StackRadar

CVE-2026-59890

Medium

Advisory

Published 8 Jul 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.004
34th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,257
of 17,792 indexed, latest versions
Container images
1,311
deployed by those charts
Fix available
4 of 5
affected packages

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

Carried by container images the latest versions of 1,257 of 17,792 indexed charts deploy, on 1,311 images.

Affected packageAffected versionsFixed inImages
setuptoolspypi0.9.8, 20.7.0, 20.8.0, 29.0.1.post20161130+135 more83.0.01,249
setuptoolsdeb45.2.0-1, 45.2.0-1ubuntu0.1, 45.2.0-1ubuntu0.2, 45.2.0-1ubuntu0.3+9 moreno fix listed160
setuptoolsbitnami70.3.0, 80.9.083.0.03
py3-setuptoolsapk75.8.0-r083.0.0-r01
python-3.11deb3.11.15+e43.11.16+e21
OSV records
BIT-setuptools-2026-59890CGA-45cv-ppqx-4qxhGHSA-h35f-9h28-mq5cUBUNTU-CVE-2026-59890ECHO-732c-d358-5fef
Also known as
CGA-4hr8-28qq-pc5f, CGA-7mpr-r977-c726, CGA-qfw9-8w49-7c33, PYSEC-2026-3447

Charts affected

1,257 by stars
ChartLatestAffected imagesRadar Score
artifactory-cleanupsubshellVerified publisher1.0.11 of 1See more

artifactory-cleanup subshell 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
devopshq/artifactory-cleanup:1.0.1830e093bffa91
setuptools@58.1.0
83.0.0

Open the chart page →

2,551
substra-backendsubstraVerified publisher26.15.31 of 7See more

substra-backend substra 26.15.3

1 of the 7 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/substra/substra-backend:1.0.121967f54ec86
setuptools@75.8.0
83.0.0

Open the chart page →

4,799
verbasubstratusVerified publisher0.4.01 of 1See more

verba substratus 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
substratusai/verba:v0.4.0-baseURL261695be635eb
setuptools@65.5.1
83.0.0

Open the chart page →

13,463
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
setuptools@66.1.1
83.0.0

Open the chart page →

3,494
netforge-besvtechVerified publisher0.0.21 of 3See more

netforge-be svtech 0.0.2

1 of the 3 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
mher/flower:2.051c3c3db5be3
setuptools@65.5.1
83.0.0

Open the chart page →

4,701
csv-viewsvtech-public-helm-charts1.0.01 of 1See more

csv-view svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
svtechnmaa/svtech_csv:v1.0.1b9d7ecf8de24
setuptools@49.3.1
83.0.0

Open the chart page →

1,220
freeradiussvtech-public-helm-charts0.1.51 of 4See more

freeradius svtech-public-helm-charts 0.1.5

1 of the 4 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
library/mysql:8.2.0212fe73edca5
setuptools@50.3.2
83.0.0

Open the chart page →

12,712
icinga2svtech-public-helm-charts1.0.01 of 4See more

icinga2 svtech-public-helm-charts 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
svtechnmaa/svtech_icinga2:v1.1.667be2aba9436
setuptools@40.8.0
83.0.0

Open the chart page →

5,535
icinga2-reportsvtech-public-helm-charts1.0.01 of 1See more

icinga2-report svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
trungkien210493/icinga2-report:v1.7.12cc8c3763c4c
setuptools@49.2.0
83.0.0

Open the chart page →

1,779
maxscalesvtech-public-helm-charts1.0.01 of 2See more

maxscale svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
library/mysql:8.2.0212fe73edca5
setuptools@50.3.2
83.0.0

Open the chart page →

5,883
postfixsvtech-public-helm-charts1.0.01 of 1See more

postfix svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
svtechnmaa/svtech_postfix:v1.0.2d5327df8b8a2
setuptools@51.3.3
83.0.0

Open the chart page →

77
rundecksvtech-public-helm-charts1.0.01 of 2See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
setuptools@45.2.0-1ubuntu0.1
setuptools@69.5.1
no fix listed
83.0.0

Open the chart page →

18,846
rundeck-option-providersvtech-public-helm-charts1.0.01 of 2See more

rundeck-option-provider svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
svtechnmaa/svtech_rundeck_option_provider:v1.1.1674fad30a51f
setuptools@49.3.1
83.0.0

Open the chart page →

1,428
swr-cache-proxyswr-cache-proxy0.2.01 of 1See more

swr-cache-proxy swr-cache-proxy 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
vividplanet/swr-cache-proxy:v1ae1c5b1cbecb
setuptools@39.2.0
83.0.0

Open the chart page →

14,058
stashswuuper-githubVerified publisher0.1.161 of 1See more

stash swuuper-github 0.1.16

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
stashapp/stash:v0.31.1df744af5a0c9
setuptools@80.9.0
83.0.0

Open the chart page →

2,402
cronjobt3n0.1.01 of 1See more

cronjob t3n 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
library/python:3.8d41127070014
setuptools@57.5.0
83.0.0

