StackRadar

CVE-2026-54370

High

Advisory

Published 29 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.2
base score, highest
EPSS
0.001
0th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,518
of 17,832 indexed, latest versions
Container images
2,500
deployed by those charts
Fix available
2 of 2
affected packages

CVE-2026-54370 affecting package acl for versions less than 2.4.0-1

Carried by container images the latest versions of 2,518 of 17,832 indexed charts deploy, on 2,500 images.

Affected packageAffected versionsFixed inImages
acldeb2.2.52-1, 2.2.52-3, 2.2.52-3build1, 2.2.53-6+8 more2.4.0-12,497
aclrpm2.3.1-2.azl32.4.0-13
OSV records
DEBIAN-CVE-2026-54370UBUNTU-CVE-2026-54370AZL-91394ECHO-ae30-49be-9cc5

Charts affected

2,518 by stars
ChartLatestAffected imagesRadar Score
paperless-ngxoli-the-devVerified publisher1.1.11 of 1See more

paperless-ngx oli-the-dev 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
acl@2.3.2-2+b1
no fix listed

Open the chart page →

4,703
cron-jobonechart-slVerified publisher0.73.71 of 1See more

cron-job onechart-sl 0.73.7

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/debian:stable-slim5bc3287b2540
acl@2.3.2-2+b1
no fix listed

Open the chart page →

579
onedevonedev11.9.01 of 1See more

onedev onedev 11.9.0

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
1dev/server:11.9.0cd5b12fe5471
acl@2.3.2-1build1.1
no fix listed

Open the chart page →

6,224
ontoserverontoserverVerified publisher0.5.21 of 2See more

ontoserver ontoserver 0.5.2

1 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/postgres:16a3b7f434b2dc
acl@2.3.2-2+b1
no fix listed

Open the chart page →

1,268
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
onyxdotapp/onyx-backend:latest60e83a098ae4
acl@2.3.2-2+b1
no fix listed

Open the chart page →

6,604
erigonop-chartsVerified publisher0.0.51 of 2See more

erigon op-charts 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
testinprod/op-erigon:latest0a125bd77a2d
acl@2.3.1-3
no fix listed

Open the chart page →

2,922
opds-shelfopds-shelfVerified publisher0.4.01 of 3See more

opds-shelf opds-shelf 0.4.0

1 of the 3 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/calibre-web:latest0767226fcf20
acl@2.3.2-1build1.1
no fix listed

Open the chart page →

4,532
commonground-gatewayopencatalogi1.5.31 of 7See more

commonground-gateway opencatalogi 1.5.3

1 of the 7 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/gateway-ui:stag6a5594b7b32c
acl@2.3.1-3
no fix listed

Open the chart page →

9,800
opentickopenchartVerified publisher0.1.01 of 1See more

opentick openchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/nginx:1.25.5a484819eb602
acl@2.3.1-3
no fix listed

Open the chart page →

5,752
jobopen-charts2.0.01 of 1See more

job open-charts 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/ubuntu:latest2260313b31c8
acl@2.3.2-2
no fix listed

Open the chart page →

791
bbsimopencord4.8.111 of 1See more

bbsim opencord 4.8.11

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
voltha/bbsim:1.16.7d90403d58016
acl@2.2.52-3build1
no fix listed

Open the chart page →

3,949
bbsim-sadis-serveropencord0.3.51 of 1See more

bbsim-sadis-server opencord 0.3.5

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
voltha/bbsim-sadis-server:0.4.0762b272d439e
acl@2.2.52-3build1
no fix listed

Open the chart page →

3,763
cdn-remoteopencord0.2.42 of 3See more

cdn-remote opencord 0.2.4

2 of the 3 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
omecproject/cdn-antmedia:1.0.0b4ae7d0d6b74
acl@2.2.52-3build1
no fix listed
omecproject/cdn-video-repo:1.0.0d59ccb138ffb
acl@2.2.52-3
no fix listed

Open the chart page →

63,962
comacopencord1.0.03 of 9See more

comac opencord 1.0.0

3 of the 9 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
acl@2.2.52-3
no fix listed
omecproject/onos-progran:1.0.05715e5648aa0
acl@2.2.52-3
no fix listed
omecproject/progran-synchronizer:comac-1.0.0d109a8e57e71
acl@2.2.52-3
no fix listed

Open the chart page →

255,903
comac-cuopencord0.1.11 of 4See more

comac-cu opencord 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ngick8stesting/c3po-mmeinit:latest1e764eab77b4
acl@2.2.52-3build1
no fix listed

