StackRadar

CVE-2026-61801

Medium

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Medium
worst across findings
CVSS
5.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
630
of 18,071 indexed, latest versions
Container images
314
deployed by those charts
Fix available
1 of 1
affected package

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

Carried by container images the latest versions of 630 of 18,071 indexed charts deploy, on 314 images.

Affected packageAffected versionsFixed inImages
github.com/moby/sys/usergolangv0.1.0, v0.2.0, v0.3.0, v0.4.00.4.1314
OSV records
GHSA-mjcv-p78q-w5fw
Trending
Rank 20 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

630 by stars
ChartLatestAffected imagesRadar Score
fastapi-microservice-appfast-api-microservice-app1.3.01 of 4See more

fastapi-microservice-app fast-api-microservice-app 1.3.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:7.01f995ad6fdb9
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

10,612
ferriskeyferriskey0.9.01 of 3See more

ferriskey ferriskey 0.9.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17d74eeac9a635
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,413
leantimegissilabs1.3.01 of 2See more

leantime gissilabs 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:10.6.218a16204dc96c
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

7,577
meta-monitoringgrafana1.3.01 of 2See more

meta-monitoring grafana 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
grafana/alloy:v1.4.306bdcbb51fc2
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,694
greenkubegreenkubeVerified publisher0.3.01 of 3See more

greenkube greenkube 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18-alpine77f585114c32
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,028
ghostgroundhog2k0.212.161 of 1See more

ghost groundhog2k 0.212.16

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/ghost:6.69.055131b90d48c
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,881
IMgrycapOfficialVerified publisher1.8.01 of 3See more

IM grycap 1.8.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.46ea90827b110
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,087
boundary-controllerhashicorpVerified publisher0.2.01 of 1See more

boundary-controller hashicorp 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
hashicorp/boundary-enterprise:1.0.2-ent3a8061968ee4
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

291
boundary-workerhashicorpVerified publisher0.2.01 of 1See more

boundary-worker hashicorp 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
hashicorp/boundary-enterprise:1.0.2-ent3a8061968ee4
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

291
clickstackhdx-oss-v21.1.11 of 5See more

clickstack hdx-oss-v2 1.1.1

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:5.0.32-focal3b6c281e1c08
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,402
guacamolehelmforgeVerified publisher1.5.32 of 5See more

guacamole helmforge 1.5.3

2 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.6-trixie5a5a84b19854
github.com/moby/sys/user@v0.1.0
0.4.1
library/postgres:17.5-bookwormfbcea1bd13b6
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

10,438
mariadbhelmforgeVerified publisher2.1.21 of 1See more

mariadb helmforge 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:13.0.2d4fdec0510ad
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,891
matomohelmforgeVerified publisher2.3.21 of 3See more

matomo helmforge 2.3.2

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:26.7.0ade067ae2fb1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,205
holoinsightholoinsight0.2.51 of 6See more

holoinsight holoinsight 0.2.5

1 of the 6 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:86ea90827b110
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

29,874
backendikusi-bk-chart1.0.31 of 3See more

backend ikusi-bk-chart 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15724292da1f2e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,753
odooimioVerified publisher3.2.11 of 3See more

odoo imio 3.2.1

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17.10ebba4f4de37f
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,768
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0bcf63357191b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

18,319
jessejesse-chartVerified publisher0.0.461 of 6See more

jesse jesse-chart 0.0.46

1 of the 6 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:alpine77f585114c32
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,355
kikplatekikplateVerified publisher0.22.01 of 3See more

kikplate kikplate 0.22.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:161a6ab3f5345e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,355
netbirdkitstream-netbird0.7.11 of 3See more

netbird kitstream-netbird 0.7.1

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
netbirdio/netbird-server:0.78.2ac6317722f6f
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

1,218
glpikitsune-itopsVerified publisher1.0.71 of 3See more

glpi kitsune-itops 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:latestf1bba652ba57
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,638
kodboxkodboxVerified publisher0.6.11 of 5See more

kodbox kodbox 0.6.1

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:12.3.32bdff1534a7e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,328
owncloudkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

owncloud kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:10.117db29378d4fd
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

11,715
mesherykubesphere-stable0.5.01 of 13See more

meshery kubesphere-stable 0.5.0

1 of the 13 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
layer5/meshery:stable-latest78a8be21bef3
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

33,342
hertzbeatkubesphere-testVerified publisher1.4.11 of 4See more

hertzbeat kubesphere-test 1.4.1

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:86ea90827b110
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

8,501
checkoutlabs64io-helm-chartsVerified publisher0.11.81 of 3See more

checkout labs64io-helm-charts 0.11.8

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:1874935e722416
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,251
payment-gatewaylabs64io-helm-chartsVerified publisher0.10.81 of 2See more

payment-gateway labs64io-helm-charts 0.10.8

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:1874935e722416
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,229
lagoon-remotelagoon-chartsVerified publisher0.107.01 of 1See more

lagoon-remote lagoon-charts 0.107.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
uselagoon/docker-host:v3.6.12c89ed939b8b
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