Open the chart page →

11,272
gtmetrix-bqt3n1.0.01 of 1See more

gtmetrix-bq t3n 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
t3nde/gtmetrix-bq:0.2.0d2939e9a719b
setuptools@46.1.3
83.0.0

Open the chart page →

1,287
take-the-helmtake-the-helm0.1.01 of 1See more

take-the-helm take-the-helm 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
cadmusthefounder/lnd:take-the-helm-0.1.0e596c5fbf80f
setuptools@58.1.0
83.0.0

Open the chart page →

805
democharttech-challenge0.1.02 of 4See more

demochart tech-challenge 0.1.0

2 of the 4 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
alexvm6/generator:latestfb99ee4f760a
setuptools@65.5.1
83.0.0
alexvm6/pythonalex:latest89a05786879c
setuptools@65.5.1
83.0.0

Open the chart page →

3,630
rundeck-exportertechpreta0.1.91 of 1See more

rundeck-exporter techpreta 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
phsmith/rundeck-exporter:2.6.10265a7616ae8
setuptools@65.5.1
83.0.0

Open the chart page →

1,104
hadoop-deploymenttejaswita-hadoop-helmchart1.0.01 of 1See more

hadoop-deployment tejaswita-hadoop-helmchart 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
apache/hadoop:3af361b20bec0
setuptools@0.9.8
83.0.0

Open the chart page →

4,240
temporaltemporal0.28.91 of 13See more

temporal temporal 0.28.9

1 of the 13 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.22.0836af062af30
setuptools@67.7.2
83.0.0

Open the chart page →

21,040
tensor_apptensor-app0.2.22 of 3See more

tensor_app tensor-app 0.2.2

2 of the 3 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
setuptools@58.1.0
83.0.0
xeladock/mysql_dns:latest4baf531453f1
setuptools@59.6.0-1.2
setuptools@59.6.0
no fix listed
83.0.0

Open the chart page →

17,590
krokiteochenglim1.0.11 of 5See more

kroki teochenglim 1.0.1

1 of the 5 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
yuzutech/kroki-blockdiag:0.16.07c1917c66d96
setuptools@57.5.0
83.0.0

Open the chart page →

8,717
webapp1test-helm-chart-10.1.01 of 1See more

webapp1 test-helm-chart-1 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
devopsjourney1/mywebapp:latestbd1ec6838570
setuptools@57.5.0
83.0.0

Open the chart page →

1,469
asrtest-opea1.0.01 of 1See more

asr test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
opea/asr:1.025dd26d9cd09
setuptools@65.5.1
83.0.0

Open the chart page →

4,411
chatqnatest-opea1.0.06 of 11See more

chatqna test-opea 1.0.0

6 of the 11 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
opea/chatqna:1.038c51b791efa
setuptools@65.5.1
83.0.0
opea/embedding-tei:1.05c9639de61c1
setuptools@65.5.1
83.0.0
opea/llm-tgi:1.00c25aab3f106
setuptools@65.5.1
83.0.0
opea/reranking-tei:1.0e48613afb191
setuptools@65.5.1
83.0.0
opea/retriever-redis:1.0eb746b263705
setuptools@65.5.1
83.0.0
redis/redis-stack:7.2.0-v91c5f43fddcdd
setuptools@59.6.0-1.2ubuntu0.22.04.1
no fix listed

Open the chart page →

39,273
codegentest-opea1.0.02 of 5See more

codegen test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
opea/codegen:1.058f91683892d
setuptools@65.5.1
83.0.0
opea/llm-tgi:1.00c25aab3f106
setuptools@65.5.1
83.0.0

Open the chart page →

28,944
codetranstest-opea1.0.02 of 5See more

codetrans test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
opea/codetrans:1.0e2436483b73d
setuptools@65.5.1
83.0.0
opea/llm-tgi:1.00c25aab3f106
setuptools@65.5.1
83.0.0

Open the chart page →

28,515
docsumtest-opea1.0.02 of 5See more

docsum test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
opea/docsum:1.03eaa91849512
setuptools@65.5.1
83.0.0
opea/llm-docsum-tgi:1.002f9e8fa5d71
setuptools@65.5.1
83.0.0

Open the chart page →

28,990
embedding-usvctest-opea1.0.01 of 1See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
opea/embedding-tei:1.05c9639de61c1
setuptools@65.5.1
83.0.0

Open the chart page →

5,203
guardrails-usvctest-opea1.0.01 of 1See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
opea/guardrails-tgi:1.0262c6048aab8
setuptools@65.5.1
83.0.0

Open the chart page →

5,238
llm-uservicetest-opea1.0.01 of 1See more

llm-uservice test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
opea/llm-tgi:1.00c25aab3f106
setuptools@65.5.1
83.0.0

Open the chart page →

4,737
redis-vector-dbtest-opea1.0.01 of 1See more

redis-vector-db test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
redis/redis-stack:7.2.0-v91c5f43fddcdd
setuptools@59.6.0-1.2ubuntu0.22.04.1
no fix listed

