StackRadar

CVE-2026-6042

Medium

Advisory

Published 10 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.8
base score, highest
EPSS
0.002
15th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,056
of 17,787 indexed, latest versions
Container images
1,114
deployed by those charts
Fix available
1 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,056 of 17,787 indexed charts deploy, on 1,114 images.

Affected packageAffected versionsFixed inImages
muslapk1.2.4_git20230717-r4, 1.2.4_git20230717-r5, 1.2.5-r0, 1.2.5-r1+4 more1.2.4_git20230717-r6, 1.2.5-r2, 1.2.5-r10, 1.2.5-r11+2 more1,113
musldeb1.2.2-4no fix listed1
OSV records
ALPINE-CVE-2026-6042UBUNTU-CVE-2026-6042

Charts affected

1,056 by stars
ChartLatestAffected imagesRadar Score
syftopenmined0.9.52 of 6See more

syft openmined 0.9.5

2 of the 6 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
library/traefik:v2.11.00a5157f742d2
musl@1.2.4_git20230717-r4
1.2.4_git20230717-r6
openmined/syft-seaweedfs:0.9.53a4144c0bb82
musl@1.2.4_git20230717-r4
1.2.4_git20230717-r6

Open the chart page →

17,306
puppetserverpuppetserver9.5.21 of 5See more

puppetserver puppetserver 9.5.2

1 of the 5 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
curlimages/curl:8.7.125d29daeb9b1
musl@1.2.4_git20230717-r4
1.2.4_git20230717-r6

Open the chart page →

14,276
pyrrarlex0.15.01 of 1See more

pyrra rlex 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
ghcr.io/pyrra-dev/pyrra:v0.8.10e02ef538ef0
musl@1.2.5-r0
1.2.5-r2

Open the chart page →

953
emqx-operatoremqx-operator2.3.21 of 2See more

emqx-operator emqx-operator 2.3.2

1 of the 2 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
alpine/k8s:1.31.49c4976d47656
musl@1.2.5-r8
1.2.5-r10

Open the chart page →

4,532
bookstackgabe565Verified publisher0.20.01 of 1See more

bookstack gabe565 0.20.0

1 of the 1 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/bookstack:version-v24.12.1cc795b254b73
musl@1.2.5-r9
1.2.5-r10

Open the chart page →

2,811
meshery-operatormesheryOfficialVerified publisher1.0.701 of 2See more

meshery-operator meshery 1.0.70

1 of the 2 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
alpine/k8s:1.35.6b7a12c5ddf26
musl@1.2.5-r21
1.2.6-r1

Open the chart page →

2,416
tailscale-relaymvisonneau0.2.71 of 1See more

tailscale-relay mvisonneau 0.2.7

1 of the 1 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
mvisonneau/tailscale:v1.68.1fc45ad8abf10
musl@1.2.5-r0
1.2.5-r2

Open the chart page →

1,356
ketoory0.64.01 of 1See more

keto ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
oryd/keto:v26.2.0bfdb8b9e283a
musl@1.2.5-r9
1.2.5-r10

Open the chart page →

817
oathkeeperory0.64.01 of 1See more

oathkeeper ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
oryd/oathkeeper:v26.2.0467329abde34
musl@1.2.5-r9
1.2.5-r10

Open the chart page →

769
py-kube-downscalerpy-kube-downscalerVerified publisher0.3.121 of 1See more

py-kube-downscaler py-kube-downscaler 0.3.12

1 of the 1 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
ghcr.io/caas-team/py-kube-downscaler:26.4.0af05a098b0d2
musl@1.2.5-r21
1.2.5-r22

Open the chart page →

732
redisinsightredisinsight-guiVerified publisher1.3.51 of 1See more

redisinsight redisinsight-gui 1.3.5

1 of the 1 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
redis/redisinsight:3.8b5e19ee240ab
musl@1.2.5-r21
1.2.5-r22

Open the chart page →

1,039
redisinsight-secureredisinsight-secureVerified publisher1.0.21 of 1See more

redisinsight-secure redisinsight-secure 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
redis/redisinsight:2.68019fcf774631
musl@1.2.5-r0
1.2.5-r2

