StackRadar

CVE-2026-59890

Medium

Advisory

Published 8 Jul 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.004
34th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,257
of 17,792 indexed, latest versions
Container images
1,311
deployed by those charts
Fix available
4 of 5
affected packages

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

Carried by container images the latest versions of 1,257 of 17,792 indexed charts deploy, on 1,311 images.

Affected packageAffected versionsFixed inImages
setuptoolspypi0.9.8, 20.7.0, 20.8.0, 29.0.1.post20161130+135 more83.0.01,249
setuptoolsdeb45.2.0-1, 45.2.0-1ubuntu0.1, 45.2.0-1ubuntu0.2, 45.2.0-1ubuntu0.3+9 moreno fix listed160
setuptoolsbitnami70.3.0, 80.9.083.0.03
py3-setuptoolsapk75.8.0-r083.0.0-r01
python-3.11deb3.11.15+e43.11.16+e21
OSV records
BIT-setuptools-2026-59890CGA-45cv-ppqx-4qxhGHSA-h35f-9h28-mq5cUBUNTU-CVE-2026-59890ECHO-732c-d358-5fef
Also known as
CGA-4hr8-28qq-pc5f, CGA-7mpr-r977-c726, CGA-qfw9-8w49-7c33, PYSEC-2026-3447

Charts affected

1,257 by stars
ChartLatestAffected imagesRadar Score
xbackbonegeek-cookbookVerified publisher5.4.21 of 1See more

xbackbone geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
pe46dro/xbackbone-docker:3.3.309dfe3aa10f6
setuptools@40.6.3.post20190116
83.0.0

Open the chart page →

1,655
volume-autoscalergke-volume-autoscaler3.0.21 of 1See more

volume-autoscaler gke-volume-autoscaler 3.0.2

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
shadowrhyder/gke-volume-autoscaler:3.0.24aae9270356a
setuptools@80.9.0
83.0.0

Open the chart page →

900
glassflow-etlglassflowVerified publisher0.5.211 of 16See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/glassflow/glassflow-notifier:v1.0.3d1b0ce10b513
setuptools@79.0.1
83.0.0

Open the chart page →

12,115
ldap-backupgluuVerified publisher1.6.111 of 1See more

ldap-backup gluu 1.6.11

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
gluufederation/opendj:4.3.0_011a1128b28b95
setuptools@52.0.0
83.0.0

Open the chart page →

3,065
gmaas-github-apigmaas-github-api2.0.11 of 1See more

gmaas-github-api gmaas-github-api 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
gmaas2/github-api:latest148fc2d9afe9
setuptools@65.5.1
83.0.0

Open the chart page →

1,206
docker-registry-gcgmelilloVerified publisher0.1.91 of 1See more

docker-registry-gc gmelillo 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
gmelillo/registry:0.1.8c599d608a2f7
setuptools@52.0.0
83.0.0

Open the chart page →

981
gnp-stackgnp-stack0.0.51 of 14See more

gnp-stack gnp-stack 0.0.5

1 of the 14 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:1.30.10835d79d8fbae
setuptools@80.9.0
83.0.0

Open the chart page →

7,683
platformgoofy-chart0.1.01 of 1See more

platform goofy-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
devopsgoofy/k8s-platform:latestad865312099f
setuptools@75.6.0
83.0.0

Open the chart page →

2,806
kube-prometheus-stackgpg-dev84.0.01 of 6See more

kube-prometheus-stack gpg-dev 84.0.0

1 of the 6 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.6.0a6c101156d42
setuptools@82.0.1
83.0.0

Open the chart page →

4,303
opentelemetry-demogpg-dev0.33.82 of 27See more

opentelemetry-demo gpg-dev 0.33.8

2 of the 27 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-loadgenerator85c9935ff31b
setuptools@75.3.0
83.0.0
ghcr.io/open-telemetry/demo:1.12.0-recommendationserviceb294a4278407
setuptools@75.3.0
83.0.0

Open the chart page →

49,362
spark-standalonegradiant-bigdataVerified publisher0.1.01 of 2See more

spark-standalone gradiant-bigdata 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
gradiant/spark:2.4.4-python-alpine97657d56e927
setuptools@41.6.0
83.0.0

Open the chart page →

6,148
grapple-installergrapple-installer0.3.221 of 1See more

grapple-installer grapple-installer 0.3.22

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
grpl/grapple-cli:0.2.127c00aafee6629
setuptools@68.1.2-2ubuntu1
setuptools@68.1.2
no fix listed
83.0.0

Open the chart page →

7,956
siembolgresearch0.1.61 of 4See more

siembol gresearch 0.1.6

1 of the 4 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
alpine/k8s:1.18.16a41efe02a041
setuptools@56.0.0
83.0.0

Open the chart page →

14,327
act-runnergringolitoVerified publisher0.2.01 of 1See more

act-runner gringolito 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
gitea/act_runner:0.2.11-dind-rootless6120b1165f3a
setuptools@70.3.0
83.0.0

