StackRadar

CVE-2026-61801

Medium

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Medium
worst across findings
CVSS
5.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
630
of 18,071 indexed, latest versions
Container images
314
deployed by those charts
Fix available
1 of 1
affected package

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

Carried by container images the latest versions of 630 of 18,071 indexed charts deploy, on 314 images.

Affected packageAffected versionsFixed inImages
github.com/moby/sys/usergolangv0.1.0, v0.2.0, v0.3.0, v0.4.00.4.1314
OSV records
GHSA-mjcv-p78q-w5fw
Trending
Rank 20 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

630 by stars
ChartLatestAffected imagesRadar Score
harborharborOfficialVerified publisher1.19.21 of 8See more

harbor harbor 1.19.2

1 of the 8 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

2,723
rancherrancher-stable2.15.22 of 2See more

rancher rancher-stable 2.15.2

2 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
rancher/rancher:v2.15.20c3d8e570255
github.com/moby/sys/user@v0.4.0
0.4.1
rancher/shell:v0.8.21eeed72d4eda
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

2,326
artifact-hubartifact-hubVerified publisher1.23.04 of 7See more

artifact-hub artifact-hub 1.23.0

4 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
aquasec/trivy:0.69.3bcc376de8d77
github.com/moby/sys/user@v0.4.0
0.4.1
artifacthub/postgres:latest4fd34fa635cc
github.com/moby/sys/user@v0.1.0
0.4.1
artifacthub/scanner:v1.23.02d8365601f0e
github.com/moby/sys/user@v0.4.0
0.4.1
artifacthub/tracker:v1.23.05368d21a6e5c
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

14,174
openebsopenebsOfficialVerified publisher4.6.21 of 35See more

openebs openebs 4.6.2

1 of the 35 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
grafana/alloy:v1.8.17790f6f7fbd8
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

33,271
open-webuiopen-webui16.6.01 of 4See more

open-webui open-webui 16.6.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redis:7.4.2-alpine3.2102419de7eddf
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,277
zabbixzabbix-communityVerified publisher7.1.01 of 5See more

zabbix zabbix-community 7.1.0

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:161a6ab3f5345e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

15,941
keycloakcloudpirates-keycloakVerified publisher0.21.462 of 3See more

keycloak cloudpirates-keycloak 0.21.46

2 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.0073e7c8b84e2
github.com/moby/sys/user@v0.1.0
0.4.1
library/postgres:18.674935e722416
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,977
postgrescloudpirates-postgresVerified publisher0.21.21 of 1See more

postgres cloudpirates-postgres 0.21.2

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.674935e722416
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,636
zammadzammadOfficialVerified publisher19.1.41 of 5See more

zammad zammad 19.1.4

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.4a02db8cac496
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,014
chaos-meshchaos-meshVerified publisher2.8.43 of 4See more

chaos-mesh chaos-mesh 2.8.4

3 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-daemon:v2.8.40d28dbd95b03
github.com/moby/sys/user@v0.4.0
0.4.1
ghcr.io/chaos-mesh/chaos-dashboard:v2.8.48a8ec8d4c9ea
github.com/moby/sys/user@v0.4.0
0.4.1
ghcr.io/chaos-mesh/chaos-mesh:v2.8.49e48285bb44c
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

8,160
portainerportainer245.2.01 of 1See more

portainer portainer 245.2.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
portainer/portainer-ce:2.45.203f94a406496
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

420
mesherymesheryOfficialVerified publisher1.0.701 of 1See more

meshery meshery 1.0.70

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
meshery/meshery:stable-latest44b64ee128fb
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,841
postgresgroundhog2k1.6.81 of 1See more

postgres groundhog2k 1.6.8

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.65a5a84b19854
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,753
rancherrancher-latest2.15.22 of 2See more

rancher rancher-latest 2.15.2

2 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
rancher/rancher:v2.15.20c3d8e570255
github.com/moby/sys/user@v0.4.0
0.4.1
rancher/shell:v0.8.21eeed72d4eda
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

