StackRadar

CVE-2026-59890

Medium

Advisory

Published 8 Jul 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.004
34th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,256
of 17,790 indexed, latest versions
Container images
1,315
deployed by those charts
Fix available
4 of 5
affected packages

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

Carried by container images the latest versions of 1,256 of 17,790 indexed charts deploy, on 1,315 images.

Affected packageAffected versionsFixed inImages
setuptoolspypi0.9.8, 20.7.0, 20.8.0, 29.0.1.post20161130+135 more83.0.01,255
setuptoolsdeb45.2.0-1, 45.2.0-1ubuntu0.1, 45.2.0-1ubuntu0.2, 45.2.0-1ubuntu0.3+9 moreno fix listed159
setuptoolsbitnami70.3.0, 80.9.083.0.03
py3-setuptoolsapk75.8.0-r083.0.0-r01
python-3.11deb3.11.15+e43.11.16+e21
OSV records
BIT-setuptools-2026-59890CGA-45cv-ppqx-4qxhGHSA-h35f-9h28-mq5cUBUNTU-CVE-2026-59890ECHO-732c-d358-5fef
Also known as
CGA-4hr8-28qq-pc5f, CGA-7mpr-r977-c726, CGA-qfw9-8w49-7c33, PYSEC-2026-3447

Charts affected

1,256 by stars
ChartLatestAffected imagesRadar Score
keycloakxzaks2.2.01 of 1See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:20.0.3b8f2a453a17a
setuptools@39.2.0
83.0.0

Open the chart page →

6,016
enterprise-gatewayzeet3.2.21 of 2See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
elyra/kernel-image-puller:3.2.2c922f1f1646a
setuptools@65.5.1
83.0.0

Open the chart page →

1,838
sockpuppetbrowserzekker6Verified publisher0.1.01 of 1See more

sockpuppetbrowser zekker6 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
dgtlmoon/sockpuppetbrowser:latestf166a963b550
setuptools@65.5.0
83.0.0

Open the chart page →

1,588
alertmanager-matrix-forwarderzloi-space1.0.11 of 2See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
setuptools@57.5.0
83.0.0

Open the chart page →

3,118
grafana-matrix-forwarderzloi-space1.0.01 of 2See more

grafana-matrix-forwarder zloi-space 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
setuptools@57.5.0
83.0.0

Open the chart page →

1,636
zoo-project-druzoo-projectOfficialVerified publisher0.10.41 of 6See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a9a507cb7e2dd
setuptools@68.1.2-2~jammy3
no fix listed