2,962
litlyxlitlyx0.2.01 of 5See more

litlyx litlyx 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:8.0.11dca8d11fe467
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

9,711
magentomagento3.2.31 of 12See more

magento magento 3.2.3

1 of the 12 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:10.422edfe1c7834
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

17,336
mcp-orchestratormagertronVerified publisher4.0.831 of 7See more

mcp-orchestrator magertron 4.0.83

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17-alpineb0f9560a2de0
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,066
plane-enterprisemakeplaneOfficialVerified publisher3.10.51 of 13See more

plane-enterprise makeplane 3.10.5

1 of the 13 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15.7-alpine468d34fefd63
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,485
Practica_4_Recuperacion_helmmca-03-02-practica4-recuperacionVerified publisher1.0.11 of 6See more

Practica_4_Recuperacion_helm mca-03-02-practica4-recuperacion 1.0.1

1 of the 6 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:86ea90827b110
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

22,393
redminemt1905027.3.42 of 3See more

redmine mt190502 7.3.4

2 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:185a5a84b19854
github.com/moby/sys/user@v0.1.0
0.4.1
library/redmine:6.1.204ac44a2595b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

8,944
spring-helmnaveenalla-springboot1.0.01 of 2See more

spring-helm naveenalla-springboot 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:latest5a5a84b19854
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,753
librechatopenshift1.9.01 of 3See more

librechat openshift 1.9.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:8.0.20098862b1339f
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,669
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.31 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.3

1 of the 34 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.4a02db8cac496
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

25,547
opikopikOfficialVerified publisher2.2.952 of 12See more

opik opik 2.2.95

2 of the 12 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.4.2ac80b6e09e5b
github.com/moby/sys/user@v0.1.0
0.4.1
ghcr.io/comet-ml/opik/opik-python-backend:2.2.9516bffd322ecd
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

15,690
orbitalregorbitalregVerified publisher0.4.02 of 5See more

orbitalreg orbitalreg 0.4.0

2 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1
orbitalreg/orbitalreg-scanner:0.4.0f72711b94d11
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

5,101
pbuf-registrypbuf-registry0.4.11 of 2See more

pbuf-registry pbuf-registry 0.4.1

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.1-alpine3.2144d837eb4c2e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,811
phpipamphpipam-helmVerified publisher1.0.121 of 3See more

phpipam phpipam-helm 1.0.12

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.0.40d58ac93387f6
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,658
matomopockostVerified publisher1.4.01 of 3See more

matomo pockost 1.4.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:12.3.3dd9b303aed4f
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,129
postgresqlpostgresqlVerified publisher0.3.172 of 2See more

postgresql postgresql 0.3.17

2 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.6-alpine77f585114c32
github.com/moby/sys/user@v0.1.0
0.4.1
pgautoupgrade/pgautoupgrade:18-alpine2245aabc5b80
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,232
postgresqlpostgresql-helm0.1.21 of 1See more

postgresql postgresql-helm 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:161a6ab3f5345e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,753
preparrpreparr0.19.81 of 6See more

preparr preparr 0.19.8

1 of the 6 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18-alpine77f585114c32
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,169
privacyideaprivacyidea1.0.61 of 2See more

privacyidea privacyidea 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:11.7.2fcc7fcd7114a
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,777
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

9,999
redmineredmine-helm-chartVerified publisher0.2.61 of 1See more

redmine redmine-helm-chart 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redmine:6.1.3-trixief474a901faec
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,471
reportportalreportportal-ioOfficialVerified publisher26.8.121 of 15See more

reportportal reportportal-io 26.8.12

1 of the 15 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.4a02db8cac496
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

15,810
rocket-chatrocket-chatVerified publisher0.1.51 of 3See more

rocket-chat rocket-chat 0.1.5

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
pgvector/pgvector:pg167b822b0aac60
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,989

Container images carrying it

314 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/codefresh/dind:3.0.250885ab519dac
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/fossa/postgres:17.2-15af45ac79f38
github.com/moby/sys/user@v0.1.0
0.4.1
1
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/kubescape/kubescape:v4.0.14418fa941ecc0
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/kubescape/node-agent:v0.3.2192044ed750f5e
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/nuclio/dashboard:1.17.9-amd64708fe10f099a
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/openshift/origin-cli:latest10fef10863a3
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/operator-framework/catalogd:v1.8.06ff40fa6257f
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/operator-framework/olm40d0363f4aa6
github.com/moby/sys/user@v0.1.0
0.4.1
1
quay.io/operator-framework/olm:v0.46.04404599eb7b7
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/operator-framework/operator-controller:v1.8.0bca5dfcc67ca
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/rhdh/rhdh-hub-rhel9:latest4f8c0f8a8ee0
github.com/moby/sys/user@v0.4.0
0.4.1
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao:v2.6.2-gitlab13bc2e20d60d1
github.com/moby/sys/user@v0.4.0
0.4.1
1
registry.gitlab.com/xrow-public/ci-tools/tools:mainaa62b23f2b5e
github.com/moby/sys/user@v0.4.0
0.4.1
1

syft 1.42.1 · advisories as of 9 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.