StackRadar

CVE-2026-54370

High

Advisory

Published 29 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.2
base score, highest
EPSS
0.001
0th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,562
of 17,832 indexed, latest versions
Container images
2,562
deployed by those charts
Fix available
2 of 2
affected packages

CVE-2026-54370 affecting package acl for versions less than 2.4.0-1

Carried by container images the latest versions of 2,562 of 17,832 indexed charts deploy, on 2,562 images.

Affected packageAffected versionsFixed inImages
acldeb2.2.52-1, 2.2.52-3, 2.2.52-3build1, 2.2.53-6+8 more2.4.0-12,559
aclrpm2.3.1-2.azl32.4.0-13
OSV records
DEBIAN-CVE-2026-54370UBUNTU-CVE-2026-54370AZL-91394ECHO-ae30-49be-9cc5

Charts affected

2,562 by stars
ChartLatestAffected imagesRadar Score
federidfederidOfficialVerified publisher0.1.21 of 1See more

federid federid 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
federid/webhook:0.1.0fbfb7c6510a7
acl@2.3.1-3
no fix listed

Open the chart page →

2,142
taigafermosit0.0.112 of 7See more

taiga fermosit 0.0.11

2 of the 7 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
taigaio/taiga-back:latest4beed8f62c9f
acl@2.3.2-2+b1
no fix listed
taigaio/taiga-protected:latestfd4568a97a59
acl@2.3.2-2+b1
no fix listed

Open the chart page →

8,660
zabbix-server-mysqlfermosit3.0.23 of 4See more

zabbix-server-mysql fermosit 3.0.2

3 of the 4 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
zabbix/zabbix-agent:ubuntu-6.4-latest349b924472a7
acl@2.3.2-1build1.1
no fix listed
zabbix/zabbix-server-mysql:ubuntu-6.4-latest55d074b6b031
acl@2.3.2-1build1.1
no fix listed
zabbix/zabbix-web-nginx-mysql:ubuntu-6.4-latest0e5f69c4c54e
acl@2.3.2-1build1.1
no fix listed

Open the chart page →

13,288
ferriskeyferriskey0.8.01 of 3See more

ferriskey ferriskey 0.8.0

1 of the 3 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/postgres:1767f41722b7a8
acl@2.3.2-2+b1
no fix listed

Open the chart page →

2,241
flink-operatorflink-operator0.1.11 of 2See more

flink-operator flink-operator 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
gcr.io/flink-operator/deployer:webhook-cert809338a69bd5
acl@2.2.52-3build1
no fix listed

Open the chart page →

77,495
rss-bridgegabe565Verified publisher0.5.21 of 1See more

rss-bridge gabe565 0.5.2

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/rss-bridge/rss-bridge:latest606896116558
acl@2.3.1-3
no fix listed

Open the chart page →

2,269
bazarrgeek-cookbookVerified publisher10.6.21 of 1See more

bazarr geek-cookbook 10.6.2

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/bazarr:v1.0.3fdb5501cdfb9
acl@2.2.53-6
no fix listed

Open the chart page →

17,666
calibregeek-cookbookVerified publisher5.4.21 of 1See more

calibre geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
linuxserver/calibre:version-v5.21.0a847b5b2d860
acl@2.2.52-3build1
no fix listed

Open the chart page →

23,123
games-on-whalesgeek-cookbookVerified publisher1.8.23 of 7See more

games-on-whales geek-cookbook 1.8.2

3 of the 7 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/games-on-whales/pulseaudio:1.0.0f34f98405c10
acl@2.2.53-6
no fix listed
ghcr.io/games-on-whales/retroarch:1.0.0103fbcec2314
acl@2.2.53-6
no fix listed
ghcr.io/games-on-whales/steam:1.0.09b6105be7ad0
acl@2.2.53-6
no fix listed

Open the chart page →

109,253
homebridgegeek-cookbookVerified publisher5.3.21 of 1See more

homebridge geek-cookbook 5.3.2

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/oznu/homebridge:2022-07-08ff2af53897e7
acl@2.2.53-6
no fix listed

Open the chart page →

84,503
lazylibrariangeek-cookbookVerified publisher7.4.21 of 1See more

lazylibrarian geek-cookbook 7.4.2

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
linuxserver/lazylibrarian:version-1152df82f93d2560e233
acl@2.2.52-3build1
no fix listed

