StackRadar

CVE-2026-59890

Medium

Advisory

Published 8 Jul 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.004
34th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,264
of 17,790 indexed, latest versions
Container images
1,324
deployed by those charts
Fix available
4 of 5
affected packages

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

Carried by container images the latest versions of 1,264 of 17,790 indexed charts deploy, on 1,324 images.

Affected packageAffected versionsFixed inImages
setuptoolspypi0.9.8, 20.7.0, 20.8.0, 29.0.1.post20161130+135 more83.0.01,262
setuptoolsdeb45.2.0-1, 45.2.0-1ubuntu0.1, 45.2.0-1ubuntu0.2, 45.2.0-1ubuntu0.3+9 moreno fix listed161
setuptoolsbitnami70.3.0, 80.9.083.0.03
py3-setuptoolsapk75.8.0-r083.0.0-r01
python-3.11deb3.11.15+e43.11.16+e21
OSV records
BIT-setuptools-2026-59890CGA-45cv-ppqx-4qxhGHSA-h35f-9h28-mq5cUBUNTU-CVE-2026-59890ECHO-732c-d358-5fef
Also known as
CGA-4hr8-28qq-pc5f, CGA-7mpr-r977-c726, CGA-qfw9-8w49-7c33, PYSEC-2026-3447

Charts affected

1,264 by stars
ChartLatestAffected imagesRadar Score
squash-apilsst-sqre0.1.61 of 3See more

squash-api lsst-sqre 0.1.6

1 of the 3 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
lsstsqre/squash-api:0.5.34879415ec6ac
setuptools@51.0.0
83.0.0

Open the chart page →

6,642
flaresolverrluiscajl0.0.31 of 1See more

flaresolverr luiscajl 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
flaresolverr/flaresolverr:latest139dfee1c6f8
setuptools@79.0.1
83.0.0

Open the chart page →

27,554
hyperglassm0nsterrr-hyperglassVerified publisher4.2.11 of 2See more

hyperglass m0nsterrr-hyperglass 4.2.1

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/m0nsterrr/hyperglass:v2.0.4f7b5d20c5e42
setuptools@70.0.0
83.0.0

Open the chart page →

4,669
kube-hunterm9sweeperVerified publisher1.6.01 of 1See more

kube-hunter m9sweeper 1.6.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
aquasec/kube-hunter:0.6.8e64fe49f059f
setuptools@57.5.0
83.0.0

Open the chart page →

997
docker-mailservermailserverVerified publisher0.2.651 of 9See more

docker-mailserver mailserver 0.2.65

1 of the 9 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
jeboehm/mailserver-web:5.0.929da13edf5aa8
setuptools@80.9.0
83.0.0

Open the chart page →

10,921
plane-mcp-servermakeplaneVerified publisher1.0.01 of 2See more

plane-mcp-server makeplane 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
makeplane/plane-mcp-server:v0.3.071b7252adef0
setuptools@79.0.1
83.0.0

Open the chart page →

2,602
nodecg-chartmarathon-charts0.1.51 of 2See more

nodecg-chart marathon-charts 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/rodg/rtmp-controller:latest67f99a5beab7
setuptools@65.5.1
83.0.0

Open the chart page →

7,334
novosgamarcusrepo0.1.11 of 2See more

novosga marcusrepo 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
setuptools@58.1.0
83.0.0

Open the chart page →

3,713
webapp-colormarcusrepo0.1.11 of 1See more

webapp-color marcusrepo 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
kodekloud/webapp-color:latest99c3821ea49b
setuptools@40.4.3
83.0.0

Open the chart page →

911
mayastormayastorVerified publisher2.12.11 of 31See more

mayastor mayastor 2.12.1

1 of the 31 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:1.30.2cdb361e67b1b
setuptools@76.0.0
83.0.0

Open the chart page →

21,269
cleanuparrmedia-servarrVerified publisher0.19.11 of 1See more

cleanuparr media-servarr 0.19.1

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/cleanuparr/cleanuparr:2.10.68136c3beda7a
setuptools@68.1.2-2ubuntu1.2
no fix listed

