StackRadar

CVE-2026-55153

High

Advisory

Published 14 Aug 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.1
base score, highest
EPSS
0.002
9th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
29
of 17,781 indexed, latest versions
Container images
31
deployed by those charts
Fix available
1 of 1
affected package

mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

Carried by container images the latest versions of 29 of 17,781 indexed charts deploy, on 31 images.

Affected packageAffected versionsFixed inImages
mchange-commons-javamaven0.2.11, 0.2.15, 0.2.19, 0.5.00.6.031
OSV records
GHSA-h84g-69h7-mw6v

Charts affected

29 by stars
ChartLatestAffected imagesRadar Score
crowdatlassian-data-centerVerified publisher2.0.151 of 2See more

crowd atlassian-data-center 2.0.15

1 of the 2 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
atlassian/crowd:7.2.3c81cc7d6bc9e
mchange-commons-java@0.5.0
0.6.0

Open the chart page →

1,415
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

107,811
feedbacksystemthm-mni-iiVerified publisher0.47.11 of 10See more

feedbacksystem thm-mni-ii 0.47.1

1 of the 10 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
thmmniii/fbs-runner:v1.27.186105349c1a3
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

28,534
soarv113assist-iot-cybersecurity-monitoring-soar0.1.31 of 5See more

soarv113 assist-iot-cybersecurity-monitoring-soar 0.1.3

1 of the 5 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_ir-thv:latestc8b6c7eaa0cd
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

17,896
nifid4nVerified publisher2.0.01 of 5See more

nifi d4n 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
apache/nifi-registry:1.26.07cdfd8deec92
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

5,398
atlas-cmmsf3k-techVerified publisher0.151.51 of 4See more

atlas-cmms f3k-tech 0.151.5

1 of the 4 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
intelloop/atlas-cmms-backend:v1.5.14c61bc3dd3f8
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

5,291
airbyteairbyte-v2Verified publisher2.2.03 of 10See more

airbyte airbyte-v2 2.2.0

3 of the 10 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
airbyte/server:2.2.070e125498a1c
mchange-commons-java@0.2.15
0.6.0
airbyte/worker:2.2.08060b88b29c8
mchange-commons-java@0.2.15
0.6.0
airbyte/workload-api-server:2.2.042093cff86e9
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

12,473
axelor-open-suiteaxelor-open-suiteVerified publisher7.2.581 of 2See more

axelor-open-suite axelor-open-suite 7.2.58

1 of the 2 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
pmoscode/axelor-open-suite:v7.2.57a58f4d762f5c
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

9,722
blackduck-alertblackduck8.4.01 of 4See more

blackduck-alert blackduck 8.4.0

1 of the 4 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
blackducksoftware/blackduck-alert:8.4.090cca32de2cc
mchange-commons-java@0.2.19
0.6.0

Open the chart page →

4,292
bluerange-serverbluerangeOfficialVerified publisher1.3.11 of 1See more

bluerange-server bluerange 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
bluerange/bluerange:26.1.307c8f73b55df
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

1,816
rundeckcloudnativeapp0.1.01 of 2See more

rundeck cloudnativeapp 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
rundeck/rundeck:3.0.16b13e8059ad72
mchange-commons-java@0.2.11
0.6.0

Open the chart page →

23,665
nifi-registryd4nVerified publisher1.0.01 of 2See more

nifi-registry d4n 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
apache/nifi-registry:1.26.07cdfd8deec92
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

5,398
apache-ranger-admindata-platform-stableVerified publisher0.2.01 of 2See more

apache-ranger-admin data-platform-stable 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
egdsandaru/apache-ranger-admin:1.0.0681baa1926f4
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

8,245
rundeckdwardu-helm-charts0.3.41 of 2See more

rundeck dwardu-helm-charts 0.3.4

1 of the 2 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
rundeck/rundeck:3.2.74d64fe56f767
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

19,802
teedygeek-cookbookVerified publisher6.2.01 of 1See more

teedy geek-cookbook 6.2.0

1 of the 1 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
sismics/docs:v1.10f4b0ef019cf1
mchange-commons-java@0.2.19
0.6.0

Open the chart page →

26,944
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.82 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

2 of the 5 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
geonetwork/gn-cloud-ogc-api-records-service:4.2.8-020c9bb761f67
mchange-commons-java@0.2.15
0.6.0
jingking/geonetwork-hnap:4.2.843e74ab234e1
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

34,754
video-analytics-demogpu-operator0.1.91 of 3See more

video-analytics-demo gpu-operator 0.1.9

1 of the 3 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
anguda/ant-media:2.5c435285fc241
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

15,722
ckanhelmforgeVerified publisher1.3.81 of 6See more

ckan helmforge 1.3.8

1 of the 6 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
ckan/ckan-solr:2.11-solr9ef8e5d3e6be1
mchange-commons-java@0.2.19
0.6.0

Open the chart page →

9,920
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
openbas/platform:2.0.5d986d80b0a75
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

25,017
nifi-registryimprowisedVerified publisher1.0.01 of 2See more

nifi-registry improwised 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
apache/nifi-registry:1.27.063b8e3e40742
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

5,320
mitre-siphonmitre-siphon0.2.91 of 4See more

mitre-siphon mitre-siphon 0.2.9

1 of the 4 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
ghcr.io/curium-rocks/mitre-siphon:main503c00321502
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

