StackRadar

CVE-2026-54370

High

Advisory

Published 29 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.2
base score, highest
EPSS
0.001
0th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,562
of 17,832 indexed, latest versions
Container images
2,562
deployed by those charts
Fix available
2 of 2
affected packages

CVE-2026-54370 affecting package acl for versions less than 2.4.0-1

Carried by container images the latest versions of 2,562 of 17,832 indexed charts deploy, on 2,562 images.

Affected packageAffected versionsFixed inImages
acldeb2.2.52-1, 2.2.52-3, 2.2.52-3build1, 2.2.53-6+8 more2.4.0-12,559
aclrpm2.3.1-2.azl32.4.0-13
OSV records
DEBIAN-CVE-2026-54370UBUNTU-CVE-2026-54370AZL-91394ECHO-ae30-49be-9cc5

Charts affected

2,562 by stars
ChartLatestAffected imagesRadar Score
prometheus-cloudwatch-exporterprometheus-communityVerified publisher0.28.21 of 1See more

prometheus-cloudwatch-exporter prometheus-community 0.28.2

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
prom/cloudwatch-exporter:v0.16.071c2e988af06
acl@2.3.2-1build1
no fix listed

Open the chart page →

3,495
stalwart-mailstalwart-mailVerified publisher2.0.101 of 1See more

stalwart-mail stalwart-mail 2.0.10

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
stalwartlabs/stalwart:v0.16.2074ca4f7f6885
acl@2.3.2-2+b1
no fix listed

Open the chart page →

1,470
openvpn-asstenicVerified publisher0.1.91 of 1See more

openvpn-as stenic 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/openvpn-as:version-2.8.6-916f8e7d-ubuntu184ee0764310e7
acl@2.2.52-3build1
no fix listed

Open the chart page →

78,699
jellyfinutkuozdemirVerified publisher2.0.01 of 1See more

jellyfin utkuozdemir 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
linuxserver/jellyfin:10.7.72427dde159a2
acl@2.2.53-6
no fix listed

Open the chart page →

8,006
camel-kcamel-kVerified publisher2.11.01 of 1See more

camel-k camel-k 2.11.0

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
apache/camel-k:2.11.0d173e7efe258
acl@2.3.2-2
no fix listed

Open the chart page →

1,405
glasskube-operatorglasskubeOfficialVerified publisher0.12.21 of 3See more

glasskube-operator glasskube 0.12.2

1 of the 3 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
glasskube/operator:0.12.2be5133100d63
acl@2.3.1-1
no fix listed

Open the chart page →

12,267
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
acl@2.3.1-3
no fix listed

Open the chart page →

5,456
milvusmilvus-helm5.0.282 of 4See more

milvus milvus-helm 5.0.28

2 of the 4 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
apachepulsar/pulsar:3.0.79c9947de139d
acl@2.3.1-1
no fix listed
milvusdb/etcd:3.5.25-r1fededb2f2d63
acl@2.3.1-1
no fix listed

Open the chart page →

11,277
prefect-serverprefectVerified publisher2026.9.141419102 of 2See more

prefect-server prefect 2026.9.14141910

2 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:14.13.0df6ec02e2b9a
acl@2.3.1-3
no fix listed
prefecthq/prefect:3.8.6-python3.11f518ebb9c353
acl@2.3.2-2+b1
no fix listed

Open the chart page →

5,686
rocketmqrocketmq12.6.01 of 2See more

rocketmq rocketmq 12.6.0

1 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
apache/rocketmq:5.4.0319cd8a81ed1
acl@2.3.2-1build1.1
no fix listed

Open the chart page →

6,493
snipeitt3n3.4.11 of 2See more

snipeit t3n 3.4.1

1 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
snipe/snipe-it:v6.0.1455fb7636a98c
acl@2.2.53-6
no fix listed

Open the chart page →

84,764
bitbucketatlassian-data-centerVerified publisher2.0.151 of 1See more

bitbucket atlassian-data-center 2.0.15

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
atlassian/bitbucket:10.2.705933f2b1cfd
acl@2.3.2-1build1.1
no fix listed

Open the chart page →

32,050
zookeepercloudpirates-zookeeperVerified publisher0.15.01 of 1See more

zookeeper cloudpirates-zookeeper 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/zookeeper:3.9.57d0f24ebb67b
acl@2.3.1-1
no fix listed