Open the chart page →

1,436
flaresolverrmedia-servarrVerified publisher0.18.11 of 1See more

flaresolverr media-servarr 0.18.1

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/flaresolverr/flaresolverr:v3.5.2c80ae007ce2c
setuptools@79.0.1
83.0.0

Open the chart page →

6,416
tinymediamanagermedia-servarrVerified publisher1.6.21 of 2See more

tinymediamanager media-servarr 1.6.2

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
tinymediamanager/tinymediamanager:5.3.22b34dc85099e
setuptools@78.1.1
83.0.0

Open the chart page →

8,147
meerschaummeerschaumVerified publisher0.2.01 of 1See more

meerschaum meerschaum 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
bmeares/meerschaum:2.8.48e9c5bacaa82
setuptools@65.5.1
83.0.0

Open the chart page →

5,886
memgraph-mcpmemgraphVerified publisher1.0.01 of 1See more

memgraph-mcp memgraph 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
memgraph/mcp-memgraph:0.1.13ecdf7faea3f7
setuptools@82.0.1
83.0.0

Open the chart page →

1,699
kube-prometheus-stackmesosphere87.16.01 of 7See more

kube-prometheus-stack mesosphere 87.16.0

1 of the 7 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.8.1abb55b2165c6
setuptools@82.0.1
83.0.0

Open the chart page →

7,452
nfs-server-provisionermesosphere0.6.11 of 1See more

nfs-server-provisioner mesosphere 0.6.1

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
quay.io/kubernetes_incubator/nfs-provisioner:v2.3.0f402e6039b3c
setuptools@40.8.0
83.0.0

Open the chart page →

2,806
prometheus-operatormesosphere12.11.131 of 8See more

prometheus-operator mesosphere 12.11.13

1 of the 8 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
setuptools@80.9.0
83.0.0

Open the chart page →

11,704
kommandermesosphere-stable0.39.21 of 29See more

kommander mesosphere-stable 0.39.2

1 of the 29 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:1.3.065095a82d4a1
setuptools@50.3.2
83.0.0

Open the chart page →

68,417
kube-prometheus-stackmesosphere-stable75.9.11 of 7See more

kube-prometheus-stack mesosphere-stable 75.9.1

1 of the 7 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:1.30.349dcce269568
setuptools@78.1.0
83.0.0

Open the chart page →

10,227
pritunlmglants0.1.01 of 1See more

pritunl mglants 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
goofball222/pritunl:1.30.3070.5943c0743701d4
setuptools@52.0.0
83.0.0

Open the chart page →

1,902
activemqmicroboxlabs3.8.01 of 1See more

activemq microboxlabs 3.8.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
alfresco/alfresco-activemq:5.18.7-jre17-rockylinux85472f88d9b0b
setuptools@39.2.0
83.0.0

Open the chart page →

1,505
middleware-odigosmiddleware-labsVerified publisher0.2.411 of 6See more

middleware-odigos middleware-labs 0.2.41

1 of the 6 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/odigos-odiglet:middleware-test-0.0.103c8c835ecee
setuptools@67.4.0
83.0.0

Open the chart page →

8,378
middleware-visionmiddleware-labsVerified publisher0.2.651 of 6See more

middleware-vision middleware-labs 0.2.65

1 of the 6 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/vision-odiglet:middleware-test-0.0.3bce34c98668e
setuptools@67.6.0
83.0.0

Open the chart page →

8,370
alluremidokura-communityVerified publisher0.1.31 of 2See more

allure midokura-community 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
frankescobar/allure-docker-service:2.19.0cafa03b94dac
setuptools@47.1.1
83.0.0

Open the chart page →

12,858
errbotmidokura-communityVerified publisher0.0.51 of 1See more

errbot midokura-community 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
errbotio/errbot:6.1.900ee4e0953ab
setuptools@60.5.0
83.0.0

Open the chart page →

2,234
fossologymidokura-communityVerified publisher0.2.21 of 2See more

fossology midokura-community 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
fossology/fossology:4.2.18bd1f22ba7bb
setuptools@65.5.1
83.0.0

Open the chart page →

3,295
saltmidokura-communityVerified publisher0.0.31 of 1See more

salt midokura-community 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
saltstack/salt:3006.3e9c7906b7a5c
setuptools@58.1.0
83.0.0