Open the chart page →

8,249
comac-platformopencord0.0.171 of 11See more

comac-platform opencord 0.0.17

1 of the 11 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
acl@2.2.52-3
no fix listed

Open the chart page →

81,307
freeradiusopencord1.0.41 of 1See more

freeradius opencord 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
freeradius/freeradius-server:3.0.2121c8bfa904d8
acl@2.2.52-3build1
no fix listed

Open the chart page →

15,803
mcord-cdn-remoteopencord0.1.62 of 2See more

mcord-cdn-remote opencord 0.1.6

2 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
omecproject/cdn-video-repo:remote-v3d59ccb138ffb
acl@2.2.52-3
no fix listed
woojoong/wowza:latestec230db19652
acl@2.2.52-3build1
no fix listed

Open the chart page →

43,239
mcord-cdn-remote-freeopencord0.1.31 of 1See more

mcord-cdn-remote-free opencord 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
omecproject/cdn-video-repo:remote-v3d59ccb138ffb
acl@2.2.52-3
no fix listed

Open the chart page →

29,687
mcord-control-planeopencord0.2.22 of 5See more

mcord-control-plane opencord 0.2.2

2 of the 5 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ngick8stesting/c3po-mme:mwca-mme-debug8dd6dea45be4
acl@2.2.52-3
no fix listed
ngick8stesting/c3po-mmeinit:latest1e764eab77b4
acl@2.2.52-3build1
no fix listed

Open the chart page →

16,049
oaisimopencord0.1.72 of 3See more

oaisim opencord 0.1.7

2 of the 3 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
omecproject/lte-softmodem:1.1.0b5ddd36ec20c
acl@2.2.52-3build1
no fix listed
omecproject/lte-uesoftmodem:1.1.0686f8bc37d8c
acl@2.2.52-3build1
no fix listed

Open the chart page →

14,948
omec-control-planeopencord0.1.315 of 8See more

omec-control-plane opencord 0.1.31

5 of the 8 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
omecproject/c3po-hss:master-latest638671ef4842
acl@2.2.52-3
no fix listed
omecproject/c3po-hssdb:master-latest28a90cc26716
acl@2.2.53-6
no fix listed
omecproject/mme-exporter:paging-latestbcc5f19fd676
acl@2.2.52-3build1
no fix listed
omecproject/ngic-cp:central-cp-multi-upfs-latest24a389a0a4fe
acl@2.2.52-3build1
no fix listed
omecproject/openmme:master-latest64776cb9edb3
acl@2.2.52-3
no fix listed

Open the chart page →

105,949
onosopencord3.0.21 of 1See more

onos opencord 3.0.2

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
onosproject/onos:2.2.144914a8d4b3f
acl@2.2.52-3build1
no fix listed

Open the chart page →

12,978
onos-progranopencord1.2.71 of 2See more

onos-progran opencord 1.2.7

1 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
muluder/prograncontrollermcord:0.1.843b597a93da7
acl@2.2.52-3
no fix listed

Open the chart page →

96,028
ovspluginopencord1.0.21 of 1See more

ovsplugin opencord 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
gopinatht/ovs-plugin-installer:latest632cb2e9c399
acl@2.2.52-3
no fix listed

Open the chart page →

4,202
ponsimv2opencord1.2.31 of 2See more

ponsimv2 opencord 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
voltha/voltha-tester:1.7.0655c3048a602
acl@2.2.52-3
no fix listed

Open the chart page →

66,336
sebaopencord1.0.06 of 17See more

seba opencord 1.0.0

6 of the 17 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
tpdock/freeradius:2.2.93da600c95a49
acl@2.2.52-3
no fix listed
voltha/voltha-cli:1.6.0c4e41e92f046
acl@2.2.52-3
no fix listed
voltha/voltha-envoy:1.6.059ab2a00f712
acl@2.2.52-1
no fix listed
voltha/voltha-netconf:1.6.037f80524c207
acl@2.2.52-3
no fix listed
voltha/voltha-ofagent:1.6.09ee8c1f4428c
acl@2.2.52-3
no fix listed
voltha/voltha-voltha:1.6.0ff596b62de59
acl@2.2.52-3
no fix listed

Open the chart page →

362,480
voltha-infraopencord2.14.04 of 10See more

voltha-infra opencord 2.14.0

4 of the 10 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
freeradius/freeradius-server:3.0.2121c8bfa904d8
acl@2.2.52-3build1
no fix listed
library/ubuntu:16.041f1a2d56de1d
acl@2.2.52-3
no fix listed
voltha/bbsim-sadis-server:0.3.5259fc3a03f4e
acl@2.2.52-3build1
no fix listed
voltha/voltha-onos:5.1.8e038acb950d3
acl@2.2.52-3build1
no fix listed

