CVE-2026-5704

Medium

Advisory

Published 6 Apr 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.5; base score, highest
EPSS: 0.004; 34th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,257; of 17,797 indexed, latest versions
Container images: 2,220; deployed by those charts
Fix available: 2 of 2; affected packages

Security update for tar

Carried by container images the latest versions of 2,257 of 17,797 indexed charts deploy, on 2,220 images.

Affected package	Affected versions	Fixed in	Images
tardeb	1.27.1-1, 1.27.1-1ubuntu0.1, 1.28-2.1ubuntu0.1, 1.28-2.1ubuntu0.2+28 more	1.27.1-1ubuntu0.1+esm7, 1.28-2.1ubuntu0.2+esm6, 1.29b-2ubuntu0.4+esm4, 1.30+dfsg-7ubuntu0.20.04.4+esm3+4 more	2,214
tarrpm	1.34-150000.3.34.1, 1.34-150000.3.37.1	1.34-150000.3.42.1	6

OSV records: DEBIAN-CVE-2026-5704 UBUNTU-CVE-2026-5704 ECHO-6544-7e09-569c SUSE-SU-2026:2714-1
Also known as: USN-8477-1, USN-8477-2, USN-8477-3

Charts affected

2,257 by stars

Chart

Latest

Affected images

Radar Score

nginx-chartxxoznge-nginx

0.1.0

1 of 1 See more

nginx-chart xxoznge-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	tar@1.35+dfsg-3.1	no fix listed

Open the chart page →

1,861

helm-demoyahoon-helm-demo

1.0.0

1 of 1 See more

helm-demo yahoon-helm-demo 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
ghcr.io/yahoon/helm-demo :1.0.0	2930290a758c	tar@1.35+dfsg-3.1	no fix listed

Open the chart page →

1,311

my-nginx-appyasser-nginx-app

0.1.0

1 of 1 See more

my-nginx-app yasser-nginx-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
library/nginx :stable	d5792f71a949	tar@1.35+dfsg-3.1	no fix listed

Open the chart page →

1,861

api-snapyoukadev

0.1.1

1 of 1 See more

api-snap youkadev 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
youkadev/api-snap :0.1.1	4db0f9428e67	tar@1.34+dfsg-1.2+deb12u1	no fix listed

Open the chart page →

2,692

changedetection-iozekker6

1.101.0

1 See more

changedetection-io zekker6 1.101.0

1 container image this version deploys carries CVE-2026-5704.

Container image	Digest	Package	Fixed in
ghcr.io/dgtlmoon/changedetection.io :0.60.6	eb4a9f718801	tar@1.34+dfsg-1.2+deb12u1	no fix listed

Open the chart page →

—

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	tar@1.35+dfsg-3.1	no fix listed

Open the chart page →

1,861

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	tar@1.29b-2ubuntu0.2	1.29b-2ubuntu0.4+esm4
yandex/clickhouse-server :21.3.20	4eccfffb01d7	tar@1.30+dfsg-7ubuntu0.20.04.1	1.30+dfsg-7ubuntu0.20.04.4+esm3