Open the chart page →

2,598
guacamoleguacamole1.0.01 of 4See more

guacamole guacamole 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/cloudnative-pg/postgresql:18899d3ed526b6
setuptools@52.0.0
83.0.0

Open the chart page →

250
gwangju_2-3gwangju2-30.1.03 of 5See more

gwangju_2-3 gwangju2-3 0.1.0

3 of the 5 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
clsen2024/gwangju_2-3:service-b-10ba9eff852c5
setuptools@58.1.0
83.0.0
clsen2024/gwangju_2-3:service-a-151b1d45961cd
setuptools@58.1.0
83.0.0
clsen2024/gwangju_2-3:service-c-1efb1586c8299
setuptools@58.1.0
83.0.0

Open the chart page →

6,506
librechathajowielandVerified publisher1.1.01 of 1See more

librechat hajowieland 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
setuptools@70.3.0
83.0.0

Open the chart page →

2,949
librechat-exporterhajowielandVerified publisher1.0.01 of 1See more

librechat-exporter hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/virtuos/librechat_exporter:2.0.050ea1cf0086f
setuptools@80.7.1
83.0.0

Open the chart page →

2,301
pgadminhalkeye1.0.01 of 1See more

pgadmin halkeye 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
chorss/docker-pgadmin4:4.115c549cacb8ab
setuptools@41.0.1
83.0.0

Open the chart page →

2,556
postfixhalkeye0.1.51 of 1See more

postfix halkeye 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
applariat/tx-smtp-relay:latest6bc9655d920f
setuptools@20.8.0
83.0.0

Open the chart page →

1,322
resurrectbothalkeye0.1.51 of 1See more

resurrectbot halkeye 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
halkeye/slack-resurrect:v0.1.477b05e95fdb5
setuptools@41.0.1
83.0.0

Open the chart page →

3,809
tautullihalkeye1.1.41 of 2See more

tautulli halkeye 1.1.4

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
tautulli/tautulli:v2.7.7c4da15f058ea
setuptools@57.4.0
83.0.0

Open the chart page →

1,473
hawk-envoy-pluginhawk0.1.01 of 4See more

hawk-envoy-plugin hawk 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
kong/httpbin:latesta6ac46531193
setuptools@59.6.0-1.2ubuntu0.22.04.2
setuptools@75.6.0
no fix listed
83.0.0

Open the chart page →

9,178
heliconehelicone0.1.421 of 14See more

helicone helicone 0.1.42

1 of the 14 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
helicone/clickhouse-migration-runner:v2025.03.05-14c69b971a7e4
setuptools@45.2.0-1ubuntu0.2
setuptools@45.2.0
no fix listed
83.0.0

Open the chart page →

25,183
ms-hello-pythonhello-python-helm0.1.11 of 1See more

ms-hello-python hello-python-helm 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
irakli/ms-hello-python:latest9e7a91ba9ae0
setuptools@63.2.0
83.0.0

Open the chart page →

891
congson-charthelm-chart-example10.1.02 of 2See more

congson-chart helm-chart-example1 0.1.0

2 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
kunchalavikram/connectedcity:v14a559a47579e
setuptools@40.7.1
83.0.0
kunchalavikram/connectedfactory:v152c13fb9b1d9
setuptools@40.7.1
83.0.0

Open the chart page →

1,400
esphomehelm-chart-roeiVerified publisher2025.3.01 of 1See more

esphome helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
esphome/esphome:2025.3.0def8b6e4f517
setuptools@66.1.1
83.0.0

Open the chart page →

6,036
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
setuptools@75.8.2
83.0.0

Open the chart page →

4,651
hawkbit-operatorhelm-chartsVerified publisher0.1.41 of 1See more

hawkbit-operator helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ctron/hawkbit-operator:0.1.48fdea8f76499
setuptools@39.2.0
83.0.0

Open the chart page →

5,791
iofoghelm-chartsVerified publisher0.1.11 of 3See more

iofog helm-charts 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
quay.io/ctrontesting/iofog-controller:latest10df27bc5560
setuptools@39.2.0
83.0.0

Open the chart page →

24,171
streamsheetshelm-chartsVerified publisher0.2.35 of 8See more

streamsheets helm-charts 0.2.3

5 of the 8 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/ctron/streamsheets-base:2.4.00cf25ed621e2
setuptools@39.2.0
83.0.0
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
setuptools@39.2.0
83.0.0
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
setuptools@39.2.0
83.0.0
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
setuptools@39.2.0
83.0.0
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
setuptools@39.2.0
83.0.0

Open the chart page →

89,964
cachethelm-charts-nr1.3.51 of 2See more

cachet helm-charts-nr 1.3.5

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
cachethq/docker:2.3.15a61ff0f67ea7
setuptools@33.1.1.post20171031
83.0.0

Open the chart page →

1,895
kube-downscalerhelm-charts-nr0.7.61 of 1See more

kube-downscaler helm-charts-nr 0.7.6

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
setuptools@65.5.1
83.0.0

Open the chart page →

4,310
locusthelm-charts-nr0.32.41 of 1See more

locust helm-charts-nr 0.32.4

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
locustio/locust:2.32.2a0d4b88e42c1
setuptools@65.5.1
83.0.0

