StackRadar

CVE-2026-59890

Medium

Advisory

Published 8 Jul 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.004
34th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,257
of 17,792 indexed, latest versions
Container images
1,311
deployed by those charts
Fix available
4 of 5
affected packages

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

Carried by container images the latest versions of 1,257 of 17,792 indexed charts deploy, on 1,311 images.

Affected packageAffected versionsFixed inImages
setuptoolspypi0.9.8, 20.7.0, 20.8.0, 29.0.1.post20161130+135 more83.0.01,249
setuptoolsdeb45.2.0-1, 45.2.0-1ubuntu0.1, 45.2.0-1ubuntu0.2, 45.2.0-1ubuntu0.3+9 moreno fix listed160
setuptoolsbitnami70.3.0, 80.9.083.0.03
py3-setuptoolsapk75.8.0-r083.0.0-r01
python-3.11deb3.11.15+e43.11.16+e21
OSV records
BIT-setuptools-2026-59890CGA-45cv-ppqx-4qxhGHSA-h35f-9h28-mq5cUBUNTU-CVE-2026-59890ECHO-732c-d358-5fef
Also known as
CGA-4hr8-28qq-pc5f, CGA-7mpr-r977-c726, CGA-qfw9-8w49-7c33, PYSEC-2026-3447

Charts affected

1,257 by stars
ChartLatestAffected imagesRadar Score
logsmo-helm-chart6.0.01 of 6See more

log smo-helm-chart 6.0.0

1 of the 6 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.07daa08b81954
setuptools@39.0.1
83.0.0

Open the chart page →

29,256
mariadb-initsmo-helm-chart6.0.01 of 2See more

mariadb-init smo-helm-chart 6.0.0

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.2875814cc853d
setuptools@40.8.0
83.0.0

Open the chart page →

24,811
msbsmo-helm-chart6.0.01 of 6See more

msb smo-helm-chart 6.0.0

1 of the 6 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.07daa08b81954
setuptools@39.0.1
83.0.0

Open the chart page →

27,513
pndasmo-helm-chart6.0.01 of 3See more

pnda smo-helm-chart 6.0.0

1 of the 3 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.07daa08b81954
setuptools@39.0.1
83.0.0

Open the chart page →

27,513
pombasmo-helm-chart6.0.01 of 17See more

pomba smo-helm-chart 6.0.0

1 of the 17 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.07daa08b81954
setuptools@39.0.1
83.0.0

Open the chart page →

29,256
portalsmo-helm-chart6.0.01 of 8See more

portal smo-helm-chart 6.0.0

1 of the 8 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.07daa08b81954
setuptools@39.0.1
83.0.0

Open the chart page →

27,513
sdcsmo-helm-chart6.0.01 of 14See more

sdc smo-helm-chart 6.0.0

1 of the 14 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.2875814cc853d
setuptools@40.8.0
83.0.0

Open the chart page →

25,804
sdnc-ansible-serversmo-helm-chart6.0.01 of 3See more

sdnc-ansible-server smo-helm-chart 6.0.0

1 of the 3 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.2875814cc853d
setuptools@40.8.0
83.0.0

Open the chart page →

25,804
sdnc-portalsmo-helm-chart6.0.01 of 3See more

sdnc-portal smo-helm-chart 6.0.0

1 of the 3 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.2875814cc853d
setuptools@40.8.0
83.0.0

Open the chart page →

25,804
sdnc-promsmo-helm-chart6.0.01 of 2See more

sdnc-prom smo-helm-chart 6.0.0

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.2875814cc853d
setuptools@40.8.0
83.0.0

Open the chart page →

24,811
sdnc-websmo-helm-chart6.0.01 of 3See more

sdnc-web smo-helm-chart 6.0.0

1 of the 3 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.2875814cc853d
setuptools@40.8.0
83.0.0

Open the chart page →

24,811
ueb-listenersmo-helm-chart6.0.01 of 3See more

ueb-listener smo-helm-chart 6.0.0

1 of the 3 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.2875814cc853d
setuptools@40.8.0
83.0.0