Open the chart page →

11,779
network-ups-toolsgeek-cookbookVerified publisher6.4.21 of 1See more

network-ups-tools geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/network-ups-tools:v2.7.4-2479-g86a32237cbd5d4cc1245
acl@2.2.53-6
no fix listed

Open the chart page →

14,074
omada-controllergeek-cookbookVerified publisher4.4.21 of 1See more

omada-controller geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
mbentley/omada-controller:4.3f4e682274bed
acl@2.2.52-3build1
no fix listed

Open the chart page →

11,688
ombigeek-cookbookVerified publisher11.5.21 of 1See more

ombi geek-cookbook 11.5.2

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/ombi:4.16.124c1b67cf39af
acl@2.3.1-1
no fix listed

Open the chart page →

5,230
protonmail-bridgegeek-cookbookVerified publisher5.4.21 of 1See more

protonmail-bridge geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
shenxn/protonmail-bridge:1.8.7-1acf31af7c111
acl@2.2.52-3build1
no fix listed

Open the chart page →

8,112
prowlarrgeek-cookbookVerified publisher4.5.21 of 1See more

prowlarr geek-cookbook 4.5.2

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/prowlarr:v0.3.0.1710c863aa9875fa
acl@2.2.53-6
no fix listed

Open the chart page →

11,845
sabnzbdgeek-cookbookVerified publisher9.4.21 of 1See more

sabnzbd geek-cookbook 9.4.2

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/sabnzbd:v3.3.1c2d6e775db5a
acl@2.2.53-6
no fix listed

Open the chart page →

10,357
sonarrgeek-cookbookVerified publisher16.3.21 of 1See more

sonarr geek-cookbook 16.3.2

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/sonarr:v3.0.8.15070eb230e2381a
acl@2.3.1-1
no fix listed

Open the chart page →

13,405
stashgeek-cookbookVerified publisher3.4.21 of 1See more

stash geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
stashapp/stash:latest24dbd7607174
acl@2.2.53-6
no fix listed

Open the chart page →

15,992
tdarrgeek-cookbookVerified publisher4.6.22 of 2See more

tdarr geek-cookbook 4.6.2

2 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
haveagitgat/tdarr:2.00.181256348872ce
acl@2.2.53-6
no fix listed
haveagitgat/tdarr_node:2.00.101e3f9328327d
acl@2.2.53-6
no fix listed

Open the chart page →

101,489
valheimgeek-cookbookVerified publisher4.4.21 of 1See more

valheim geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/lloesche/valheim-server:latestc885aa902faf
acl@2.3.2-2+b1
no fix listed

Open the chart page →

2,713
wireguardgeek-cookbookVerified publisher1.4.21 of 1See more

wireguard geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/wireguard:v1.0.20210424448045c4270b
acl@2.2.53-6
no fix listed

Open the chart page →

7,746
gentrace-self-hostedgentrace-self-hostedVerified publisher0.1.32 of 9See more

gentrace-self-hosted gentrace-self-hosted 0.1.3

2 of the 9 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:23.8512bb8a21483
acl@2.2.53-6
no fix listed
library/postgres:15.38775adb39f0d
acl@2.3.1-3
no fix listed

Open the chart page →

14,715
ghostfolioghostfolioVerified publisher0.5.41 of 3See more

ghostfolio ghostfolio 0.5.4

1 of the 3 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
acl@2.3.1-3
no fix listed

Open the chart page →

3,199
leantimegissilabs1.3.01 of 2See more

leantime gissilabs 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/mariadb:10.6.218a16204dc96c
acl@2.2.53-6
no fix listed

Open the chart page →

6,527
openbaogitlabVerified publisher0.18.11 of 1See more

openbao gitlab 0.18.1

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao:v2.5.5-gitlab25b7636dfba3f
acl@2.3.2-2+b1
no fix listed

Open the chart page →

1,845
meta-monitoringgrafana1.3.01 of 2See more

meta-monitoring grafana 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
grafana/alloy:v1.4.306bdcbb51fc2
acl@2.3.2-1build1
no fix listed

Open the chart page →

3,634
greenkubegreenkubeVerified publisher0.3.01 of 3See more

greenkube greenkube 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
greenkube/greenkube:0.3.00c01932282a4
acl@2.3.1-3
no fix listed