Open the chart page →

5,655
reranking-usvctest-opea1.0.01 of 1See more

reranking-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
opea/reranking-tei:1.0e48613afb191
setuptools@65.5.1
83.0.0

Open the chart page →

5,002
retriever-usvctest-opea1.0.01 of 1See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
opea/retriever-redis:1.0eb746b263705
setuptools@65.5.1
83.0.0

Open the chart page →

5,215
speecht5test-opea1.0.01 of 1See more

speecht5 test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
opea/speecht5:1.0249afad3d268
setuptools@65.5.1
83.0.0

Open the chart page →

9,668
ttstest-opea1.0.01 of 1See more

tts test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
opea/tts:1.0257ae94709e9
setuptools@65.5.1
83.0.0

Open the chart page →

4,395
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
setuptools@65.5.1
83.0.0

Open the chart page →

5,368
tezos-nodetezos-nodeVerified publisher1.0.01 of 4See more

tezos-node tezos-node 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
oxheadalpha/tezos-k8s-utils:5.3.4d9faed45bf1c
setuptools@57.5.0
83.0.0

Open the chart page →

5,322
thanhvt27-lab-k8sthanh-vtVerified publisher0.1.41 of 5See more

thanhvt27-lab-k8s thanh-vt 0.1.4

1 of the 5 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
pysga1996/python-redis-web:latestfdeec30ad482
setuptools@57.5.0
83.0.0

Open the chart page →

4,663
kasa-exporterth-chartsVerified publisher0.1.01 of 1See more

kasa-exporter th-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
thelande/kasa_exporter:v0.2.3a1fdb8baa152
setuptools@70.0.0
83.0.0

Open the chart page →

1,515
the0the0Verified publisher0.9.81 of 9See more

the0 the0 0.9.8

1 of the 9 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ghcr.io/alexanderwanyoike/the0/runtime:1.14.7459010a02aff
setuptools@68.1.2-2ubuntu1.2
no fix listed

Open the chart page →

7,360
monitoringthl-chartsVerified publisher0.1.11 of 10See more

monitoring thl-charts 0.1.1

1 of the 10 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:1.15.61f025ae37b7b
setuptools@60.9.3
83.0.0

Open the chart page →

18,940
jenkinstnh2.7.11 of 2See more

jenkins tnh 2.7.1

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:0.1.193170069ff0976
setuptools@49.6.0
83.0.0

Open the chart page →

4,445
todolist-charttodolist-chart0.1.71 of 10See more

todolist-chart todolist-chart 0.1.7

1 of the 10 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
erenozcan17/flask_analytics:v3.1c9b6f0dfbffc
setuptools@65.5.1
83.0.0

Open the chart page →

7,019
test0tohlejezkouska0.1.01 of 2See more

test0 tohlejezkouska 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
devopsjourney1/mywebapp:latestbd1ec6838570
setuptools@57.5.0
83.0.0

Open the chart page →

3,318
netbirdtotmicro1.8.21 of 4See more

netbird totmicro 1.8.2

1 of the 4 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
netbirdio/dashboard:v2.22.215a3aab9a345
setuptools@52.0.0
83.0.0

Open the chart page →

6,017
hermestoukVerified publisher0.6.01 of 3See more

hermes touk 0.6.0

1 of the 3 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
apicurio/apicurio-registry-kafkasql:2.1.0.Finala97d67487532
setuptools@39.2.0
83.0.0

Open the chart page →

12,724
traefik-external-dns-controllertraefik-external-dns-operator2.2.01 of 1See more

traefik-external-dns-controller traefik-external-dns-operator 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-59890.

Container imageDigestPackageFixed in
ybucci/traefik-external-dns-controller:2.2.08d27ad8b5f73
setuptools@79.0.1
83.0.0

Open the chart page →

1,506

Container images carrying it

1,311 by charts deploying them

A fixed version is listed for 4 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
setuptools@68.1.2-2ubuntu1.2
setuptools@68.1.2
no fix listed
83.0.0
1
registry.gitlab.com/dyff/dyff-orchestrator:0.22.199bd5d93aaff7
setuptools@82.0.1
83.0.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb:4.4.5cf72810d33f5
setuptools@39.2.0
83.0.0
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
setuptools@45.2.0-1
setuptools@45.2.0
no fix listed
83.0.0
1
registry.gitlab.com/open-forms/design-catalogue:latestf21f19346b29
setuptools@51.0.0
83.0.0
1
registry.gitlab.com/open-forms/forms-catalogue:latest4eaf9c911f33
setuptools@57.5.0
83.0.0
1
registry.gitlab.com/open-forms/request-registry:latest0886cbbc5f95
setuptools@57.5.0
83.0.0
1
registry.gitlab.com/radiology/infrastructure/study-governor:8.0.04e7faf6f8d5f
setuptools@69.0.2
83.0.0
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
setuptools@69.0.3
83.0.0
1
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
setuptools@53.0.0
83.0.0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
setuptools@80.9.0
83.0.0
1

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.