CVE-2026-5704

Medium

Advisory

Published 6 Apr 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.5; base score, highest
EPSS: 0.004; 34th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,316; of 17,813 indexed, latest versions
Container images: 2,299; deployed by those charts
Fix available: 2 of 2; affected packages

tar-1.35-8.1 on GA media

Carried by container images the latest versions of 2,316 of 17,813 indexed charts deploy, on 2,299 images.

Affected package	Affected versions	Fixed in	Images
tardeb	1.27.1-1, 1.27.1-1ubuntu0.1, 1.28-2.1ubuntu0.1, 1.28-2.1ubuntu0.2+28 more	1.27.1-1ubuntu0.1+esm7, 1.28-2.1ubuntu0.2+esm6, 1.29b-2ubuntu0.4+esm4, 1.30+dfsg-7ubuntu0.20.04.4+esm3+4 more	2,292
tarrpm	1.30-lp152.3.6, 1.34-150000.3.34.1, 1.34-150000.3.37.1	1.34-150000.3.42.1, 1.35-8.1	7

OSV records: DEBIAN-CVE-2026-5704 UBUNTU-CVE-2026-5704 ECHO-6544-7e09-569c openSUSE-SU-2026:11125-1 SUSE-SU-2026:2714-1
Also known as: USN-8477-1, USN-8477-2, USN-8477-3

Charts affected

2,316 by stars

Chart

Latest

Affected images

Radar Score

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	tar@1.34+dfsg-1ubuntu0.1.22.04.2	1.34+dfsg-1ubuntu0.1.22.04.6

Open the chart page →

14,255

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
ghcr.io/bat-bs/bitnami-pgvector :pg16	19ebe07b4daf	tar@1.34+dfsg-1.2+deb12u1	no fix listed

Open the chart page →

11,657

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
library/nginx :1.25	a484819eb602	tar@1.34+dfsg-1.2+deb12u1	no fix listed

Open the chart page →

7,756

xkopsxkops

0.1.0

3 of 5 See more

xkops xkops 0.1.0

3 of the 5 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
hamzaarshad10/querybackend :1.6.2	2c1c3b86a8e7	tar@1.34+dfsg-1.2+deb12u1	no fix listed
hamzaarshad10/querypodpy :1.7	154f38e8668e	tar@1.34+dfsg-1.2+deb12u1	no fix listed
murtazashah46/helmfile :latest	4d11726cf803	tar@1.34+dfsg-1.2+deb12u1	no fix listed

Open the chart page →

13,907

xlinexline

0.0.1

1 of 1 See more

xline xline 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
ghcr.io/liangyuanpeng/xline :latest	3d2eceb44a3b	tar@1.35+dfsg-3build1	1.35+dfsg-3ubuntu0.4

Open the chart page →

2,166

cloudeye-exporterxxl-job-admin

0.1.2

1 of 1 See more

cloudeye-exporter xxl-job-admin 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
dellnoantechnp/cloudeye-exporter :v2.0.31	6873356c882d	tar@1.34+dfsg-1.2+deb12u1	no fix listed

Open the chart page →

2,697

dingtalk-botxxl-job-admin

0.1.2

1 of 2 See more

dingtalk-bot xxl-job-admin 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
dellnoantechnp/dingtalk-bot :v1.0.1	034000bbcad5	tar@1.35+dfsg-3.1	no fix listed

Open the chart page →

3,185

nightingalexxl-job-admin

0.2.11

3 of 6 See more

nightingale xxl-job-admin 0.2.11

3 of the 6 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	tar@1.35+dfsg-3build1	1.35+dfsg-3ubuntu0.4
flashcatcloud/nightingale :8.0.0-beta.11	ea1b0aaabe09	tar@1.34+dfsg-1.2+deb12u1	no fix listed
library/redis :6.2	d2ad7b21cafa	tar@1.34+dfsg-1.2+deb12u1	no fix listed

Open the chart page →

9,738

pgcatxxl-job-admin

0.3.3

1 of 1 See more

pgcat xxl-job-admin 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
ghcr.io/postgresml/pgcat :v1.2.0	627761f6dcbc	tar@1.34+dfsg-1.2+deb12u1	no fix listed