Open the chart page →

41,306
opencost-parquet-exporteropencostVerified publisher0.3.11 of 1See more

opencost-parquet-exporter opencost 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/opencost/opencost-parquet-exporter:v0.2.1ce85ef0ce665
acl@2.3.1-3
no fix listed

Open the chart page →

10,950
dokuopenlit0.1.41 of 3See more

doku openlit 0.1.4

1 of the 3 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:latest42acb460c63b
acl@2.3.1-1
no fix listed

Open the chart page →

1,657
openlitopenlit1.24.01 of 3See more

openlit openlit 1.24.0

1 of the 3 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:24.4.12e6587b81a26
acl@2.2.53-6
no fix listed

Open the chart page →

5,250
openlit-controlleropenlit0.10.01 of 1See more

openlit-controller openlit 0.10.0

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/openlit/openlit-controller:0.10.0165efd4469ea
acl@2.3.1-3
no fix listed

Open the chart page →

1,416
openpanelopenpanel0.9.01 of 6See more

openpanel openpanel 0.9.0

1 of the 6 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:25.10.2.65e019438e1e05
acl@2.3.1-1
no fix listed

Open the chart page →

3,508
llm-stackopenproject-helm-chartsVerified publisher1.1.02 of 2See more

llm-stack openproject-helm-charts 1.1.0

2 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
apache/apisix:3.16.0-ubuntu5e47692cac00
acl@2.3.2-1build1.1
no fix listed
library/python:3.12-slim78387bc3881b
acl@2.3.2-2+b1
no fix listed

Open the chart page →

2,068
fineractopenshift0.1.11 of 4See more

fineract openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
acl@2.3.2-2+b1
no fix listed

Open the chart page →

8,024
sohaopensohaVerified publisher0.1.101See more

soha opensoha 0.1.10

1 container image this version deploys carries CVE-2026-54370.

Container imageDigestPackageFixed in
pgvector/pgvector:0.8.5-pg18-trixie9d2e61c7352b
acl@2.3.2-2+b1
no fix listed

Open the chart page →

—
open-vpnopenvpn0.0.11 of 1See more

open-vpn openvpn 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/openvpn-as:version-2.8.6-916f8e7d-ubuntu184ee0764310e7
acl@2.2.52-3build1
no fix listed

Open the chart page →

78,680
openvscode-serveropenvscode-server-helmVerified publisher2.7.381 of 2See more

openvscode-server openvscode-server-helm 2.7.38

1 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
antiantiops/vscode-browser-docker:1.138.0d1182e8090a7
acl@2.3.2-1build1.1
no fix listed

Open the chart page →

4,265
terminalsopen-webui0.7.02 of 2See more

terminals open-webui 0.7.0

2 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/open-webui/terminals:latest5d2fd44366a4
acl@2.3.2-2+b1
no fix listed
ghcr.io/open-webui/terminals-operator:latest6287ce8be502
acl@2.3.2-2+b1
no fix listed

Open the chart page →

2,106
openwhiskopenwhisk1.0.01 of 10See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
openwhisk/ow-utils:1.0.0c80dba0de3aa
acl@2.2.52-3build1
no fix listed

Open the chart page →

99,366
issuegenopsmxVerified publisher1.0.21 of 1See more

issuegen opsmx 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
opsmx11/issuegen:v2.1.05c50ca123d88
acl@2.2.52-1
no fix listed

Open the chart page →

26,434
hiveopstty0.1.91 of 4See more

hive opstty 0.1.9

1 of the 4 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:16233f361c5819
acl@2.3.1-3
no fix listed

Open the chart page →

4,747
grrosdfir-infrastructureVerified publisher1.0.32 of 5See more

grr osdfir-infrastructure 1.0.3

2 of the 5 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/mariadb:11.3.2e101f9db3191
acl@2.3.1-1
no fix listed
ghcr.io/google/fleetspeak:v0.1.17cd264d33efd4
acl@2.3.1-3
no fix listed

Open the chart page →

11,107
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.025 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