Open the chart page →

896
parent-chartmid-proje0.1.01 of 3See more

parent-chart mid-proje 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
youssef11gaber10/flask-service:latest9c727fcfde76
setuptools@79.0.1
83.0.0

Open the chart page →

1,796
python-api-postgresmiltex0.0.11 of 2See more

python-api-postgres miltex 0.0.1

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
miltex/python-api:1.0.0dab12a7748d5
setuptools@44.0.0
83.0.0

Open the chart page →

2,347
pulsarv2milvus-helm2.7.82 of 4See more

pulsarv2 milvus-helm 2.7.8

2 of the 4 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
setuptools@40.6.3.post20190116
83.0.0
streamnative/apache-pulsar-grafana-dashboard-k8s:0.0.10ebcf7f033b54
setuptools@41.1.0
83.0.0

Open the chart page →

15,873
buildkite-exporterminaVerified publisher0.1.41 of 1See more

buildkite-exporter mina 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
codaprotocol/buildkite-exporter:0.2.137c68e67a401
setuptools@52.0.0
83.0.0

Open the chart page →

2,599
o1-botminaVerified publisher0.0.31 of 1See more

o1-bot mina 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
codaprotocol/coda-user-agent:0.1.54ba4dd3a041f
setuptools@45.2.0
83.0.0

Open the chart page →

2,656
minio-operatorminio-operator4.3.71 of 2See more

minio-operator minio-operator 4.3.7

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
minio/operator:v4.3.754393e03f3b2
setuptools@39.2.0
83.0.0

Open the chart page →

6,085
MINTmint8.0.22 of 15See more

MINT mint 8.0.2

2 of the 15 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
mintproject/data-catalog:9be70359feabe03ed55bfdbf92c20a7e43ab928b67d2f2103085
setuptools@57.5.0
83.0.0
mintproject/model-catalog-fastapi:7dd88dc5bf1fe6a6d4703ea0a077afee45cb256102260d20a21f
setuptools@65.5.0
83.0.0

Open the chart page →

43,532
mlflow-servermlflow-server0.3.01 of 1See more

mlflow-server mlflow-server 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/mlops-for-all/mlflow-tracking-server:3.8-1.30.1-v1.0.0d30e631684c3
setuptools@57.5.0
83.0.0

Open the chart page →

3,158
cockroachdb-operatormmontesVerified publisher0.1.01 of 1See more

cockroachdb-operator mmontes 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
cockroachdb/cockroach-operator:v2.1.0983312754620
setuptools@39.2.0
83.0.0

Open the chart page →

7,782
pritunl-vpnmoinologics0.0.11 of 1See more

pritunl-vpn moinologics 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
goofball222/pritunl:1.32.3602.807bf26032dfce
setuptools@59.4.0
83.0.0

Open the chart page →

2,470
mlflowmondata-helm-chartsVerified publisher0.2.31 of 1See more

mlflow mondata-helm-charts 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
mondata/mlflow:v2.3.0.s3.gc6f94c6caf8bf
setuptools@65.5.1
83.0.0

Open the chart page →

3,811
sample-appmongodb-helm-charts0.1.01 of 2See more

sample-app mongodb-helm-charts 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
quay.io/mongodb/farm-intro-backend:0.11a9ce0b8fbd4
setuptools@57.5.0
83.0.0

Open the chart page →

6,438
face-recognitionmoreillonVerified publisher0.2.41 of 3See more

face-recognition moreillon 0.2.4

1 of the 3 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
moreillon/face-recognition-fastapi:x86bacb2ddd8394
setuptools@57.5.0
83.0.0

Open the chart page →

8,556
chirpstackmosquitto-helm-chart0.5.01 of 8See more

chirpstack mosquitto-helm-chart 0.5.0

1 of the 8 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.9.0d056c89b7131
setuptools@45.2.0-1
setuptools@45.2.0
no fix listed
83.0.0

Open the chart page →

26,022
pulsarmosquitto-helm-chart0.2.01 of 1See more

pulsar mosquitto-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.10.03b262ab7a7d9
setuptools@45.2.0-1
setuptools@45.2.0
no fix listed
83.0.0