Open the chart page →

9,272

Container images carrying it

2,220 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
instill/artifact-backend :b28766a	c4a393e601ed	tar@1.35+dfsg-3.1	no fix listed	1
instill/mgmt-backend :d0933d4	ebe12f77a3f9	tar@1.35+dfsg-3.1	no fix listed	1
instill/model-backend :611f0f2	e980125e5ba5	tar@1.35+dfsg-3.1	no fix listed	1
instructure/kinesalite :latest	34400d82f28f	tar@1.30+dfsg-7ubuntu0.20.04.4	1.30+dfsg-7ubuntu0.20.04.4+esm3	1
intel/dlstreamer-pipeline-server :2022.1.1-ubuntu20	aa8f5483a2ef	tar@1.30+dfsg-7ubuntu0.20.04.2	1.30+dfsg-7ubuntu0.20.04.4+esm3	1
intel/multimodal-data-visualization-streaming :3.0	1a89327e499b	tar@1.30+dfsg-7ubuntu0.20.04.2	1.30+dfsg-7ubuntu0.20.04.4+esm3	1
intelowlproject/intelowl :v6.6.1	0b22e547ea6b	tar@1.34+dfsg-1.2	no fix listed	1
intel/trusted-certificate-issuer :0.5.0	591a9db4a427	tar@1.30+dfsg-7ubuntu0.20.04.3	1.30+dfsg-7ubuntu0.20.04.4+esm3	1
inventree/inventree :1.5.4	a946ec09da3e	tar@1.35+dfsg-3.1	no fix listed	1
iofog/router :2.0.1	7260cf861479	tar@1.29b-2ubuntu0.1	1.29b-2ubuntu0.4+esm4	1
iomesh/csi-driver :v2.8.0	1a151f602451	tar@1.34+dfsg-1ubuntu0.1.22.04.2	1.34+dfsg-1ubuntu0.1.22.04.6	1
iomesh/csi-driver :v2.7.2	5d3f9bf9240b	tar@1.34+dfsg-1ubuntu0.1.22.04.2	1.34+dfsg-1ubuntu0.1.22.04.6	1
iomesh/node-disk-manager :1.8.0	002c4b92fd34	tar@1.30+dfsg-7ubuntu0.20.04.1	1.30+dfsg-7ubuntu0.20.04.4+esm3	1
iomesh/node-disk-manager :1.8.0-2	292ad270082e	tar@1.35+dfsg-3build1	1.35+dfsg-3ubuntu0.4	1
iomesh/node-disk-operator :1.8.0-1	de4aa40684ad	tar@1.35+dfsg-3build1	1.35+dfsg-3ubuntu0.4	1
iomesh/node-disk-operator :1.8.0	f6c76380db34	tar@1.30+dfsg-7ubuntu0.20.04.1	1.30+dfsg-7ubuntu0.20.04.4+esm3	1
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	tar@1.30+dfsg-7ubuntu0.20.04.1	1.30+dfsg-7ubuntu0.20.04.4+esm3	1
ironmansoftware/universal :3.3.1-ubuntu-20.04	1943c73cce31	tar@1.30+dfsg-7ubuntu0.20.04.2	1.30+dfsg-7ubuntu0.20.04.4+esm3	1
ispras/svacer :11-2-0	42aa9fa9f189	tar@1.34+dfsg-1ubuntu0.1.22.04.2	1.34+dfsg-1ubuntu0.1.22.04.6	1
istio/examples-bookinfo-reviews-v1 :1.17.0	b8f16a765eea	tar@1.30+dfsg-7ubuntu0.20.04.2	1.30+dfsg-7ubuntu0.20.04.4+esm3	1
istio/examples-bookinfo-reviews-v2 :1.17.0	72f25a55f078	tar@1.30+dfsg-7ubuntu0.20.04.2	1.30+dfsg-7ubuntu0.20.04.4+esm3	1
istio/examples-bookinfo-reviews-v3 :1.17.0	8f92fc1b6592	tar@1.30+dfsg-7ubuntu0.20.04.2	1.30+dfsg-7ubuntu0.20.04.4+esm3	1
istio/examples-helloworld-v1 :latest	328b237e4fb1	tar@1.34+dfsg-1.2	no fix listed	1
istio/examples-helloworld-v2 :latest	0a7f02b2c7c9	tar@1.34+dfsg-1.2	no fix listed	1
istio/install-cni :1.10.3	2232f365aed6	tar@1.29b-2ubuntu0.2	1.29b-2ubuntu0.4+esm4	1
istio/install-cni :1.23.6	ab34c4740f44	tar@1.35+dfsg-3build1	1.35+dfsg-3ubuntu0.4	1
istio/install-cni :1.29.0	ce27c9ce43c8	tar@1.35+dfsg-3build1	1.35+dfsg-3ubuntu0.4	1
istio/node-agent-k8s :1.2.9	268ab879ea51	tar@1.28-2.1ubuntu0.1	1.28-2.1ubuntu0.2+esm6	1
istio/operator :1.10.3	655eefa11c84	tar@1.29b-2ubuntu0.2	1.29b-2ubuntu0.4+esm4	1
istio/operator :1.12.0	6cfce8a071b9	tar@1.30+dfsg-7ubuntu0.20.04.1	1.30+dfsg-7ubuntu0.20.04.4+esm3	1
istio/operator :1.18.2	70f9d1fe5fff	tar@1.34+dfsg-1ubuntu0.1.22.04.1	1.34+dfsg-1ubuntu0.1.22.04.6	1
istio/pilot :1.10.0	294ca55bd1cc	tar@1.29b-2ubuntu0.2	1.29b-2ubuntu0.4+esm4	1
istio/pilot :1.29.0	325156535773	tar@1.35+dfsg-3build1	1.35+dfsg-3ubuntu0.4	1
istio/pilot :1.23.6	9c3d6a218181	tar@1.35+dfsg-3build1	1.35+dfsg-3ubuntu0.4	1
istio/pilot :1.16.0	ac0284d75ec9	tar@1.34+dfsg-1build3	1.34+dfsg-1ubuntu0.1.22.04.6	1
istio/pilot :1.2.9	c09319753454	tar@1.28-2.1ubuntu0.1	1.28-2.1ubuntu0.2+esm6	1
istio/pilot :1.17.1	ce9d87606701	tar@1.34+dfsg-1build3	1.34+dfsg-1ubuntu0.1.22.04.6	1
istio/pilot :1.15.2	db08d6963975	tar@1.34+dfsg-1build3	1.34+dfsg-1ubuntu0.1.22.04.6	1
istio/pilot :1.10.3	e7e110a421c2	tar@1.29b-2ubuntu0.2	1.29b-2ubuntu0.4+esm4	1
istio/pilot :1.29.1	f8b0e412ac4a	tar@1.35+dfsg-3build1	1.35+dfsg-3ubuntu0.4	1
istio/proxyv2 :1.2.9	0c78be035e98	tar@1.28-2.1ubuntu0.1	1.28-2.1ubuntu0.2+esm6	1
istio/proxyv2 :1.9.6	87a9db561d2e	tar@1.29b-2ubuntu0.2	1.29b-2ubuntu0.4+esm4	1
istio/proxyv2 :1.10.0	88c6c693e67a	tar@1.29b-2ubuntu0.2	1.29b-2ubuntu0.4+esm4	1
istio/proxyv2 :1.14.1	df69c1a7af7c	tar@1.30+dfsg-7ubuntu0.20.04.2	1.30+dfsg-7ubuntu0.20.04.4+esm3	1
istio/ztunnel :1.25.0	05f3972d80a9	tar@1.35+dfsg-3build1	1.35+dfsg-3ubuntu0.4	1
ixsystems/truecommand :3.2.0	19c218455cd2	tar@1.35+dfsg-3.1	no fix listed	1
jacobalberty/unifi :v7.1.66	4a3616625dda	tar@1.29b-2ubuntu0.3	1.29b-2ubuntu0.4+esm4	1
jacobalberty/unifi :v7.4.162	b3edc809a3ff	tar@1.29b-2ubuntu0.4	1.29b-2ubuntu0.4+esm4	1
jacobalberty/unifi :5.10.19	c409924e2463	tar@1.28-2.1ubuntu0.1	1.28-2.1ubuntu0.2+esm6	1
jaedb/iris :latest	048cfbf58d57	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1