Open the chart page →

3,196

nginx-chartxxoznge-nginx

0.1.0

1 of 1 See more

nginx-chart xxoznge-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	tar@1.35+dfsg-3.1	no fix listed

Open the chart page →

1,956

helm-demoyahoon-helm-demo

1.0.0

1 of 1 See more

helm-demo yahoon-helm-demo 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
ghcr.io/yahoon/helm-demo :1.0.0	2930290a758c	tar@1.35+dfsg-3.1	no fix listed

Open the chart page →

1,338

my-nginx-appyasser-nginx-app

0.1.0

1 of 1 See more

my-nginx-app yasser-nginx-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
library/nginx :stable	d5792f71a949	tar@1.35+dfsg-3.1	no fix listed

Open the chart page →

1,956

api-snapyoukadev

0.1.1

1 of 1 See more

api-snap youkadev 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
youkadev/api-snap :0.1.1	4db0f9428e67	tar@1.34+dfsg-1.2+deb12u1	no fix listed

Open the chart page →

2,718

changedetection-iozekker6

1.102.0

1 of 1 See more

changedetection-io zekker6 1.102.0

1 of the 1 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
ghcr.io/dgtlmoon/changedetection.io :0.60.7	096dae27b5d6	tar@1.34+dfsg-1.2+deb12u1	no fix listed

Open the chart page →

2,697

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	tar@1.35+dfsg-3.1	no fix listed

Open the chart page →

1,956

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-5704.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	tar@1.29b-2ubuntu0.2	1.29b-2ubuntu0.4+esm4
yandex/clickhouse-server :21.3.20	4eccfffb01d7	tar@1.30+dfsg-7ubuntu0.20.04.1	1.30+dfsg-7ubuntu0.20.04.4+esm3