2,326
mariadbcloudpirates-mariadbVerified publisher0.16.161 of 1See more

mariadb cloudpirates-mariadb 0.16.16

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:13.0.2f1bba652ba57
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,745
mongodbcloudpirates-mongodbVerified publisher0.20.01 of 1See more

mongodb cloudpirates-mongodb 0.20.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:9.0.2bac22ea7710d
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,192
unleashunleash5.6.81 of 2See more

unleash unleash 5.6.8

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18-alpine77f585114c32
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,412
oktetooktetoOfficialVerified publisher0.0.0-2026-08-311 of 10See more

okteto okteto 0.0.0-2026-08-31

1 of the 10 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/okteto/buildkit:0.0.0-2026-08-3114527ca5d2a9
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

7,401
concourseconcourseVerified publisher20.3.12 of 2See more

concourse concourse 20.3.1

2 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
concourse/concourse:8.3.1c9d48dfbf4f9
github.com/moby/sys/user@v0.4.0
0.4.1
library/postgres:17d74eeac9a635
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,049
openprojectopenproject-helm-chartsOfficialVerified publisher13.13.11 of 5See more

openproject openproject-helm-charts 13.13.1

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:161a6ab3f5345e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,355
zabbixcetic3.1.31 of 5See more

zabbix cetic 3.1.3

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:14c2427de38f99
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

37,344
gadgetgadgetOfficialVerified publisher0.56.11 of 1See more

gadget gadget 0.56.1

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/inspektor-gadget/inspektor-gadget:v0.56.1d1c34335183b
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

167
netbirdjaconiVerified publisher0.15.11 of 4See more

netbird jaconi 0.15.1

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
netbirdio/management:0.45.10c9994b393ea
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

10,057
argocdnicklasfrahm-argocdVerified publisher0.3.01 of 2See more

argocd nicklasfrahm-argocd 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
public.ecr.aws/docker/library/redis:7.2.8-alpinec88ea2979a49
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

7,106
oneuptimeoneuptimeOfficialVerified publisher14.0.241 of 7See more

oneuptime oneuptime 14.0.24

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:latest74935e722416
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

8,871
kubescape-operatorkubescape1.40.52 of 6See more

kubescape-operator kubescape 1.40.5

2 of the 6 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/kubescape/kubescape:v4.0.14418fa941ecc0
github.com/moby/sys/user@v0.4.0
0.4.1
quay.io/kubescape/node-agent:v0.3.2192044ed750f5e
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,679
plane-cemakeplaneOfficialVerified publisher1.8.41 of 11See more

plane-ce makeplane 1.8.4

1 of the 11 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15.7-alpine468d34fefd63
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,435
codefreshcodefresh-onpremOfficialVerified publisher2.12.211 of 42See more

codefresh codefresh-onprem 2.12.21

1 of the 42 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/codefresh/dind:3.0.250885ab519dac
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

18,934
coreneuvectorchartsVerified publisher2.11.23 of 5See more

core neuvectorcharts 2.11.2

3 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
neuvector/controller:5.6.2824e29cf32c5
github.com/moby/sys/user@v0.4.0
0.4.1
neuvector/enforcer:5.6.272e1deee40fb
github.com/moby/sys/user@v0.4.0
0.4.1
neuvector/scanner:6d9e8b2ee8d69
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

952
questdbquestdb1.0.271 of 2See more

questdb questdb 1.0.27

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
questdb/questdb:10.0.167eaed863ebb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

74
spegelspegelVerified publisher0.7.41 of 1See more

spegel spegel 0.7.4

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/spegel-org/spegeldigest-pinned26c60b05e08a
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

370
supabasetokens-studioVerified publisher1.0.01 of 14See more

supabase tokens-studio 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15-alpinef7d23353e1b1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