Open the chart page →

25,804
smtpsmtpVerified publisher1.3.31 of 1See more

smtp smtp 1.3.3

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
setuptools@80.9.0
83.0.0

Open the chart page →

1,437
sneakerssneakers1.0.01 of 4See more

sneakers sneakers 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
helga09/my_sql_shoes:v1.1.1a03657d97897
setuptools@50.3.2
83.0.0

Open the chart page →

7,596
cost-analyzersoftonic2.5.52 of 6See more

cost-analyzer softonic 2.5.5

2 of the 6 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
gcr.io/kubecost1/kubecost-modeling:v0.1.24a2259b098b13
setuptools@75.8.2
83.0.0
ghcr.io/kiwigrid/k8s-sidecar:1.29.142002d66ddb3
setuptools@75.8.0
83.0.0

Open the chart page →

7,957
gar-exportersoftonic0.1.11 of 1See more

gar-exporter softonic 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
softonic/gar-exporter:0.2.1a64d6c0e0ae5
setuptools@50.3.2
83.0.0

Open the chart page →

2,296
kube-prometheus-stacksoftonic81.5.11 of 6See more

kube-prometheus-stack softonic 81.5.1

1 of the 6 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
setuptools@80.9.0
83.0.0

Open the chart page →

4,989
pwssoketi0.2.41 of 1See more

pws soketi 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
quay.io/soketi/pws:0.8-16-alpine399d2e6b10ef
setuptools@58.2.0
83.0.0

Open the chart page →

3,228
atlassian-confluencesomeblackmagic3.4.11 of 1See more

atlassian-confluence someblackmagic 3.4.1

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
atlassian/confluence-server:7.10.03b9222ab32ef
setuptools@59.6.0-1.2
no fix listed

Open the chart page →

13,657
atlassian-jirasomeblackmagic3.3.21 of 1See more

atlassian-jira someblackmagic 3.3.2

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
atlassian/jira-software:8.14.037bc46cbec1a
setuptools@59.6.0-1.2ubuntu0.22.04.1
no fix listed

Open the chart page →

13,130
testing-multitoolsomeblackmagic0.1.21 of 1See more

testing-multitool someblackmagic 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
someblackmagic/k8s-testing-multitool:v0.1.06eca64b6b440
setuptools@45.2.0-1
setuptools@45.2.0
no fix listed
83.0.0

Open the chart page →

30,779
spacecapybara-chartspacecapy1.0.491 of 2See more

spacecapybara-chart spacecapy 1.0.49

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
sashafefler/spacecapybara_app:latestf96d7804c0ca
setuptools@57.5.0
83.0.0

Open the chart page →

11,979
speckle-server-branch-hotfix-2.19.1speckleVerified publisher2.19.2-branch.hotfix-2.19.1.124125-665e7e11 of 5See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of the 5 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
speckle/speckle-monitor-deployment:2.19.2-branch.hotfix-2.19.1.124125-665e7e1b696ac5022ab
setuptools@66.1.1
83.0.0

Open the chart page →

16,463
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb1 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of the 5 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
speckle/speckle-monitor-deployment:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb2faf1508c1d3
setuptools@66.1.1
83.0.0

Open the chart page →

16,495
speckle-server-branch-testingspeckleVerified publisher2.17.14-branch.testing.72707.921a5f81 of 5See more

speckle-server-branch-testing speckle 2.17.14-branch.testing.72707.921a5f8

1 of the 5 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
speckle/speckle-monitor-deployment:2.17.14-branch.testing.72707.921a5f8ff1641ac3f1b
setuptools@66.1.1
83.0.0

Open the chart page →

14,756
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091141 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

1 of the 5 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
speckle/speckle-monitor-deployment:2.20.6-branch.testing1.154030-9b09114738c77eb6f97
setuptools@66.1.1
83.0.0

Open the chart page →

16,495
speckle-server-branch-testing2speckleVerified publisher2.18.11-branch.testing2.88634-335d4691 of 5See more

speckle-server-branch-testing2 speckle 2.18.11-branch.testing2.88634-335d469

1 of the 5 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
speckle/speckle-monitor-deployment:2.18.11-branch.testing2.88634-335d469d6790a97ad47
setuptools@66.1.1
83.0.0