Open the chart page →

7,916

Container images carrying it

1,315 by charts deploying them

A fixed version is listed for 4 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
langgenius/dify-sandbox:0.2.124e65e8a351a2
setuptools@65.5.1
83.0.0
1
leantime/leantime:3.3.3ad4bfb0699d3
setuptools@70.3.0
83.0.0
1
lib42/deluge:20c4d1d326f95
setuptools@65.5.1
83.0.0
1
library/crate:4.7.0c7984a05e15b
setuptools@39.2.0
83.0.0
1
library/mysql:8.4.3106d5197fd8e
setuptools@73.0.1
83.0.0
1
library/mysql:8.0.41bf577825b52a
setuptools@73.0.1
83.0.0
1
library/mysql:8.0.40d58ac93387f6
setuptools@73.0.1
83.0.0
1
library/python:3.8-alpine3d93b1f77efc
setuptools@57.5.0
83.0.0
1
library/python:3.1070c9cc675605
setuptools@79.0.1
83.0.0
1
library/python:3.11-slim9534e5a8e315
setuptools@79.0.1
83.0.0
1
library/python:3.8d41127070014
setuptools@57.5.0
83.0.0
1
library/python:3.9da5aee29682d
setuptools@79.0.1
83.0.0
1
librenms/librenms:24.11.00920bc9117a8
setuptools@75.6.0
83.0.0
1
librenms/librenms:22.4.14f1f3d667cc7
setuptools@62.1.0
83.0.0
1
librenms/librenms:26.8.28194a4a9ff49
setuptools@80.9.0
83.0.0
1
libretranslate/libretranslate:v1.9.61de2d7056bb8
setuptools@79.0.1
83.0.0
1
linuxserver/babybuddy:1.10.2f7d7c7704249
setuptools@52.0.0
83.0.0
1
linuxserver/beets:1.5.0e36d16f7341c
setuptools@56.0.0
83.0.0
1
linuxserver/calibre-web:0.6.24241009026e6f
setuptools@68.1.2-2ubuntu1.2
setuptools@80.9.0
no fix listed
83.0.0
1
linuxserver/calibre-web:version-0.6.12938810eca3d3
setuptools@45.2.0-1
no fix listed
1
linuxserver/couchpotato:75e576ee-ls389cd8d5fb1ac
setuptools@40.7.2
83.0.0
1
linuxserver/couchpotato:75e576ee-ls32c4d2766b9eb7
setuptools@42.0.2.post20191202
83.0.0
1
linuxserver/deluge:libtorrentv1-2.2.0-ls40052eac68ccc0
setuptools@80.8.0
83.0.0
1
linuxserver/deluge:2.2.09505c64720af
setuptools@81.0.0
83.0.0
1
linuxserver/healthchecks:version-v1.20.050792a72fc71
setuptools@56.0.0
83.0.0
1
linuxserver/healthchecks:2.7.2023033194696dab3c50
setuptools@65.5.0
83.0.0
1
linuxserver/medusa:v0.3.9-ls340a5f5114128b
setuptools@41.2.0
83.0.0
1
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
setuptools@42.0.2.post20191202
83.0.0
1
linuxserver/yq:3.2.26f5b9586a93e
setuptools@65.5.0
83.0.0
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
setuptools@82.0.1
83.0.0
1
lnbitsdocker/lnbits-legend:latest26fae6327477
setuptools@65.5.1
83.0.0
1
lnbitsdocker/lnbits-legend:0.10.6a11aaa6d2b21
setuptools@65.7.0
83.0.0
1
lncm/specter-desktop:v0.10.4bca14d04397d
setuptools@50.3.0
83.0.0
1
localstack/localstack:3.19d278167f2b7
setuptools@69.0.3
83.0.0
1
locustio/locust:2.24.151d866285170
setuptools@65.5.0
83.0.0
1
logiqai/toolbox:2.0.155a574ec5b64
setuptools@42.0.2.post20191202
83.0.0
1
lsstdm/alert-stream-simulator:v1.2.1973df082d006
setuptools@57.5.0
83.0.0
1
lsstdm/lsst_alert_packet:tickets-DM-3274374c97a490940
setuptools@57.5.0
83.0.0
1
lsstsqre/exposurelog:0.8.079b00fb67a65
setuptools@60.8.2
83.0.0
1
lsstsqre/kafkaaggregator:masterbe1b21060854
setuptools@54.1.2
83.0.0
1
lsstsqre/kafkaconnect:0.9.34143c7cd705e
setuptools@57.5.0
83.0.0
1
lsstsqre/narrativelog:0.1.0ce01de04ce21
setuptools@60.9.1
83.0.0
1
lsstsqre/nublado2:2.0.1b75bf8aaafa4
setuptools@45.2.0-1
setuptools@60.5.0
no fix listed
83.0.0
1
lsstsqre/prepuller:latest19c2dfc4e4ff
setuptools@56.0.0
83.0.0
1
lsstsqre/sciplat-hub:latest5e0ade6bed1c
setuptools@0.9.8
83.0.0
1
lsstsqre/squash-api:0.5.34879415ec6ac
setuptools@51.0.0
83.0.0
1
lsstsqre/strimzi-registry-operator:0.4.1e139fde946d7
setuptools@57.5.0
83.0.0
1
lsstsqre/wfdispatcher:lateste9feb99f524d
setuptools@39.2.0
83.0.0
1
makeplane/plane-mcp-server:v0.3.071b7252adef0
setuptools@79.0.1
83.0.0
1
makersquad/harp-proxy:0.8.1a40dd258c527
setuptools@66.1.1
83.0.0
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.