3,083
crowdmoxVerified publisher2.4.31 of 3See more

crowd mox 2.4.3

1 of the 3 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
atlassian/crowd:5.2.2ebf761c7d437
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

5,663
onedevonedev11.9.01 of 1See more

onedev onedev 11.9.0

1 of the 1 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
1dev/server:11.9.0cd5b12fe5471
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

6,037
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
trinodb/trino:45038c6f24ab1a4
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

21,211
reportportalreportportal5.7.21 of 8See more

reportportal reportportal 5.7.2

1 of the 8 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
reportportal/service-api:5.7.29df41f8fb320
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

25,737
atlassian-confluencesomeblackmagic3.4.11 of 1See more

atlassian-confluence someblackmagic 3.4.1

1 of the 1 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
atlassian/confluence-server:7.10.03b9222ab32ef
mchange-commons-java@0.2.19
0.6.0

Open the chart page →

13,605
trinostatcan1.23.41 of 2See more

trino statcan 1.23.4

1 of the 2 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
trinodb/trino:405ee80ab5eeab2
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

13,767
rundecksvtech-public-helm-charts1.0.01 of 2See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
mchange-commons-java@0.2.15
0.6.0

Open the chart page →

18,756
orchestratremolo3.1.551 of 5See more

orchestra tremolo 3.1.55

1 of the 5 container images this version deploys carry CVE-2026-55153.

Container imageDigestPackageFixed in
ghcr.io/openunison/openunison-k8s:1.0.509ad450220ab9
mchange-commons-java@0.5.0
0.6.0

Open the chart page →

7,637

Container images carrying it

31 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
apache/nifi-registry:1.26.07cdfd8deec92
mchange-commons-java@0.2.15
0.6.0
2
1dev/server:11.9.0cd5b12fe5471
mchange-commons-java@0.2.15
0.6.0
1
airbyte/server:2.2.070e125498a1c
mchange-commons-java@0.2.15
0.6.0
1
airbyte/worker:2.2.08060b88b29c8
mchange-commons-java@0.2.15
0.6.0
1
airbyte/workload-api-server:2.2.042093cff86e9
mchange-commons-java@0.2.15
0.6.0
1
anguda/ant-media:2.5c435285fc241
mchange-commons-java@0.2.15
0.6.0
1
apache/nifi-registry:1.27.063b8e3e40742
mchange-commons-java@0.2.15
0.6.0
1
assistiot/cybersecurity-monitoring_ir-thv:latestc8b6c7eaa0cd
mchange-commons-java@0.2.15
0.6.0
1
atlassian/confluence-server:7.10.03b9222ab32ef
mchange-commons-java@0.2.19
0.6.0
1
atlassian/crowd:7.2.3c81cc7d6bc9e
mchange-commons-java@0.5.0
0.6.0
1
atlassian/crowd:5.2.2ebf761c7d437
mchange-commons-java@0.2.15
0.6.0
1
blackducksoftware/blackduck-alert:8.4.090cca32de2cc
mchange-commons-java@0.2.19
0.6.0
1
bluerange/bluerange:26.1.307c8f73b55df
mchange-commons-java@0.2.15
0.6.0
1
ckan/ckan-solr:2.11-solr9ef8e5d3e6be1
mchange-commons-java@0.2.19
0.6.0
1
egdsandaru/apache-ranger-admin:1.0.0681baa1926f4
mchange-commons-java@0.2.15
0.6.0
1
geonetwork/gn-cloud-ogc-api-records-service:4.2.8-020c9bb761f67
mchange-commons-java@0.2.15
0.6.0
1
intelloop/atlas-cmms-backend:v1.5.14c61bc3dd3f8
mchange-commons-java@0.2.15
0.6.0
1
jingking/geonetwork-hnap:4.2.843e74ab234e1
mchange-commons-java@0.2.15
0.6.0
1
openbas/platform:2.0.5d986d80b0a75
mchange-commons-java@0.2.15
0.6.0
1
pmoscode/axelor-open-suite:v7.2.57a58f4d762f5c
mchange-commons-java@0.2.15
0.6.0
1
reportportal/service-api:5.7.29df41f8fb320
mchange-commons-java@0.2.15
0.6.0
1
rundeck/rundeck:3.2.74d64fe56f767
mchange-commons-java@0.2.15
0.6.0
1
rundeck/rundeck:3.0.16b13e8059ad72
mchange-commons-java@0.2.11
0.6.0
1
sismics/docs:v1.10f4b0ef019cf1
mchange-commons-java@0.2.19
0.6.0
1
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
mchange-commons-java@0.2.15
0.6.0
1
thmmniii/fbs-runner:v1.27.186105349c1a3
mchange-commons-java@0.2.15
0.6.0
1
trinodb/trino:45038c6f24ab1a4
mchange-commons-java@0.2.15
0.6.0
1
trinodb/trino:405ee80ab5eeab2
mchange-commons-java@0.2.15
0.6.0
1
ghcr.io/curium-rocks/mitre-siphon:main503c00321502
mchange-commons-java@0.2.15
0.6.0
1
ghcr.io/openunison/openunison-k8s:1.0.509ad450220ab9
mchange-commons-java@0.5.0
0.6.0
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
mchange-commons-java@0.2.15
0.6.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.