StackRadar

CVE-2026-59890

Medium

Advisory

Published 8 Jul 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.004
34th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,256
of 17,790 indexed, latest versions
Container images
1,315
deployed by those charts
Fix available
4 of 5
affected packages

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

Carried by container images the latest versions of 1,256 of 17,790 indexed charts deploy, on 1,315 images.

Affected packageAffected versionsFixed inImages
setuptoolspypi0.9.8, 20.7.0, 20.8.0, 29.0.1.post20161130+135 more83.0.01,255
setuptoolsdeb45.2.0-1, 45.2.0-1ubuntu0.1, 45.2.0-1ubuntu0.2, 45.2.0-1ubuntu0.3+9 moreno fix listed159
setuptoolsbitnami70.3.0, 80.9.083.0.03
py3-setuptoolsapk75.8.0-r083.0.0-r01
python-3.11deb3.11.15+e43.11.16+e21
OSV records
BIT-setuptools-2026-59890CGA-45cv-ppqx-4qxhGHSA-h35f-9h28-mq5cUBUNTU-CVE-2026-59890ECHO-732c-d358-5fef
Also known as
CGA-4hr8-28qq-pc5f, CGA-7mpr-r977-c726, CGA-qfw9-8w49-7c33, PYSEC-2026-3447

Charts affected

1,256 by stars
ChartLatestAffected imagesRadar Score
keycloakxzaks2.2.01 of 1See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:20.0.3b8f2a453a17a
setuptools@39.2.0
83.0.0

Open the chart page →

6,016
enterprise-gatewayzeet3.2.21 of 2See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
elyra/kernel-image-puller:3.2.2c922f1f1646a
setuptools@65.5.1
83.0.0

Open the chart page →

1,838
sockpuppetbrowserzekker6Verified publisher0.1.01 of 1See more

sockpuppetbrowser zekker6 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
dgtlmoon/sockpuppetbrowser:latestf166a963b550
setuptools@65.5.0
83.0.0

Open the chart page →

1,588
alertmanager-matrix-forwarderzloi-space1.0.11 of 2See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
setuptools@57.5.0
83.0.0

Open the chart page →

3,118
grafana-matrix-forwarderzloi-space1.0.01 of 2See more

grafana-matrix-forwarder zloi-space 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
setuptools@57.5.0
83.0.0

Open the chart page →

1,636
zoo-project-druzoo-projectOfficialVerified publisher0.10.41 of 6See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a9a507cb7e2dd
setuptools@68.1.2-2~jammy3
no fix listed