Open the chart page →

3,031
codefreshcodefresh-onpremOfficialVerified publisher2.12.164 of 42See more

codefresh codefresh-onprem 2.12.16

4 of the 42 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
bitnamilegacy/consul:1.21.4-debian-12-r133ae872fc99d
acl@2.3.1-3
no fix listed
bitnamilegacy/mongodb:7.0.14-debian-12-r321e8f8baa432
acl@2.3.1-3
no fix listed
bitnamilegacy/rabbitmq:4.1.39e635efba431
acl@2.3.1-3
no fix listed
quay.io/codefresh/redis:7.4.3-debian-12-r0935f97598255
acl@2.3.1-3
no fix listed

Open the chart page →

15,652
contourcontour0.8.01 of 2See more

contour contour 0.8.0

1 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
envoyproxy/envoy:v1.38.4447f857a0146
acl@2.3.1-1
no fix listed

Open the chart page →

1,574
apim3graviteeioVerified publisher4.12.202 of 4See more

apim3 graviteeio 4.12.20

2 of the 4 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
graviteeio/apim-gateway:4.12.20-debian8f1a14449381
acl@2.3.2-2+b1
no fix listed
graviteeio/apim-management-api:4.12.20-debiand30d085395ca
acl@2.3.2-2+b1
no fix listed

Open the chart page →

4,383
redisgroundhog2k2.4.71 of 1See more

redis groundhog2k 2.4.7

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/redis:8.10.18a1efc5f4795
acl@2.3.2-2+b1
no fix listed

Open the chart page →

602
wordpressgroundhog2k0.16.51 of 1See more

wordpress groundhog2k 0.16.5

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/wordpress:7.1.1-apache51464c8fdb10
acl@2.3.2-2+b1
no fix listed

Open the chart page →

3,064
memcachedkubelauncherVerified publisher0.1.321 of 1See more

memcached kubelauncher 0.1.32

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/memcacheddigest-pinnedb599ca6b3ff3
acl@2.3.2-2
no fix listed

Open the chart page →

700
mysqlkubelauncherVerified publisher0.4.41 of 1See more

mysql kubelauncher 0.4.4

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/mysqldigest-pinnede9609bd50416
acl@2.3.2-2
no fix listed

Open the chart page →

1,042
postgresqlkubelauncherVerified publisher0.4.31 of 1See more

postgresql kubelauncher 0.4.3

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/postgresqldigest-pinned1a27e11e5925
acl@2.3.2-2
no fix listed

Open the chart page →

1,226
memgraphmemgraphVerified publisher1.0.71 of 2See more

memgraph memgraph 1.0.7

1 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
memgraph/memgraph:3.13.1bd3fe13228f4
acl@2.3.2-1build1.1
no fix listed

Open the chart page →

1,299
velero-uiotwldVerified publisher0.16.01 of 1See more

velero-ui otwld 0.16.0

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
otwld/velero-ui:0.10.31c228d9ef71b
acl@2.3.1-3
no fix listed

Open the chart page →

1,409
stackstorm-hastackstormVerified publisher1.1.012 of 17See more

stackstorm-ha stackstorm 1.1.0

12 of the 17 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
stackstorm/st2actionrunner:3.888235ba70cad
acl@2.2.53-6
no fix listed
stackstorm/st2api:3.86f56d239d280
acl@2.2.53-6
no fix listed
stackstorm/st2auth:3.833ecfda16608
acl@2.2.53-6
no fix listed
stackstorm/st2garbagecollector:3.84e3f8c7ca52d
acl@2.2.53-6
no fix listed
stackstorm/st2notifier:3.8f190a6212195
acl@2.2.53-6
no fix listed
stackstorm/st2rulesengine:3.8259503496ff9
acl@2.2.53-6
no fix listed
stackstorm/st2scheduler:3.8b1de2055c362
acl@2.2.53-6
no fix listed
stackstorm/st2sensorcontainer:3.8b1a338f64773
acl@2.2.53-6
no fix listed
stackstorm/st2stream:3.81c8904a3bf67
acl@2.2.53-6
no fix listed
stackstorm/st2timersengine:3.81bf35bfaf00c
acl@2.2.53-6
no fix listed
stackstorm/st2web:3.809989a26c8b7
acl@2.2.53-6
no fix listed
stackstorm/st2workflowengine:3.819fdfffdbba8
acl@2.2.53-6
no fix listed

Open the chart page →

713,829
supabasetokens-studioVerified publisher1.0.06 of 14See more

supabase tokens-studio 1.0.0

6 of the 14 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
darthsim/imgproxy:v3.26476cb08c816a
acl@2.3.2-1build1
no fix listed
library/kong:3.8.0fd78090e9e77
acl@2.3.1-1
no fix listed
supabase/edge-runtime:v1.59.0eff9c554d649
acl@2.3.1-3
no fix listed
supabase/postgres-meta:v0.84.2d0a96973e9f1
acl@2.3.1-3
no fix listed
supabase/realtime:v2.33.8d207e6e23ad3
acl@2.3.1-3
no fix listed
supabase/studio:20241021-9f9b08326d8070c55e9
acl@2.3.1-3
no fix listed