Open the chart page →

15,727
mozalert-controllermozilla0.4.01 of 1See more

mozalert-controller mozilla 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
afrank/mozalert-controller:latestd463c37b08d7
setuptools@49.2.0
83.0.0

Open the chart page →

2,969
tianjimsgbyte0.1.171 of 2See more

tianji msgbyte 0.1.17

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
moonrailgun/tianji:1.11.2b528c8f8fcc4
setuptools@69.5.1
83.0.0

Open the chart page →

4,560
radicalemt1905024.1.11 of 1See more

radicale mt190502 4.1.1

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
tomsquest/docker-radicale:3.6.1.0a594c624c5a6
setuptools@80.9.0
83.0.0

Open the chart page →

1,546
mtlsmtls0.3.41 of 1See more

mtls mtls 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
drgrove/mtls-server:v0.14.2361721759a2b
setuptools@41.0.1
83.0.0

Open the chart page →

1,458
mum-discord-botmum-discord-botVerified publisher0.3.71 of 1See more

mum-discord-bot mum-discord-bot 0.3.7

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/drewburr-labs/mum-discord-bot:3.1.26e82914e1051
setuptools@65.5.1
83.0.0

Open the chart page →

13,759
szurubooru-servermy0nVerified publisher0.2.51 of 3See more

szurubooru-server my0n 0.2.5

1 of the 3 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
szurubooru/server:2.5accf2ad9fbc3
setuptools@80.9.0
83.0.0

Open the chart page →

1,044
my-app-namemy-app-name0.0.21 of 1See more

my-app-name my-app-name 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
viniciusfcf/gitops-quarkus-app-jvm:latestbba8ee1b5cd5
setuptools@39.2.0
83.0.0

Open the chart page →

9,418

Container images carrying it

1,324 by charts deploying them

A fixed version is listed for 4 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/opsmxpublic/ubi8-oes-db:v3.0.089ee6493af89
setuptools@39.2.0
83.0.0
1
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
setuptools@39.2.0
83.0.0
1
quay.io/opsmxpublic/ubi8-oes-ui:isd-spin-2025.10.01-e6f6f01-2025121006405d934bb66884
setuptools@39.2.0
83.0.0
1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
setuptools@65.5.1
83.0.0
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
setuptools@53.0.0
83.0.0
1
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
setuptools@80.10.2
83.0.0
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
setuptools@39.2.0
83.0.0
1
quay.io/seamware/consent-facade:0.0.14be844c750c7e
setuptools@39.2.0
83.0.0
1
quay.io/soketi/pws:0.8-16-alpine399d2e6b10ef
setuptools@58.2.0
83.0.0
1
quay.io/stackgres/operator:1.19.1f241b0b20326
setuptools@68.2.2
83.0.0
1
quay.io/strimzi/operator:0.36.1e9e03b31007c
setuptools@39.2.0
83.0.0
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
setuptools@39.2.0
83.0.0
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
setuptools@57.5.0
83.0.0
1
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
setuptools@68.1.2-2ubuntu1.2
setuptools@68.1.2
no fix listed
83.0.0
1
registry.gitlab.com/dyff/dyff-orchestrator:0.22.199bd5d93aaff7
setuptools@82.0.1
83.0.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb:4.4.5cf72810d33f5
setuptools@39.2.0
83.0.0
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
setuptools@45.2.0-1
setuptools@45.2.0
no fix listed
83.0.0
1
registry.gitlab.com/open-forms/design-catalogue:latestf21f19346b29
setuptools@51.0.0
83.0.0
1
registry.gitlab.com/open-forms/forms-catalogue:latest4eaf9c911f33
setuptools@57.5.0
83.0.0
1
registry.gitlab.com/open-forms/request-registry:latest0886cbbc5f95
setuptools@57.5.0
83.0.0
1
registry.gitlab.com/radiology/infrastructure/study-governor:8.0.04e7faf6f8d5f
setuptools@69.0.2
83.0.0
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
setuptools@69.0.3
83.0.0
1
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
setuptools@53.0.0
83.0.0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
setuptools@80.9.0
83.0.0
1

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.