Open the chart page →

1,555
ghostgroundhog2k0.212.131 of 1See more

ghost groundhog2k 0.212.13

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/ghost:6.64.0a31d03f1f629
acl@2.3.1-3
no fix listed

Open the chart page →

2,045
IMgrycapOfficialVerified publisher1.8.01 of 3See more

IM grycap 1.8.0

1 of the 3 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/grycap/im:latest06a16d4f279f
acl@2.3.2-1build1.1
no fix listed

Open the chart page →

4,270
castopodh2mVerified publisher1.12.101 of 3See more

castopod h2m 1.12.10

1 of the 3 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
castopod/castopod:1.12.101fd37280cbb2
acl@2.3.1-3
no fix listed

Open the chart page →

10,280
haproxy-redis-sentinelhaproxy-redis-sentinelVerified publisher0.1.32 of 2See more

haproxy-redis-sentinel haproxy-redis-sentinel 0.1.3

2 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/haproxy:3.1-bookworm49a0a0d6f0b8
acl@2.3.1-3
no fix listed
ghcr.io/parmincloud/haproxy-redis-sentinel:1.0.040a00a6456ae
acl@2.3.1-3
no fix listed

Open the chart page →

4,426
harp-proxyharp0.8.11 of 1See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
makersquad/harp-proxy:0.8.1a40dd258c527
acl@2.3.1-3
no fix listed

Open the chart page →

6,605
hawkhawk1.1.52 of 4See more

hawk hawk 1.1.5

2 of the 4 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/postgres:16.109f23e02d766
acl@2.3.1-3
no fix listed
ghcr.io/privacyengineering/hawk-service:latestbfedf47bb5e0
acl@2.3.1-1
no fix listed

Open the chart page →

13,824
clickstackhdx-oss-v21.1.11 of 5See more

clickstack hdx-oss-v2 1.1.1

1 of the 5 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/mongo:5.0.32-focal3b6c281e1c08
acl@2.2.53-6
no fix listed

Open the chart page →

4,805
hello-helmhellok8s0.1.01 of 2See more

hello-helm hellok8s 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
acl@2.3.2-2+b1
no fix listed

Open the chart page →

1,796
guacamolehelmforgeVerified publisher1.5.23 of 5See more

guacamole helmforge 1.5.2

3 of the 5 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
guacamole/guacamole:1.6.0f344085e618b
acl@2.3.2-1build1.1
no fix listed
library/postgres:18.6-trixie86c951e05bf5
acl@2.3.2-2+b1
no fix listed
library/postgres:17.5-bookwormfbcea1bd13b6
acl@2.3.1-3
no fix listed

Open the chart page →

8,730
mariadbhelmforgeVerified publisher2.1.11 of 1See more

mariadb helmforge 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/mariadb:12.3.3805c8e104bd5
acl@2.3.2-1build1.1
no fix listed

Open the chart page →

1,681
matomohelmforgeVerified publisher2.3.01 of 3See more

matomo helmforge 2.3.0

1 of the 3 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/matomo:5.13.0-apache369723bd31cd
acl@2.3.2-2+b1
no fix listed

Open the chart page →

2,493
uptime-kumahelmforgeVerified publisher1.5.131 of 1See more

uptime-kuma helmforge 1.5.13

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
acl@2.3.1-3
no fix listed

Open the chart page →

31,207
valkeyhelmforgeVerified publisher2.0.41 of 1See more

valkey helmforge 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
valkey/valkey:9.1.2c123e3715db6
acl@2.3.2-2+b1
no fix listed

Open the chart page →

881
vaultwardenhelmforgeVerified publisher1.14.11 of 1See more

vaultwarden helmforge 1.14.1

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
vaultwarden/server:1.37.31587c45feaa4
acl@2.3.2-2+b1
no fix listed

Open the chart page →

1,549
mywebapphelm-nginxVerified publisher0.1.01 of 1See more

mywebapp helm-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
acl@2.3.2-2+b1
no fix listed

Open the chart page →

1,623
helmuphelmupVerified publisher0.1.03 of 3See more

helmup helmup 0.1.0

3 of the 3 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
acl@2.3.1-3
no fix listed
sirrend/helmup-github-scraper:0.1.47ca688c7abf5
acl@2.3.1-3
no fix listed
sirrend/helmup-notifications-service:0.1.3997866417011
acl@2.3.1-3
no fix listed