Open the chart page →

23,350
wekanwekanVerified publisher11.90.02 of 3See more

wekan wekan 11.90.0

2 of the 3 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/wekan/ferretdb:latestebed9a5eaae0
acl@2.3.2-2+b1
no fix listed
ghcr.io/wekan/wekan:v11.90078ca230c0df
acl@2.3.2-2+b1
no fix listed

Open the chart page →

1,723
renterdartur9010Verified publisher1.4.42 of 2See more

renterd artur9010 1.4.4

2 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
artur9010/wait-for:v1.0.06b4de3ce8b0e
acl@2.3.1-3
no fix listed
ghcr.io/siafoundation/renterd:2.9.0e0334f124863
acl@2.3.1-3
no fix listed

Open the chart page →

8,707
cloudbeaveravistoVerified publisher1.1.71 of 1See more

cloudbeaver avisto 1.1.7

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
dbeaver/cloudbeaver:26.1.287ab86d00f8c
acl@2.3.2-1build1.1
no fix listed

Open the chart page →

1,876
budibasebudibase0.0.0-master3 of 7See more

budibase budibase 0.0.0-master

3 of the 7 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
budibase/database:2.1.0d90f656261c9
acl@2.3.1-3
no fix listed
budibase/proxy:3.41.38d780b6ee602
acl@2.3.2-2+b1
no fix listed
library/redis:latest8a1efc5f4795
acl@2.3.2-2+b1
no fix listed

Open the chart page →

9,809
csi-secrets-store-provider-azurecsi-secrets-store-provider-azureVerified publisher1.8.23 of 5See more

csi-secrets-store-provider-azure csi-secrets-store-provider-azure 1.8.2

3 of the 5 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
mcr.microsoft.com/oss/v2/kubernetes-csi/livenessprobe:v2.15.059b9d0348428
acl@2.3.1-2.azl3
2.4.0-1
mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.5.65f91243cfd60
acl@2.3.1-2.azl3
2.4.0-1
mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver-crds:v1.5.6cb0112636dc4
acl@2.3.1-2.azl3
2.4.0-1

Open the chart page →

2,232
paperless-ngxfmjstudios0.2.83 of 5See more

paperless-ngx fmjstudios 0.2.8

3 of the 5 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
apache/tika:2.9.0.092d055a84e9e
acl@2.3.1-1
no fix listed
gotenberg/gotenberg:8.0.1cf0b9a7ca3cf
acl@2.3.1-3
no fix listed
ghcr.io/paperless-ngx/paperless-ngx:2.10.1a132c2ac7c57
acl@2.3.1-3
no fix listed

Open the chart page →

31,518
bitcoindfold0.3.21 of 2See more

bitcoind fold 0.3.2

1 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
thesisrobot/bitcoind:v23.016b368e4d52c
acl@2.3.1-1
no fix listed

Open the chart page →

3,548
cubestoregadsme1.2.01 of 3See more

cubestore gadsme 1.2.0

1 of the 3 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
cubejs/cubestore:v1.5.334ac523a9bab
acl@2.3.1-3
no fix listed

Open the chart page →

3,103
gopaddlegopaddle-liteVerified publisher5.0.01 of 1See more

gopaddle gopaddle-lite 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
gopaddle/gopaddle:5.0435359250b63
acl@2.3.1-1
no fix listed

Open the chart page →

5,187
hivemq-operatorhivemqOfficialVerified publisher0.11.621 of 2See more

hivemq-operator hivemq 0.11.62

1 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
hivemq/hivemq-operator:4.7.10241d6a8e1963
acl@2.3.1-1
no fix listed

Open the chart page →

8,054
cassandrakubelauncherVerified publisher0.1.271 of 1See more

cassandra kubelauncher 0.1.27

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/cassandradigest-pinnedb66aba320083
acl@2.3.2-2
no fix listed

Open the chart page →

1,620
etcdkubelauncherVerified publisher0.4.31 of 1See more

etcd kubelauncher 0.4.3

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/etcddigest-pinned8ab954711fb9
acl@2.3.2-2
no fix listed

Open the chart page →

885
kafkakubelauncherVerified publisher0.1.261 of 1See more

kafka kubelauncher 0.1.26

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/kafkadigest-pinned43e1085cd0a8
acl@2.3.2-2
no fix listed

