StackRadar

CVE-2026-5598

Critical

Advisory

Published 15 Apr 2026In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.9
base score, highest
EPSS
0.009
58th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
34
of 17,781 indexed, latest versions
Container images
28
deployed by those charts
Fix available
2 of 3
affected packages

Bouncy Castle Has Covert Timing Channel Vulnerability

Carried by container images the latest versions of 34 of 17,781 indexed charts deploy, on 28 images.

Affected packageAffected versionsFixed inImages
bcprov-jdk15to18maven1.72, 1.74, 1.75, 1.76+4 more1.80.216
bcprov-jdk18onmaven1.82, 1.831.8413
bouncycastledeb1.61-1no fix listed1
OSV records
GHSA-p93r-85wp-75v3UBUNTU-CVE-2026-5598

Charts affected

34 by stars
ChartLatestAffected imagesRadar Score
graylogkong-zVerified publisher3.0.321 of 5See more

graylog kong-z 3.0.32

1 of the 5 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.19.68690b204fe91
bcprov-jdk15to18@1.79
1.80.2

Open the chart page →

2,699
guacamoleberyju-org1.4.21 of 3See more

guacamole beryju-org 1.4.2

1 of the 3 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
guacamole/guacamole:1.6.0f344085e618b
bcprov-jdk15to18@1.80
1.80.2

Open the chart page →

3,606
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
wazuh/wazuh-indexer:4.14.3b149b30da686
bcprov-jdk15to18@1.79
bcprov-jdk18on@1.82
1.80.2
1.84

Open the chart page →

11,384
glasskube-operatorglasskubeOfficialVerified publisher0.12.21 of 3See more

glasskube-operator glasskube 0.12.2

1 of the 3 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
glasskube/operator:0.12.2be5133100d63
bcprov-jdk15to18@1.76
1.80.2

Open the chart page →

11,933
druiddruid-helmVerified publisher37.0.21 of 3See more

druid druid-helm 37.0.2

1 of the 3 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
apache/druid:37.0.00116fb802786
bcprov-jdk18on@1.82
1.84

Open the chart page →

3,812
guacamoledmunozv04Verified publisher0.3.41 of 2See more

guacamole dmunozv04 0.3.4

1 of the 2 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
guacamole/guacamole:1.6.0f344085e618b
bcprov-jdk15to18@1.80
1.80.2

Open the chart page →

3,606
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
wazuh/wazuh-indexer:4.11.1a7a2076b167e
bcprov-jdk15to18@1.78
1.80.2

Open the chart page →

6,168
kubernetes-loggingkubernetes-logging4.8.01 of 6See more

kubernetes-logging kubernetes-logging 4.8.0

1 of the 6 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.10.0c8f3ebd2a934
bcprov-jdk15to18@1.75
1.80.2

Open the chart page →

10,530
opensearchcaptnbpVerified publisher3.1.11 of 2See more

opensearch captnbp 3.1.1

1 of the 2 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.19.269588c664014
bcprov-jdk15to18@1.78.1
1.80.2

Open the chart page →

998
cosmocosmo-platformOfficialVerified publisher0.20.01 of 10See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/keycloak:0.13.0b37408461b9b
bcprov-jdk18on@1.82
1.84

Open the chart page →

28,839
browserless-chromesagikazarmarkVerified publisher0.0.51 of 1See more

browserless-chrome sagikazarmark 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
bouncycastle@1.61-1
no fix listed

Open the chart page →

24,488
dbrepodbrepo1.13.31 of 25See more

dbrepo dbrepo 1.13.3

1 of the 25 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
bitnamilegacy/opensearch:2.18.0-debian-12-r0d8440eb6b290
bcprov-jdk15to18@1.78.1
1.80.2

Open the chart page →

52,635
guacamolehelmforgeVerified publisher1.5.21 of 5See more

guacamole helmforge 1.5.2

1 of the 5 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
guacamole/guacamole:1.6.0f344085e618b
bcprov-jdk15to18@1.80
1.80.2

Open the chart page →

8,716
mcpmcp-chartsVerified publisher0.0.231 of 7See more

mcp mcp-charts 0.0.23

1 of the 7 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
glarad/mc-service-registry:latest7b02b9e7f1ef
bcprov-jdk18on@1.82
1.84

