed9a5eaae0	acl@2.3.2-2+b1	no fix listed	1
ghcr.io/wekan/wekan :v11.90	078ca230c0df	acl@2.3.2-2+b1	no fix listed	1
ghcr.io/wgbh-mla/chowda :main	86ab9effd1a5	acl@2.3.2-2+b1	no fix listed	1
ghcr.io/wgbh-mla/ov-wag :v1.1.0	6df27f944fe8	acl@2.3.1-3	no fix listed	1
ghcr.io/wgbh-mla/pbcore-util :pr-6	6e04659a3baa	acl@2.3.1-3	no fix listed	1
ghcr.io/wiremind/bitnami/keycloak :26.5.0-debian-12-r3	8622ea9e43c0	acl@2.3.1-3	no fix listed	1
ghcr.io/wiremind/bitnami/rabbitmq :4.2.2-debian-12-r1	1572e12bc93c	acl@2.3.1-3	no fix listed	1
ghcr.io/wiremind/bitnami/redis :8.4.0-debian-12-r3	1f0f7ddc4370	acl@2.3.1-3	no fix listed	1
ghcr.io/wiremind/grafana-pdf-exporter :v1.7	dbaa8527bf4c	acl@2.3.1-3	no fix listed	1
ghcr.io/wittdennis/calibre-web :1.1.1	aa7d5d5dd6be	acl@2.3.1-3	no fix listed	1
ghcr.io/wittdennis/homeassistant-otbr :4.2.5	282f840612d9	acl@2.3.2-2+b1	no fix listed	1
ghcr.io/wizarrrr/wizarr :4.2.0-beta.3	d19d886d5090	acl@2.3.1-3	no fix listed	1
ghcr.io/wmde/wbaas-backup :v0.1.7	8e6a9516eac0	acl@2.2.52-3build1	no fix listed	1
ghcr.io/wolveix/satisfactory-server :v1.9.10	e0f2f8c97598	acl@2.3.1-1	no fix listed	1
ghcr.io/woodenmaiden/relfinderreformedfront :latest	344f53763b25	acl@2.3.1-3	no fix listed	1
ghcr.io/wrenix/autopush-rs/autoconnect :1.84.2	85f93ced88b2	acl@2.3.1-3	no fix listed	1
ghcr.io/wrenix/autopush-rs/autoendpoint :1.84.2	d95e9a124eed	acl@2.3.1-3	no fix listed	1
ghcr.io/wundergraph/cosmo/cdn :0.14.1	d86fcf169f15	acl@2.3.1-3	no fix listed	1
ghcr.io/wundergraph/cosmo/otelcollector :0.18.1	5a6fe78d4d15	acl@2.3.1-3	no fix listed	1
ghcr.io/yahoon/helm-demo :1.0.0	2930290a758c	acl@2.3.2-2+b1	no fix listed	1
ghcr.io/yourls/yourls :1.10.6	7550ff86b15f	acl@2.3.2-2+b1	no fix listed	1
ghcr.io/yurymkomarov/docker/kubernetes-kiosk-chromium :0.1.2	7bff29dcec72	acl@2.3.1-3	no fix listed	1
ghcr.io/zammad/zammad :7.1.3-0014	ce435c77651e	acl@2.3.2-2+b1	no fix listed	1
ghcr.io/zazukoians/qlever-server :v0.10.1	1de7869ab46e	acl@2.3.2-1build1.1	no fix listed	1
ghcr.io/zoriya/kyoo_autosync :4.7.1	fbba58ddb1a6	acl@2.3.1-3	no fix listed	1
ghcr.io/zoriya/kyoo_back :4.7.1	416e980f76a6	acl@2.3.1-3	no fix listed	1
ghcr.io/zoriya/kyoo_migrations :4.7.1	f7e607f24071	acl@2.3.1-3	no fix listed	1
ghcr.io/zoriya/kyoo_scanner :4.7.1	7dc0ee57b628	acl@2.3.1-3	no fix listed	1
ghcr.io/zystem-io/zymtrace-pub-gateway :26.9.2	ae9ae0925ff8	acl@2.3.1-1	no fix listed	1
mcr.microsoft.com/azure-application-gateway/kubernetes-ingress :1.6.0	bccaa701e2df	acl@2.2.53-6	no fix listed	1