Open the chart page →

16,882
hivemq-platform-operatorhivemqOfficialVerified publisher0.2.261 of 1See more

hivemq-platform-operator hivemq 0.2.26

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
hivemq/hivemq-platform-operator:2.2.2a919f990141b
acl@2.3.2-2
no fix listed

Open the chart page →

999
hivemq-swarmhivemqOfficialVerified publisher0.2.701 of 1See more

hivemq-swarm hivemq 0.2.70

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
hivemq/hivemq-swarm:4.54.0f9746d5d70fa
acl@2.3.2-1build1.1
no fix listed

Open the chart page →

1,457
hiverhiverVerified publisher0.1.4510 of 10See more

hiver hiver 0.1.45

10 of the 10 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
hiversh/antigravity:0.1.45-microvm0e36d98402bc
acl@2.3.1-3
no fix listed
hiversh/browser:0.1.45-microvmb5048c6342ce
acl@2.3.1-3
no fix listed
hiversh/claude:0.1.45-microvm2fbf9f264498
acl@2.3.1-3
no fix listed
hiversh/codex:0.1.45-microvm4f43130f51e5
acl@2.3.1-3
no fix listed
hiversh/controller:0.1.45b0b85f8942c7
acl@2.3.1-3
no fix listed
hiversh/copilot:0.1.45-microvm50c07b84f298
acl@2.3.1-3
no fix listed
hiversh/gateway:0.1.45839226cc6e41
acl@2.3.1-1
no fix listed
hiversh/node:0.1.45-alpine-microvm836a37641941
acl@2.3.1-3
no fix listed
hiversh/openclaw:0.1.45-microvm958b7ebb4eb4
acl@2.3.1-3
no fix listed
hiversh/python:0.1.45-3.13-alpine-microvm63a5ae179a9f
acl@2.3.1-3
no fix listed

Open the chart page →

22,479
holoinsightholoinsight0.2.52 of 6See more

holoinsight holoinsight 0.2.5

2 of the 6 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ceresdb/ceresdb-server:v1.0.053b2d0dbba1f
acl@2.2.53-6
no fix listed
library/elasticsearch:7.16.18d5fd89230d7
acl@2.2.53-6
no fix listed

Open the chart page →

27,978
refineryhoneycomb3.4.01 of 2See more

refinery honeycomb 3.4.0

1 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/redis:8.4a17e6c4fec82
acl@2.3.2-2+b1
no fix listed

Open the chart page →

612
htnn-controllerhtnnVerified publisher0.5.01 of 1See more

htnn-controller htnn 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/mosn/htnn-controller:v0.3.1c379e66246be
acl@2.3.1-1
no fix listed

Open the chart page →

4,394

Container images carrying it

2,562 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
registry.gitlab.com/gitlab-org/build/cng/kubectl:v19.4.048ee51dd67d4
acl@2.3.2-2+b1
no fix listed
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
acl@2.2.53-6
no fix listed
1
registry.gitlab.com/school_guy/docker-typo3:13.4.30-197d868ed76185d7270d
acl@2.3.1-3
no fix listed
1
registry.k8s.io/csi-secrets-store/driver:v1.6.1b48d7d13dd06
acl@2.3.1-3
no fix listed
1
registry.k8s.io/git-sync/git-sync:v4.5.00e64aedb0d0a
acl@2.3.2-2+b1
no fix listed
1
registry.k8s.io/git-sync/git-sync:v4.1.0fd9722fd02e3
acl@2.3.1-3
no fix listed
1
registry.k8s.io/node-problem-detector/node-problem-detector:v0.8.2052f0618e9bc2
acl@2.3.1-3
no fix listed
1
registry.k8s.io/node-problem-detector/node-problem-detector:v1.35.1c380751accc5
acl@2.3.1-3
no fix listed
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
acl@2.3.1-3
no fix listed
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.9.0f9d65db8bda2
acl@2.3.1-3
no fix listed
1
registry.k8s.io/sig-storage/nfsplugin:v4.13.41eb5a85180a4
acl@2.3.1-3
no fix listed
1
registry.k8s.io/sig-storage/nfsplugin:v4.11.0ce5b5ccd5eb0
acl@2.3.1-3
no fix listed
1

syft 1.42.1 · advisories as of 23 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.