Open the chart page →

14,299
speckle-server-branch-testing3speckleVerified publisher2.18.12-branch.testing3.88744-f55b3411 of 5See more

speckle-server-branch-testing3 speckle 2.18.12-branch.testing3.88744-f55b341

1 of the 5 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
speckle/speckle-monitor-deployment:2.18.12-branch.testing3.88744-f55b34181335b40696a
setuptools@66.1.1
83.0.0

Open the chart page →

14,299
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b21 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

1 of the 5 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
speckle/speckle-monitor-deployment:2.20.2-branch.testing4.134160-9fad4b23c8fbe855665
setuptools@66.1.1
83.0.0

Open the chart page →

16,114
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef1 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
speckle/speckle-monitor-deployment:2.21.3-branch.testing5.219631-2153befcf72ad0f25fb
setuptools@66.1.1
83.0.0

Open the chart page →

15,725
speedtest-exporterspeedtest-exporter0.2.21 of 1See more

speedtest-exporter speedtest-exporter 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/miguelndecarvalho/speedtest-exporter:v3.5.4f1064d49124c
setuptools@65.5.0
83.0.0

Open the chart page →

741
ambassador-manifestssqream-chartsVerified publisher0.6.31 of 1See more

ambassador-manifests sqream-charts 0.6.3

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
datawire/aes:3.11.195ec30b3c732
setuptools@69.5.1
83.0.0

Open the chart page →

2,422
downscalersqream-chartsVerified publisher1.0.01 of 1See more

downscaler sqream-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.05d328c003efe
setuptools@65.5.1
83.0.0

Open the chart page →

1,009
servicexssl-hep1.8.510 of 16See more

servicex ssl-hep 1.8.5

10 of the 16 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
library/python:3.1070c9cc675605
setuptools@79.0.1
83.0.0
ncsa/checks:main0b738bbc8d70
setuptools@65.5.1
83.0.0
sslhep/servicex_code_gen_atlas_xaod:v1.8.5e7aff7f97b89
setuptools@79.0.1
83.0.0
sslhep/servicex_code_gen_func_adl_uproot:v1.8.5b01b8ee966ed
setuptools@79.0.1
83.0.0
sslhep/servicex_code_gen_python:v1.8.50e4175a4e1eb
setuptools@79.0.1
83.0.0
sslhep/servicex_code_gen_raw_uproot:v1.8.5671980005c57
setuptools@79.0.1
83.0.0
sslhep/servicex_code_gen_topcp:v1.8.5596db2abdd09
setuptools@79.0.1
83.0.0
sslhep/servicex-did-finder:v1.8.5ab0090083567
setuptools@53.0.0
83.0.0
sslhep/servicex-did-finder-cernopendata:v1.8.52cb88ceab5bb
setuptools@79.0.1
83.0.0
sslhep/x509-secrets:v1.8.5d9e9ecb12d59
setuptools@53.0.0
83.0.0

Open the chart page →

67,262
allurestakaterVerified publisher1.0.11 of 1See more

allure stakater 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
quay.io/eformat/jenkins-agent-graalvm:latesta3b9a07648b6
setuptools@39.2.0
83.0.0

Open the chart page →

28,515
nordmart-reviewstakaterVerified publisher0.0.61 of 3See more

nordmart-review stakater 0.0.6

1 of the 3 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
stakater/stakater-nordmart-review:1.0.35954d2be66e95
setuptools@39.2.0
83.0.0

Open the chart page →

11,557
nordmart-review-instancestakaterVerified publisher1.0.01 of 3See more

nordmart-review-instance stakater 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
stakater/stakater-nordmart-review:1.0.35954d2be66e95
setuptools@39.2.0
83.0.0

Open the chart page →

11,557
pgadminstakaterVerified publisher0.1.141 of 1See more

pgadmin stakater 0.1.14

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
dpage/pgadmin4:4.5a5a656e1d5fd
setuptools@40.8.0
83.0.0

Open the chart page →

2,060
restful-distributed-lock-managerstakaterVerified publisher1.0.41 of 1See more

restful-distributed-lock-manager stakater 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
stakater/restful-distributed-lock-manager:0.5.34f8e409f30c2
setuptools@38.5.2
83.0.0