Open the chart page →

9,296

Container images carrying it

2,299 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/cilium/cilium-envoy :v1.34.7-1757592137-1a52bb680a956879722f48c591a2ca90f7791324	7932d656b63f	tar@1.35+dfsg-3build1	1.35+dfsg-3ubuntu0.4	1
quay.io/clustersecret/clustersecret :0.0.14	a9f835d1b241	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
quay.io/codefresh/redis :7.4.3-debian-12-r0	935f97598255	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
quay.io/enix/topomatik :1.3.1	d9f0bec83ef0	tar@1.34+dfsg-1ubuntu0.1.22.04.2	1.34+dfsg-1ubuntu0.1.22.04.6	1
quay.io/evryfs/docker-mcrouter :0.40.0-9	a2d3a4c67b0f	tar@1.29b-2ubuntu0.3	1.29b-2ubuntu0.4+esm4	1
quay.io/evryfs/spring-boot-admin :2.7.10	60950ef63764	tar@1.34+dfsg-1build3	1.34+dfsg-1ubuntu0.1.22.04.6	1
quay.io/fiware/waltid :1.14.1-SNAPSHOT	93889c3d8a34	tar@1.34+dfsg-1build3	1.34+dfsg-1ubuntu0.1.22.04.6	1
quay.io/galaxyproject/galaxy-min :26.1.1	2c324c9789f5	tar@1.35+dfsg-3.1	no fix listed	1
quay.io/jupyterhub/k8s-hub :4.4.2	108fbb01c3fe	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
quay.io/jupyterhub/k8s-hub :4.3.5	113e372cf71b	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
quay.io/jupyterhub/k8s-hub :4.3.4	92f883d09270	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
quay.io/jupyterhub/k8s-singleuser-sample :4.4.2	65e1b09fc8c9	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
quay.io/maxiv/pieeat :0.9.3	099715479210	tar@1.35+dfsg-3.1	no fix listed	1
quay.io/mittwald/kube-httpcache :stable	2169032c5840	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
quay.io/mittwald/kube-mail :latest	04f1099241fc	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
quay.io/mongodb/mongodb-enterprise-operator :1.8.2	a1c3843b03bc	tar@1.28-2.1ubuntu0.1	1.28-2.1ubuntu0.2+esm6	1
quay.io/ocellusai/operator :v0.10.5	9ff01f642e2b	tar@1.35+dfsg-3.1	no fix listed	1
quay.io/opsmxpublic/rabbitmq :4.2-management	3408107e5cc4	tar@1.35+dfsg-3build1	1.35+dfsg-3ubuntu0.4	1
quay.io/opsmxpublic/spin-sample-pipeline :v1.0.1	c6a934439421	tar@1.28-2.1ubuntu0.1	1.28-2.1ubuntu0.2+esm6	1
quay.io/opsmxpublic/ubi8-oes-datascience :isd-spin-2025.10.01-af26a30d4-202511261054	d8f66f4117fe	tar@1.35+dfsg-3.1	no fix listed	1
quay.io/seamware/onboarding :0.2.2	b406475f9f00	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
quay.io/wi_stefan/consent-manager :0.0.6	56399619568b	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	tar@1.34+dfsg-1.2	no fix listed	1
registry.gitlab.com/dyff/dyff-api :0.57.5	b6c44d969163	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
registry.gitlab.com/dyff/dyff-orchestrator :0.22.19	9bd5d93aaff7	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
registry.gitlab.com/dyff/workflows-sink :0.16.3	564718e28931	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
registry.gitlab.com/egos-tech/smtp :latest	df842ed79211	tar@1.35+dfsg-3.1	no fix listed	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend :1.0.31	66353ce9bf98	tar@1.35+dfsg-3.1	no fix listed	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer :1.0.31	0e3cd8c7776d	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/rabbitmq :3.12.14	5a9334f371f3	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
registry.gitlab.com/gitlab-org/build/cng/certificates :v19.4.0	1c38ad710b0c	tar@1.35+dfsg-3.1	no fix listed	1
registry.gitlab.com/gitlab-org/build/cng/gitaly :v19.4.0	704cd68566af	tar@1.35+dfsg-3.1	no fix listed	1
registry.gitlab.com/gitlab-org/build/cng/gitlab-base :v19.4.0	696d798a5c85	tar@1.35+dfsg-3.1	no fix listed	1
registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry :v4.40.2-gitlab	dc1a8972c640	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter :17.0.2	6645e014f75d	tar@1.35+dfsg-3.1	no fix listed	1
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao :v2.5.5-gitlab2	5b7636dfba3f	tar@1.35+dfsg-3.1	no fix listed	1
registry.gitlab.com/gitlab-org/build/cng/gitlab-shell :v14.57.3	aca1bb3d5b7e	tar@1.35+dfsg-3.1	no fix listed	1
registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ee :v19.4.0	2256b49461fa	tar@1.35+dfsg-3.1	no fix listed	1
registry.gitlab.com/gitlab-org/build/cng/kubectl :v19.4.0	48ee51dd67d4	tar@1.35+dfsg-3.1	no fix listed	1
registry.gitlab.com/infinitydon/registry/open5gs-aio :v2.2.2	f6385712935f	tar@1.30+dfsg-7ubuntu0.20.04.1	1.30+dfsg-7ubuntu0.20.04.4+esm3	1
registry.gitlab.com/school_guy/docker-typo3 :13.4.30-197d868e	d76185d7270d	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
registry.k8s.io/csi-secrets-store/driver :v1.6.1	b48d7d13dd06	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
registry.k8s.io/git-sync/git-sync :v4.5.0	0e64aedb0d0a	tar@1.35+dfsg-3.1	no fix listed	1
registry.k8s.io/node-problem-detector/node-problem-detector :v0.8.20	52f0618e9bc2	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
registry.k8s.io/node-problem-detector/node-problem-detector :v1.35.1	c380751accc5	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
registry.k8s.io/sig-storage/local-volume-provisioner :v2.8.0	3e2bf2eaef9f	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
registry.k8s.io/sig-storage/local-volume-provisioner :v2.9.0	f9d65db8bda2	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
registry.k8s.io/sig-storage/nfsplugin :v4.13.4	1eb5a85180a4	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1
registry.k8s.io/sig-storage/nfsplugin :v4.11.0	ce5b5ccd5eb0	tar@1.34+dfsg-1.2+deb12u1	no fix listed	1