Open the chart page →

1,721
servarrservarr1.0.26 of 10See more

servarr servarr 1.0.2

6 of the 10 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
dinutac/jinja2docker:2.1.89340dde8a8a4
musl@1.2.4_git20230717-r4
1.2.4_git20230717-r6
rapidfort/curl:8.7.18483c9f4490f
musl@1.2.4_git20230717-r4
1.2.4_git20230717-r6
ghcr.io/onedr0p/prowlarr-develop:1.14.0.4286c77d84ebf7a6
musl@1.2.4_git20230717-r4
1.2.4_git20230717-r6
ghcr.io/onedr0p/qbittorrent:4.6.3a4ad890e8c4a
musl@1.2.4_git20230717-r4
1.2.4_git20230717-r6
ghcr.io/onedr0p/radarr:5.3.6.86128d299e59fce7
musl@1.2.4_git20230717-r4
1.2.4_git20230717-r6
ghcr.io/onedr0p/sonarr:4.0.2.118327ffdcc8a937
musl@1.2.4_git20230717-r4
1.2.4_git20230717-r6

Open the chart page →

14,231
rekorsigstoreVerified publisher1.8.52 of 9See more

rekor sigstore 1.8.5

2 of the 9 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
curlimages/curldigest-pinned935d9100e9ba
musl@1.2.5-r10
1.2.5-r11
library/redisdigest-pinned148bb5411c18
musl@1.2.5-r9
1.2.5-r10

Open the chart page →

5,416
thehivestrangebee-helmOfficialVerified publisher1.0.61 of 7See more

thehive strangebee-helm 1.0.6

1 of the 7 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
curlimages/curl:8.17.0935d9100e9ba
musl@1.2.5-r10
1.2.5-r11

Open the chart page →

16,161
uffizzi-controlleruffizzi-controller2.4.61 of 11See more

uffizzi-controller uffizzi-controller 2.4.6

1 of the 11 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.10.1e24f39d3eed6
musl@1.2.4_git20230717-r4
1.2.4_git20230717-r6

Open the chart page →

14,266
druidwiremindVerified publisher1.22.11 of 3See more

druid wiremind 1.22.1

1 of the 3 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
curlimages/curl:8.5.008e466006f08
musl@1.2.4_git20230717-r4
1.2.4_git20230717-r6

Open the chart page →

7,935
zipkinygqygq2Verified publisher2.1.41 of 4See more

zipkin ygqygq2 2.1.4

1 of the 4 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
openzipkin/zipkin:2.24197a9692f6a9
musl@1.2.4_git20230717-r4
1.2.4_git20230717-r6

Open the chart page →

2,764
zigbee2mqttzigbee2mqtt2.14.11 of 2See more

zigbee2mqtt zigbee2mqtt 2.14.1

1 of the 2 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
mikefarah/yq:4.45.12c100efaca06
musl@1.2.5-r8
1.2.5-r10

Open the chart page →

1,032
cloudflaredartur9010Verified publisher1.0.91 of 3See more

cloudflared artur9010 1.0.9

1 of the 3 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.15.1594ceea76b01
musl@1.2.5-r21
1.2.5-r22

Open the chart page →

2,990
celestia-appcelestia-labsVerified publisher0.5.01 of 3See more

celestia-app celestia-labs 0.5.0

1 of the 3 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-app:v3.7.0-arabica23a9ec9b1879
musl@1.2.4_git20230717-r5
1.2.4_git20230717-r6

Open the chart page →

1,066
dolibarrcowboysysopVerified publisher9.0.31 of 3See more

dolibarr cowboysysop 9.0.3

1 of the 3 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
wait4x/wait4x:3.3.14dcd86307de1
musl@1.2.5-r9
1.2.5-r10

Open the chart page →

9,154
homerdjjudas21Verified publisher8.2.41 of 1See more

homer djjudas21 8.2.4

1 of the 1 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
b4bz/homer:v24.12.14b44a4a9e329
musl@1.2.5-r0
1.2.5-r2

Open the chart page →

398
k8s-image-swapperestahnVerified publisher1.11.01 of 2See more

k8s-image-swapper estahn 1.11.0

1 of the 2 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
ghcr.io/estahn/k8s-image-swapper:1.5.102f5be9cde5f9
musl@1.2.4_git20230717-r4
1.2.4_git20230717-r6

Open the chart page →

1,980
geonode-k8sgeonode-k8sVerified publisher2.0.01 of 10See more

geonode-k8s geonode-k8s 2.0.0

1 of the 10 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
alpine/curl:8.5.0513c4f0d7123
musl@1.2.4_git20230717-r4
1.2.4_git20230717-r6

Open the chart page →

14,043
sbomscannerkubewardenVerified publisher0.12.11 of 5See more

sbomscanner kubewarden 0.12.1

1 of the 5 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
natsio/nats-server-config-reloader:0.23.064cb6c858e79
musl@1.2.5-r21
1.2.5-r22