25 of the 40 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
bitnamilegacy/git:latest4b08d0c5af8d
acl@2.3.1-3
no fix listed
chromadb/chroma:1.5.7fc8dc8e11fb2
acl@2.3.2-2+b1
no fix listed
library/mariadb:11.3.2e101f9db3191
acl@2.3.1-1
no fix listed
yetiplatform/yeti:2.9.09bcbe2650a14
acl@2.3.2-2+b1
no fix listed
yetiplatform/yeti-frontend:2.9.0873ef15d267b
acl@2.3.2-2+b1
no fix listed
ghcr.io/google/fleetspeak:v0.1.17cd264d33efd4
acl@2.3.1-3
no fix listed
ghcr.io/openrelik/openrelik-mediator:latest42efc445b19e
acl@2.3.1-3
no fix listed
ghcr.io/openrelik/openrelik-metrics:latest3d0f1ddeebf5
acl@2.3.1-3
no fix listed
ghcr.io/openrelik/openrelik-server:latestce1132261523
acl@2.3.1-3
no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
acl@2.3.2-1build1.1
no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestb175cc61959a
acl@2.3.2-1build1.1
no fix listed
ghcr.io/openrelik/openrelik-worker-bulkextractor:latest67498ee2e639
acl@2.3.2-1build1.1
no fix listed
ghcr.io/openrelik/openrelik-worker-capa:latest71323a4f3fc5
acl@2.3.2-1build1.1
no fix listed
ghcr.io/openrelik/openrelik-worker-chromecreds:latest76d4fbcc6ff0
acl@2.3.2-1build1.1
no fix listed
ghcr.io/openrelik/openrelik-worker-cloud-logs:latesta5d7e3cf71d3
acl@2.3.2-1build1.1
no fix listed
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
acl@2.3.2-1build1.1
no fix listed
ghcr.io/openrelik/openrelik-worker-dfindexeddb:latest31966a825782
acl@2.3.2-1build1.1
no fix listed
ghcr.io/openrelik/openrelik-worker-extraction:latestec9fc5864cd5
acl@2.3.2-1build1.1
no fix listed
ghcr.io/openrelik/openrelik-worker-floss:latest7a331eb83c6a
acl@2.3.2-1build1.1
no fix listed
ghcr.io/openrelik/openrelik-worker-grep:latest470ff3529746
acl@2.3.2-1build1.1
no fix listed
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
acl@2.3.2-1build1.1
no fix listed
ghcr.io/openrelik/openrelik-worker-plaso:latest75537ea8c851
acl@2.3.2-1build1.1
no fix listed
ghcr.io/openrelik/openrelik-worker-strings:latest6e05055b701f
acl@2.3.2-1build1.1
no fix listed
ghcr.io/openrelik/openrelik-worker-timesketch:latest4cb88b603cdc
acl@2.3.2-1build1.1
no fix listed
ghcr.io/openrelik/openrelik-worker-yara:latestbd7fbf4505b5
acl@2.3.2-1build1.1
no fix listed

Open the chart page →

200,900
yetiosdfir-infrastructureVerified publisher1.0.52 of 4See more

yeti osdfir-infrastructure 1.0.5

2 of the 4 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
yetiplatform/yeti:latest9c3006cedcca
acl@2.3.2-2+b1
no fix listed
yetiplatform/yeti-frontend:latest709064278c7e
acl@2.3.2-2+b1
no fix listed

Open the chart page →

6,893
fluent-bitot-container-kit0.0.31 of 2See more

fluent-bit ot-container-kit 0.0.3

1 of the 2 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
quay.io/opstree/fluent-bit:5.0.3391eef5a68ff
acl@2.3.2-2+b1
no fix listed

Open the chart page →

925
webot-container-kit0.1.01 of 1See more

web ot-container-kit 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
acl@2.3.2-2+b1
no fix listed

Open the chart page →

1,965
workerot-container-kit0.1.01 of 1See more

worker ot-container-kit 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
acl@2.3.2-2+b1
no fix listed

Open the chart page →

1,965
akash-hostname-operatorovrclk-211.5.11 of 1See more

akash-hostname-operator ovrclk-2 11.5.1

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/akash-network/provider:0.6.88c780ae8d1bb
acl@2.3.2-1build1.1
no fix listed

Open the chart page →

3,561
akash-inventory-operatorovrclk-211.5.11 of 1See more

akash-inventory-operator ovrclk-2 11.5.1

1 of the 1 container images this version deploys carry CVE-2026-54370.

Container imageDigestPackageFixed in
ghcr.io/akash-network/provider:0.6.88c780ae8d1bb
acl@2.3.2-1build1.1
no fix listed

Open the chart page →

3,561

Container images carrying it

2,500 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

No deployed image carries CVE-2026-54370.

syft 1.42.1 · advisories as of 22 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.