Open the chart page →

6,929
inbox-serverappscodeVerified publisher2025.12.251 of 1See more

inbox-server appscode 2025.12.25

1 of the 1 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
ghcr.io/appscode/inbox-server:postgres-latest536358d7b17e
bcprov-jdk18on@1.82
1.84

Open the chart page →

3,963
inbox-server-distributedappscodeVerified publisher2025.12.251 of 4See more

inbox-server-distributed appscode 2025.12.25

1 of the 4 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
ghcr.io/appscode/inbox-server:latest536358d7b17e
bcprov-jdk18on@1.82
1.84

Open the chart page →

15,573
camellia-redis-proxycamellia-redis-proxy1.4.01 of 2See more

camellia-redis-proxy camellia-redis-proxy 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
48n6e/camellia-redis-proxy:1.4.0-jdk-21-0.0.1a6ed886fddfc
bcprov-jdk18on@1.83
1.84

Open the chart page →

8,001
opensearch-singlenodecaptnbpVerified publisher1.0.91 of 2See more

opensearch-singlenode captnbp 1.0.9

1 of the 2 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.15.01963b3ece46d
bcprov-jdk15to18@1.74
1.80.2

Open the chart page →

1,073
clusterfactoryclusterfactory0.2.01 of 5See more

clusterfactory clusterfactory 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
jenkins/jenkins:2.541.3-jdk21c4098086090c
bcprov-jdk18on@1.82
1.84

Open the chart page →

7,168
gitea-jenkinsclusterfactory0.1.11 of 5See more

gitea-jenkins clusterfactory 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
jenkins/jenkins:2.541.3-jdk21c4098086090c
bcprov-jdk18on@1.82
1.84

Open the chart page →

5,238
damap-chartdamapVerified publisher0.3.01 of 5See more

damap-chart damap 0.3.0

1 of the 5 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.49409c59bdfb6
bcprov-jdk18on@1.82
1.84

Open the chart page →

13,936
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.18.07f6fa1efee8f
bcprov-jdk15to18@1.78.1
1.80.2

Open the chart page →

49,025
gridgain9gridgainVerified publisher1.1.101 of 2See more

gridgain9 gridgain 1.1.10

1 of the 2 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
gridgain/gridgain9:9.1.1895018390077b
bcprov-jdk18on@1.83
1.84

Open the chart page →

3,199
druidhelmforgeVerified publisher1.3.61 of 4See more

druid helmforge 1.3.6

1 of the 4 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
apache/druid:37.0.00116fb802786
bcprov-jdk18on@1.82
1.84

Open the chart page →

8,541
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
openbas/platform:2.0.5d986d80b0a75
bcprov-jdk18on@1.82
1.84

Open the chart page →

25,017
mvfi4trustVerified publisher1.1.21 of 1See more

mvf i4trust 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
wistefan/mvf:lateste0887302b2d8
bcprov-jdk15to18@1.72
1.80.2

Open the chart page →

7,144
vcwaltidi4trustVerified publisher0.0.191 of 1See more

vcwaltid i4trust 0.0.19

1 of the 1 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
quay.io/fiware/waltid:1.14.1-SNAPSHOT93889c3d8a34
bcprov-jdk15to18@1.72
1.80.2

Open the chart page →

7,862
keycloakmt1905021.4.61 of 3See more

keycloak mt190502 1.4.6

1 of the 3 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.5.68d44614c7479
bcprov-jdk18on@1.82
1.84

Open the chart page →

2,901
dfdeweyosdfir-infrastructureVerified publisher1.0.01 of 3See more

dfdewey osdfir-infrastructure 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.12.0645d3d9390ad
bcprov-jdk15to18@1.76
1.80.2

Open the chart page →

1,190
timesketchosdfir-infrastructureVerified publisher1.0.81 of 6See more

timesketch osdfir-infrastructure 1.0.8

1 of the 6 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.14.0466a49f379bb
bcprov-jdk15to18@1.75
1.80.2

Open the chart page →

1,753
sonatype-nexus3simcube1.0.11 of 2See more

sonatype-nexus3 simcube 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
sonatype/nexus3:3.58.1586060431b64
bcprov-jdk15to18@1.75
1.80.2