Open the chart page →

988
venti-stackkuossOfficialVerified publisher0.5.02 of 9See more

venti-stack kuoss 0.5.0

2 of the 9 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
ghcr.io/kuoss/lethe:v0.3.3ebdf55fd5705
musl@1.2.5-r10
1.2.5-r11
ghcr.io/kuoss/venti:v0.3.38ee3e70d77f1
musl@1.2.5-r10
1.2.5-r11

Open the chart page →

3,810
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
musl@1.2.5-r9
1.2.5-r10

Open the chart page →

2,654
radarrloeken-at-homeVerified publisher5.27.0-nightly1 of 1See more

radarr loeken-at-home 5.27.0-nightly

1 of the 1 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
loeken/radarr:5.27.0-nightlya24409d3846d
musl@1.2.5-r9
1.2.5-r10

Open the chart page →

586
musicocielmusicocielVerified publisher0.0.01 of 3See more

musicociel musicociel 0.0.0

1 of the 3 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
davdiv/musicociel:deva85f99be882c
musl@1.2.4_git20230717-r4
1.2.4_git20230717-r6

Open the chart page →

4,405
headplanenbcloudVerified publisher0.1.21 of 4See more

headplane nbcloud 0.1.2

1 of the 4 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
ghcr.io/tale/headplane:0.5.50dbc52cffc19
musl@1.2.5-r9
1.2.5-r10

Open the chart page →

7,968
prometheus-smartctl-exporterprometheus-communityVerified publisher0.17.11 of 1See more

prometheus-smartctl-exporter prometheus-community 0.17.1

1 of the 1 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
quay.io/prometheuscommunity/smartctl-exporter:v0.14.0cfe22c36d7d2
musl@1.2.5-r9
1.2.5-r10

Open the chart page →

1,064
popeyeself-hosters-by-nightVerified publisher0.6.11 of 1See more

popeye self-hosters-by-night 0.6.1

1 of the 1 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
derailed/popeye:v0.22.18e68e22c7663
musl@1.2.5-r8
1.2.5-r10

Open the chart page →

1,196
fulciosigstoreVerified publisher2.11.11 of 6See more

fulcio sigstore 2.11.1

1 of the 6 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
curlimages/curl:8.17.0935d9100e9ba
musl@1.2.5-r10
1.2.5-r11

Open the chart page →

3,491
unboundunbound-helmchartVerified publisher0.2.21 of 1See more

unbound unbound-helmchart 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
ghcr.io/pixelfederation/unbound:1.24.2_0fce820a03964
musl@1.2.5-r21
1.2.5-r22

Open the chart page →

1,495
matrixzekker6Verified publisher3.30.01 of 4See more

matrix zekker6 3.30.0

1 of the 4 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
devture/exim-relay:4.98-r0-47ba30080c7a6
musl@1.2.5-r8
1.2.5-r10

Open the chart page →

5,568
pod-gatewayangelnu7.1.11 of 2See more

pod-gateway angelnu 7.1.1

1 of the 2 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
ghcr.io/angelnu/pod-gateway:v1.13.0a5b032e15f75
musl@1.2.5-r9
1.2.5-r10

Open the chart page →

1,133
boundaryboundaryVerified publisher0.1.01 of 1See more

boundary boundary 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
hashicorp/boundary:0.21.037bf86488b74
musl@1.2.5-r9
1.2.5-r10

Open the chart page →

1,438
certscertsVerified publisher2.1.31 of 1See more

certs certs 2.1.3

1 of the 1 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
mathnao/certs:2.1.3b900e6b64684
musl@1.2.5-r9
1.2.5-r10

Open the chart page →

695
popeyechristianhuthVerified publisher2.4.31 of 1See more

popeye christianhuth 2.4.3

1 of the 1 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
derailed/popeye:v0.22.18e68e22c7663
musl@1.2.5-r8
1.2.5-r10

Open the chart page →

1,196
dumpscriptcloudscriptVerified publisher1.8.31 of 1See more

dumpscript cloudscript 1.8.3

1 of the 1 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
ghcr.io/cloudscript-technology/dumpscript:v0.0.42-alpine-edgefce5b6fd161c
musl@1.2.5-r21
1.2.6-r1

Open the chart page →

2,126
clowardenclowarden0.2.32 of 4See more

clowarden clowarden 0.2.3

2 of the 4 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
ghcr.io/cncf/clowarden/dbmigrator:v0.2.3c022fd42de45
musl@1.2.5-r10
1.2.5-r11
ghcr.io/cncf/clowarden/server:v0.2.3f9379427b917
musl@1.2.5-r10
1.2.5-r11