Open the chart page →

2,817
mlflowhelm-charts-nr1.0.101 of 1See more

mlflow helm-charts-nr 1.0.10

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
larribas/mlflow:1.9.105ccb0b46bfb
setuptools@46.1.3
83.0.0

Open the chart page →

4,422
prometheus-aws-costs-exporterhelm-charts-nr0.1.51 of 1See more

prometheus-aws-costs-exporter helm-charts-nr 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
nachomillangarcia/prometheus_aws_cost_exporter:lateste4ce056f2d6d
setuptools@40.2.0
83.0.0

Open the chart page →

3,553
rds-downscalerhelm-charts-nr1.0.51 of 1See more

rds-downscaler helm-charts-nr 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
library/python:3.7.0-alpine3.8e12594db7297
setuptools@40.4.3
83.0.0

Open the chart page →

574
supersethelm-charts-nr1.1.31 of 1See more

superset helm-charts-nr 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
apache/superset:latest16b50bbef664
setuptools@80.9.0
83.0.0

Open the chart page →

2,328
weblatehelm-charts-nr0.3.21 of 3See more

weblate helm-charts-nr 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
weblate/weblate:4.2.2-169c160d37a3c
setuptools@40.8.0
83.0.0

Open the chart page →

7,987
dbapphelmcourseVerified publisher0.3.31 of 2See more

dbapp helmcourse 0.3.3

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
setuptools@58.1.0
83.0.0

Open the chart page →

3,971
mysqlhelmcourseVerified publisher0.2.41 of 1See more

mysql helmcourse 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
setuptools@58.1.0
83.0.0

Open the chart page →

1,518
appwritehelmforgeVerified publisher2.0.01 of 5See more

appwrite helmforge 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
appwrite/appwrite:2.2.0896bdd024de3
setuptools@82.0.1
83.0.0

Open the chart page →

4,689
archiveboxhelmforgeVerified publisher1.1.121 of 1See more

archivebox helmforge 1.1.12

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
archivebox/archivebox:0.7.41a5a37331091
setuptools@79.0.1
83.0.0

Open the chart page →

7,675
changedetectionhelmforgeVerified publisher1.1.161 of 1See more

changedetection helmforge 1.1.16

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.5f69554198005
setuptools@79.0.1
83.0.0

Open the chart page →

2,612
ckanhelmforgeVerified publisher1.3.81 of 6See more

ckan helmforge 1.3.8

1 of the 6 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ckan/ckan-base-datapusher:0.0.2184d11924549f
setuptools@52.0.0
83.0.0

Open the chart page →

10,027
countlyhelmforgeVerified publisher1.2.61 of 3See more

countly helmforge 1.2.6

1 of the 3 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
countly/countly-server:25.05.4e3c238248f99
setuptools@45.2.0-1
no fix listed

Open the chart page →

18,938
immichhelmforgeVerified publisher1.2.81 of 5See more

immich helmforge 1.2.8

1 of the 5 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-machine-learning:v3.1.05a0839dc5303
setuptools@79.0.1
83.0.0

Open the chart page →

11,122
middlewarehelmforgeVerified publisher1.2.61 of 4See more

middleware helmforge 1.2.6

1 of the 4 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
middlewareeng/middleware:0.3.1747d880812f1
setuptools@58.1.0
83.0.0

Open the chart page →

9,771
notediscoveryhelmforgeVerified publisher2.0.11 of 1See more

notediscovery helmforge 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/gamosoft/notediscovery:0.31.5c06aa0fa9a85
setuptools@79.0.1
83.0.0

Open the chart page →

1,263
poznotehelmforgeVerified publisher2.0.31 of 1See more

poznote helmforge 2.0.3

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/timothepoznanski/poznote:6.86.0182664fe1ca0
setuptools@80.9.0
83.0.0

Open the chart page →

483

Container images carrying it

1,311 by charts deploying them

A fixed version is listed for 4 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
setuptools@68.1.2-2ubuntu1.2
setuptools@68.1.2
no fix listed
83.0.0
1
registry.gitlab.com/dyff/dyff-orchestrator:0.22.199bd5d93aaff7
setuptools@82.0.1
83.0.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb:4.4.5cf72810d33f5
setuptools@39.2.0
83.0.0
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
setuptools@45.2.0-1
setuptools@45.2.0
no fix listed
83.0.0
1
registry.gitlab.com/open-forms/design-catalogue:latestf21f19346b29
setuptools@51.0.0
83.0.0
1
registry.gitlab.com/open-forms/forms-catalogue:latest4eaf9c911f33
setuptools@57.5.0
83.0.0
1
registry.gitlab.com/open-forms/request-registry:latest0886cbbc5f95
setuptools@57.5.0
83.0.0
1
registry.gitlab.com/radiology/infrastructure/study-governor:8.0.04e7faf6f8d5f
setuptools@69.0.2
83.0.0
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
setuptools@69.0.3
83.0.0
1
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
setuptools@53.0.0
83.0.0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
setuptools@80.9.0
83.0.0
1

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.