Open the chart page →

7,916

Container images carrying it

1,315 by charts deploying them

A fixed version is listed for 4 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
grafana/oncall:v1.16.5499851658393
setuptools@80.9.0
83.0.0
1
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
setuptools@49.2.0
83.0.0
1
greenbirdit/locust:0.9.0e99d53bdc944
setuptools@40.6.3
83.0.0
1
gristlabs/grist:0.7.96e71b1914a7e
setuptools@40.8.0
83.0.0
1
grpl/grapple-cli:0.2.127c00aafee6629
setuptools@68.1.2-2ubuntu1
setuptools@68.1.2
no fix listed
83.0.0
1
guillh/web3-prometheus-exporter:0.3.04fb99dbc32b2
setuptools@65.5.1
83.0.0
1
gurolakman/oam:4.0.0ed8fd2062548
setuptools@39.2.0
83.0.0
1
gurolakman/smsf-configuration:1.0.49abb3882bcbd
setuptools@39.2.0
83.0.0
1
gurolakman/smsf-dispatcher:1.0.46537e8ed8de8
setuptools@39.2.0
83.0.0
1
gurolakman/smsf-momt:1.0.4ce23b20a8a17
setuptools@39.2.0
83.0.0
1
gurolakman/smsf-registration:1.0.4b22e746edd5d
setuptools@39.2.0
83.0.0
1
gurolakman/ussigw-configuration:1.0.4bf18525c5ad9
setuptools@39.2.0
83.0.0
1
gurolakman/ussigw-core:1.0.48739565c3ea2
setuptools@39.2.0
83.0.0
1
ha33ona/python:test6affdfc644d0
setuptools@57.5.0
83.0.0
1
halkeye/slack-resurrect:v0.1.477b05e95fdb5
setuptools@41.0.1
83.0.0
1
hamidyousefi93/saam-test:latestc34f071f6ed0
setuptools@68.2.2
83.0.0
1
hammerspaceinc/csi-plugin:v1.2.8-rc2395bee4504fc
setuptools@53.0.0
83.0.0
1
hamzaarshad10/querybackend:1.6.22c1c3b86a8e7
setuptools@58.1.0
83.0.0
1
hamzaarshad10/querypodpy:1.7154f38e8668e
setuptools@65.5.1
83.0.0
1
hansehe/locust:1.1.0bc8e45262bc4
setuptools@76.0.0
83.0.0
1
haveagitgat/tdarr:2.00.181256348872ce
setuptools@45.2.0-1
no fix listed
1
haveagitgat/tdarr_node:2.00.101e3f9328327d
setuptools@45.2.0-1
no fix listed
1
haveagitgat/tdarr_node:2.17.013ff0913202dd
setuptools@45.2.0-1ubuntu0.1
no fix listed
1
hayk96/alerta-web:9.0.486377705e9e3
setuptools@58.1.0
83.0.0
1
hazelcast/management-center:5.3.2f9d34300d330
setuptools@39.2.0
83.0.0
1
hcguersoy/cleanreg:v0.8.063b76fdcfbe1
setuptools@58.1.0
83.0.0
1
healthchecks/healthchecks:v2.8.1e82bb0836e30
setuptools@65.5.1
83.0.0
1
heartexlabs/label-studio:latestaa461572e8f9
setuptools@80.10.1
83.0.0
1
helga09/my_sql_shoes:v1.1.1a03657d97897
setuptools@50.3.2
83.0.0
1
helicone/clickhouse-migration-runner:v2025.03.05-14c69b971a7e4
setuptools@45.2.0-1ubuntu0.2
setuptools@45.2.0
no fix listed
83.0.0
1
hhyo/archery:v1.9.11aa41843419e
setuptools@62.6.0
83.0.0
1
hiboxsystems/marge-bot:0.11.07235809b43b3
setuptools@65.5.0
83.0.0
1
hiboxsystems/marge-bot:0.12.1a96c10b61a59
setuptools@65.5.0
83.0.0
1
hiboxsystems/marge-bot:0.14.0dcffb926e563
setuptools@65.5.1
83.0.0
1
hjacobs/kube-downscaler:23.2.05d328c003efe
setuptools@65.5.1
83.0.0
1
hjacobs/kube-janitor:23.7.0fbb303ed463c
setuptools@65.5.1
83.0.0
1
hjacobs/kube-ops-view:23.5.0a4fae38f93d7
setuptools@65.5.1
83.0.0
1
hjacobs/kube-resource-report:21.2.145f93491c434
setuptools@53.0.0
83.0.0
1
hjacobs/kube-resource-report:22.11.0c173cd02f5af
setuptools@63.2.0
83.0.0
1
hjacobs/kube-web-view:23.8.0431f1bf013d0
setuptools@65.5.1
83.0.0
1
hjacobs/kube-web-view:20.10.0b44a9cf81a2f
setuptools@50.3.0
83.0.0
1
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
setuptools@58.1.0
83.0.0
1
hmdmph/mongo-pod-labeler:1.0.1-alpine79e4a170f3dc
setuptools@40.8.0
83.0.0
1
hmdmph/redis-pod-labeler:1.0.0-alpine7f1381fe0f3b
setuptools@47.1.1
83.0.0
1
homeassistant/home-assistant:2023.10.3021e2afc6e57
setuptools@68.2.2
83.0.0
1
homeassistant/home-assistant:2026.75a531753cea9
setuptools@81.0.0
83.0.0
1
homeassistant/home-assistant:2023.12.48d000332b09b
setuptools@68.2.2
83.0.0
1
hyperglance/httpd-v2:ubi-10.0.51d9a8bb7c08f
setuptools@82.0.1
83.0.0
1
i4trust/activation-service:2.2.09f3719176893
setuptools@57.5.0
83.0.0
1
ibmcom/app-nav-init:1.0.1240ff499eb5b
setuptools@0.9.8
83.0.0
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.