Open the chart page →

5,620
coder-observabilitycoder-observabilityVerified publisher0.7.33 of 21See more

coder-observability coder-observability 0.7.3

3 of the 21 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
dannyben/madness:latestebdf50556c02
musl@1.2.5-r0
1.2.5-r2
grafana/grafana:10.4.19a9043254ba16
musl@1.2.5-r9
1.2.5-r10
library/memcached:1.6.23-alpine41d19476c100
musl@1.2.4_git20230717-r4
1.2.4_git20230717-r6

Open the chart page →

24,698
foremancontane-githubOfficialVerified publisher0.6.01 of 1See more

foreman contane-github 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
contane/foreman:0.5.2efb98bdcc4e9
musl@1.2.5-r9
1.2.5-r10

Open the chart page →

1,152
cosmocosmo-platformOfficialVerified publisher0.20.02 of 10See more

cosmo cosmo-platform 0.20.0

2 of the 10 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
musl@1.2.5-r9
1.2.5-r10
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
musl@1.2.5-r9
1.2.5-r10

Open the chart page →

27,984
hoppscotchdeliveryheroVerified publisher0.3.21 of 1See more

hoppscotch deliveryhero 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
musl@1.2.4_git20230717-r4
1.2.4_git20230717-r6

Open the chart page →

3,451
kube-benchdeliveryheroVerified publisher0.1.171 of 1See more

kube-bench deliveryhero 0.1.17

1 of the 1 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
aquasec/kube-bench:v0.8.0ea3e33bc3c4e
musl@1.2.5-r0
1.2.5-r2

Open the chart page →

1,623
duplistatusduplistatusVerified publisher1.2.01 of 2See more

duplistatus duplistatus 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
curlimages/curl:8.18.0d94d07ba9e7d
musl@1.2.5-r21
1.2.5-r22

Open the chart page →

1,872
bscdysnixVerified publisher0.6.592 of 4See more

bsc dysnix 0.6.59

2 of the 4 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
ghcr.io/bnb-chain/bsc:1.6.2fd0e3ec7d960
musl@1.2.5-r9
1.2.5-r10
ghcr.io/dysnix/docker-tiny:0.0.16b8e02430649
musl@1.2.5-r9
1.2.5-r10

Open the chart page →

2,012
flowableflowable-oss7.1.01 of 2See more

flowable flowable-oss 7.1.0

1 of the 2 container images this version deploys carry CVE-2026-6042.

Container imageDigestPackageFixed in
flowable/flowable-rest:7.1.0b7ae287502cd
musl@1.2.5-r0
1.2.5-r2

Open the chart page →

2,784

Container images carrying it

1,114 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/reiml/smtp-gotify:latest80ffa9d2044a
musl@1.2.5-r1
1.2.5-r2
1
quay.io/shivering-isles/dovecot:2.3.214599ada9aa06
musl@1.2.5-r0
1.2.5-r2
1
quay.io/underndog/samba:1.2.0-not-recyclecca801de9fa5
musl@1.2.5-r9
1.2.5-r10
1
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
musl@1.2.5-r10
1.2.5-r11
1
registry.gitlab.com/dyff/dyff-frontend:0.20.152549f52ae53
musl@1.2.5-r9
1.2.5-r10
1
registry.gitlab.com/shortlink-org/shortlink/bff:latestf2194e526915
musl@1.2.5-r21
1.2.5-r22
1
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
musl@1.2.5-r21
1.2.5-r22
1
registry.k8s.io/ingress-nginx/controller:v1.13.21f7eaeb01933
musl@1.2.5-r10
1.2.5-r11
1
registry.k8s.io/ingress-nginx/controller:v1.13.137e489b22ac7
musl@1.2.5-r10
1.2.5-r11
1
registry.k8s.io/ingress-nginx/controller:v1.10.042b3f0e5d084
musl@1.2.4_git20230717-r4
1.2.4_git20230717-r6
1
registry.k8s.io/ingress-nginx/controller:v1.11.3d56f135b6462
musl@1.2.5-r0
1.2.5-r2
1
registry.k8s.io/ingress-nginx/controller:v1.10.1e24f39d3eed6
musl@1.2.4_git20230717-r4
1.2.4_git20230717-r6
1
registry.k8s.io/ingress-nginx/controller:v1.12.0e6b8de175acd
musl@1.2.5-r8
1.2.5-r10
1
registry.k8s.io/provider-os/manila-csi-plugin:v1.36.0190976e2e2fe
musl@1.2.5-r21
1.2.5-r22
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.