26,261
timescaledbcloudpirates-timescaledbVerified publisher0.13.121 of 1See more

timescaledb cloudpirates-timescaledb 0.13.12

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
timescale/timescaledb:2.30.2-pg17b346edcdb51a
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,048
minecraft-proxyminecraft-server-chartsVerified publisher3.10.01 of 1See more

minecraft-proxy minecraft-server-charts 3.10.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
itzg/bungeecord:latest7b7ff61d2a60
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,215
hedgedocadfinisVerified publisher0.6.11 of 2See more

hedgedoc adfinis 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.48ff36f3c6637
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,040
connaisseurconnaisseurVerified publisher2.13.01 of 2See more

connaisseur connaisseur 2.13.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redisdigest-pinned83edc2b8e9ff
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,993
dependabot-gitlabdependabot-gitlabVerified publisher6.3.02 of 3See more

dependabot-gitlab dependabot-gitlab 6.3.0

2 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.6-alpine77f585114c32
github.com/moby/sys/user@v0.1.0
0.4.1
pgautoupgrade/pgautoupgrade:18-alpine2245aabc5b80
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

43,220
lakekeeperlakekeeperVerified publisher0.12.01 of 2See more

lakekeeper lakekeeper 0.12.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.4a02db8cac496
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,586
nuclionuclio0.23.91 of 2See more

nuclio nuclio 0.23.9

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/nuclio/dashboard:1.17.9-amd64708fe10f099a
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,746
pmmpercona1.9.11 of 1See more

pmm percona 1.9.1

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
percona/pmm-server:3.9.1003f9c25f842
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,056
docmosthelmforgeVerified publisher1.4.11 of 4See more

docmost helmforge 1.4.1

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.6-trixiefc973eb97c9f
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,461
wordpresshelmforgeVerified publisher3.0.91 of 3See more

wordpress helmforge 3.0.9

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:26.7.09d48c42f8341
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,267
lightrun-helm-chartlightrun-helm-chartOfficialVerified publisher3.53.01 of 9See more

lightrun-helm-chart lightrun-helm-chart 3.53.0

1 of the 9 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.4.108dbcf531a03a
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

791
olmolmVerified publisher0.46.01 of 1See more

olm olm 0.46.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/operator-framework/olm:v0.46.04404599eb7b7
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

409
passboltpassbolt2.2.01 of 6See more

passbolt passbolt 2.2.0

1 of the 6 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:latestd4fdec0510ad
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

13,878
backstagerhdh-chartVerified publisher4.0.11 of 2See more

backstage rhdh-chart 4.0.1

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/rhdh/rhdh-hub-rhel9:latest4f8c0f8a8ee0
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,934
rekorsigstoreVerified publisher1.8.71 of 9See more

rekor sigstore 1.8.7

1 of the 9 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redisdigest-pinned148bb5411c18
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

7,582
snyk-monitorsnyk2.23.261 of 2See more

snyk-monitor snyk 2.23.26

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
snyk/kubernetes-monitor:2.23.26fb5ad76ce84e
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,008
abcdesktopabcdesktopOfficialVerified publisher4.4.131 of 9See more

abcdesktop abcdesktop 4.4.13

1 of the 9 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/abcdesktopio/mongo:safe8.0b91afcb145a5
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,081
glpiglpi-conteiner0.1.01 of 3See more

glpi glpi-conteiner 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:latestf1bba652ba57
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

12,962

Container images carrying it

314 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/codefresh/dind:3.0.250885ab519dac
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/fossa/postgres:17.2-15af45ac79f38
github.com/moby/sys/user@v0.1.0
0.4.1
1
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/kubescape/kubescape:v4.0.14418fa941ecc0
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/kubescape/node-agent:v0.3.2192044ed750f5e
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/nuclio/dashboard:1.17.9-amd64708fe10f099a
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/openshift/origin-cli:latest10fef10863a3
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/operator-framework/catalogd:v1.8.06ff40fa6257f
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/operator-framework/olm40d0363f4aa6
github.com/moby/sys/user@v0.1.0
0.4.1
1
quay.io/operator-framework/olm:v0.46.04404599eb7b7
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/operator-framework/operator-controller:v1.8.0bca5dfcc67ca
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/rhdh/rhdh-hub-rhel9:latest4f8c0f8a8ee0
github.com/moby/sys/user@v0.4.0
0.4.1
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao:v2.6.2-gitlab13bc2e20d60d1
github.com/moby/sys/user@v0.4.0
0.4.1
1
registry.gitlab.com/xrow-public/ci-tools/tools:mainaa62b23f2b5e
github.com/moby/sys/user@v0.4.0
0.4.1
1

syft 1.42.1 · advisories as of 9 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.