Open the chart page →

1,504
keycloakkubelauncherVerified publisher0.4.41 of 1See more

keycloak kubelauncher 0.4.4

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/keycloakdigest-pinnedafe3bd73d7cf
acl@2.3.2-2
no fix listed

Open the chart page →

1,426
kubectlkubelauncherVerified publisher0.2.111 of 1See more

kubectl kubelauncher 0.2.11

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/kubectldigest-pinned7280594a2f18
acl@2.3.2-2
no fix listed

Open the chart page →

1,334
mariadbkubelauncherVerified publisher0.5.71 of 1See more

mariadb kubelauncher 0.5.7

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/mariadbdigest-pinnede25056a6ec52
acl@2.3.2-2
no fix listed

Open the chart page →

1,180
mongodbkubelauncherVerified publisher0.4.51 of 1See more

mongodb kubelauncher 0.4.5

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/mongodbdigest-pinned9bc37ed78a8b
acl@2.3.2-2
no fix listed

Open the chart page →

1,446
openldapkubelauncherVerified publisher0.2.01 of 1See more

openldap kubelauncher 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/openldapdigest-pinned8978aa002bc0
acl@2.3.2-1build1.1
no fix listed

Open the chart page →

1,338
rabbitmqkubelauncherVerified publisher0.2.111 of 1See more

rabbitmq kubelauncher 0.2.11

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/rabbitmqdigest-pinnedff5a36a457f1
acl@2.3.2-1build1.1
no fix listed

Open the chart page →

1,176
rediskubelauncherVerified publisher0.5.11 of 1See more

redis kubelauncher 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/redisdigest-pinnedbcd8e9a6224f
acl@2.3.2-2
no fix listed

Open the chart page →

874
zookeeperkubelauncherVerified publisher0.2.111 of 1See more

zookeeper kubelauncher 0.2.11

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/zookeeperdigest-pinned7826e9caa461
acl@2.3.2-2
no fix listed

Open the chart page →

1,133
minecraft-proxyminecraft-server-chartsVerified publisher3.10.01 of 1See more

minecraft-proxy minecraft-server-charts 3.10.0

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
itzg/bungeecord:latestde76286c0e73
acl@2.3.2-2
no fix listed

Open the chart page →

2,812
openclawopenclawVerified publisher1.93.01 of 2See more

openclaw openclaw 1.93.0

1 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.56.7b1ba7b054af2
acl@2.3.2-1build1.1
no fix listed

Open the chart page →

3,149
quickwitquickwit0.8.171 of 1See more

quickwit quickwit 0.8.17

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
quickwit/quickwit:v0.8.2363ff56ce456
acl@2.3.1-3
no fix listed

Open the chart page →

3,554
transmission-openvpnutkuozdemirVerified publisher2.5.01 of 1See more

transmission-openvpn utkuozdemir 2.5.0

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
haugene/transmission-openvpn:4.0059216cfae4b
acl@2.2.53-6
no fix listed

Open the chart page →

11,697

Container images carrying it

2,562 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
registry.gitlab.com/gitlab-org/build/cng/kubectl:v19.4.048ee51dd67d4
acl@2.3.2-2+b1
no fix listed
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
acl@2.2.53-6
no fix listed
1
registry.gitlab.com/school_guy/docker-typo3:13.4.30-197d868ed76185d7270d
acl@2.3.1-3
no fix listed
1
registry.k8s.io/csi-secrets-store/driver:v1.6.1b48d7d13dd06
acl@2.3.1-3
no fix listed
1
registry.k8s.io/git-sync/git-sync:v4.5.00e64aedb0d0a
acl@2.3.2-2+b1
no fix listed
1
registry.k8s.io/git-sync/git-sync:v4.1.0fd9722fd02e3
acl@2.3.1-3
no fix listed
1
registry.k8s.io/node-problem-detector/node-problem-detector:v0.8.2052f0618e9bc2
acl@2.3.1-3
no fix listed
1
registry.k8s.io/node-problem-detector/node-problem-detector:v1.35.1c380751accc5
acl@2.3.1-3
no fix listed
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
acl@2.3.1-3
no fix listed
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.9.0f9d65db8bda2
acl@2.3.1-3
no fix listed
1
registry.k8s.io/sig-storage/nfsplugin:v4.13.41eb5a85180a4
acl@2.3.1-3
no fix listed
1
registry.k8s.io/sig-storage/nfsplugin:v4.11.0ce5b5ccd5eb0
acl@2.3.1-3
no fix listed
1

syft 1.42.1 · advisories as of 23 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.