Open the chart page →

3,117
stakefishstakefish0.1.01 of 8See more

stakefish stakefish 0.1.0

1 of the 8 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
thongngo3301/stakefish:latesta341af5976e3
setuptools@65.5.1
83.0.0

Open the chart page →

20,321
horcruxstakewise1.0.11 of 1See more

horcrux stakewise 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
stakewiselabs/bls-horcrux:v1.0.02afd0c0b34cb
setuptools@52.0.0
83.0.0

Open the chart page →

1,421
verostakewise0.8.31 of 2See more

vero stakewise 0.8.3

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/serenita-org/vero:v0.8.3e5a7ec714acc
setuptools@72.1.0
83.0.0

Open the chart page →

3,475
open-appsec-injectorstartechnicaVerified publisher1.1.21 of 3See more

open-appsec-injector startechnica 1.1.2

1 of the 3 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/openappsec/openappsec-waf-webhook:1.1.345b979b962043
setuptools@79.0.1
83.0.0

Open the chart page →

4,326
cost-analyzerstatcan1.82.21 of 9See more

cost-analyzer statcan 1.82.2

1 of the 9 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:1.12.089739be9ff38
setuptools@56.0.0
83.0.0

Open the chart page →

16,537
datapusherstatcan1.0.01 of 1See more

datapusher statcan 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
keitaro/ckan-datapusher:0.0.175bf1a45f45c1
setuptools@50.3.0
83.0.0

Open the chart page →

3,044
prometheus-operatorstatcan0.2.21 of 7See more

prometheus-operator statcan 0.2.2

1 of the 7 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:0.1.1517b98eecdf6d1
setuptools@46.1.3
83.0.0

Open the chart page →

12,251
meerkat-crmstone0.3.01 of 1See more

meerkat-crm stone 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/fbuchner/meerkat-crm:1.7.0d513bdd3ae80
setuptools@70.3.0
83.0.0

Open the chart page →

104
storageclass-routerstorageclass-routerVerified publisher0.4.11 of 1See more

storageclass-router storageclass-router 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
quay.io/maxiv/storageclass-router:0.4.160725dab588c
setuptools@69.0.3
83.0.0

Open the chart page →

1,057
sn-platform-slimstreamnative1.11.441 of 6See more

sn-platform-slim streamnative 1.11.44

1 of the 6 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
streamnative/apache-pulsar-grafana-dashboard-k8s:0.1.20e6d7aa3ef32
setuptools@45.2.0-1ubuntu0.1
setuptools@45.2.0
no fix listed
83.0.0

Open the chart page →

10,214
studygovernorstudy-governorVerified publisher0.1.381 of 3See more

studygovernor study-governor 0.1.38

1 of the 3 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
registry.gitlab.com/radiology/infrastructure/study-governor:8.0.04e7faf6f8d5f
setuptools@69.0.2
83.0.0

Open the chart page →

1,447

Container images carrying it

1,311 by charts deploying them

A fixed version is listed for 4 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
setuptools@68.1.2-2ubuntu1.2
setuptools@68.1.2
no fix listed
83.0.0
1
registry.gitlab.com/dyff/dyff-orchestrator:0.22.199bd5d93aaff7
setuptools@82.0.1
83.0.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb:4.4.5cf72810d33f5
setuptools@39.2.0
83.0.0
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
setuptools@45.2.0-1
setuptools@45.2.0
no fix listed
83.0.0
1
registry.gitlab.com/open-forms/design-catalogue:latestf21f19346b29
setuptools@51.0.0
83.0.0
1
registry.gitlab.com/open-forms/forms-catalogue:latest4eaf9c911f33
setuptools@57.5.0
83.0.0
1
registry.gitlab.com/open-forms/request-registry:latest0886cbbc5f95
setuptools@57.5.0
83.0.0
1
registry.gitlab.com/radiology/infrastructure/study-governor:8.0.04e7faf6f8d5f
setuptools@69.0.2
83.0.0
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
setuptools@69.0.3
83.0.0
1
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
setuptools@53.0.0
83.0.0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
setuptools@80.9.0
83.0.0
1

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.