Open the chart page →

4,946
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
wazuh/wazuh-indexer:4.14.49c344d2b1757
bcprov-jdk15to18@1.78.1
bcprov-jdk18on@1.82
1.80.2
1.84

Open the chart page →

5,484
keycloakwiremindVerified publisher25.3.11 of 2See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
ghcr.io/wiremind/bitnami/keycloak:26.5.0-debian-12-r38622ea9e43c0
bcprov-jdk18on@1.82
1.84

Open the chart page →

7,624
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-5598.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.18.07f6fa1efee8f
bcprov-jdk15to18@1.78.1
1.80.2

Open the chart page →

9,381

Container images carrying it

28 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
guacamole/guacamole:1.6.0f344085e618b
bcprov-jdk15to18@1.80
1.80.2
3
apache/druid:37.0.00116fb802786
bcprov-jdk18on@1.82
1.84
2
jenkins/jenkins:2.541.3-jdk21c4098086090c
bcprov-jdk18on@1.82
1.84
2
opensearchproject/opensearch:2.18.07f6fa1efee8f
bcprov-jdk15to18@1.78.1
1.80.2
2
ghcr.io/appscode/inbox-server:latest:postgres-latest536358d7b17e
bcprov-jdk18on@1.82
1.84
2
48n6e/camellia-redis-proxy:1.4.0-jdk-21-0.0.1a6ed886fddfc
bcprov-jdk18on@1.83
1.84
1
bitnamilegacy/opensearch:2.18.0-debian-12-r0d8440eb6b290
bcprov-jdk15to18@1.78.1
1.80.2
1
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
bouncycastle@1.61-1
no fix listed
1
glarad/mc-service-registry:latest7b02b9e7f1ef
bcprov-jdk18on@1.82
1.84
1
glasskube/operator:0.12.2be5133100d63
bcprov-jdk15to18@1.76
1.80.2
1
gridgain/gridgain9:9.1.1895018390077b
bcprov-jdk18on@1.83
1.84
1
openbas/platform:2.0.5d986d80b0a75
bcprov-jdk18on@1.82
1.84
1
opensearchproject/opensearch:2.15.01963b3ece46d
bcprov-jdk15to18@1.74
1.80.2
1
opensearchproject/opensearch:2.14.0466a49f379bb
bcprov-jdk15to18@1.75
1.80.2
1
opensearchproject/opensearch:2.12.0645d3d9390ad
bcprov-jdk15to18@1.76
1.80.2
1
opensearchproject/opensearch:2.19.269588c664014
bcprov-jdk15to18@1.78.1
1.80.2
1
opensearchproject/opensearch:2.19.68690b204fe91
bcprov-jdk15to18@1.79
1.80.2
1
opensearchproject/opensearch:2.10.0c8f3ebd2a934
bcprov-jdk15to18@1.75
1.80.2
1
sonatype/nexus3:3.58.1586060431b64
bcprov-jdk15to18@1.75
1.80.2
1
wazuh/wazuh-indexer:4.14.49c344d2b1757
bcprov-jdk15to18@1.78.1
bcprov-jdk18on@1.82
1.80.2
1.84
1
wazuh/wazuh-indexer:4.11.1a7a2076b167e
bcprov-jdk15to18@1.78
1.80.2
1
wazuh/wazuh-indexer:4.14.3b149b30da686
bcprov-jdk15to18@1.79
bcprov-jdk18on@1.82
1.80.2
1.84
1
wistefan/mvf:lateste0887302b2d8
bcprov-jdk15to18@1.72
1.80.2
1
ghcr.io/wiremind/bitnami/keycloak:26.5.0-debian-12-r38622ea9e43c0
bcprov-jdk18on@1.82
1.84
1
ghcr.io/wundergraph/cosmo/keycloak:0.13.0b37408461b9b
bcprov-jdk18on@1.82
1.84
1
quay.io/fiware/waltid:1.14.1-SNAPSHOT93889c3d8a34
bcprov-jdk15to18@1.72
1.80.2
1
quay.io/keycloak/keycloak:26.5.68d44614c7479
bcprov-jdk18on@1.82
1.84
1
quay.io/keycloak/keycloak:26.49409c59bdfb6
bcprov-jdk18on@1.82
1.84
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.