StackRadar

CVE-2026-61801

Medium

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Medium
worst across findings
CVSS
5.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
630
of 18,071 indexed, latest versions
Container images
314
deployed by those charts
Fix available
1 of 1
affected package

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

Carried by container images the latest versions of 630 of 18,071 indexed charts deploy, on 314 images.

Affected packageAffected versionsFixed inImages
github.com/moby/sys/usergolangv0.1.0, v0.2.0, v0.3.0, v0.4.00.4.1314
OSV records
GHSA-mjcv-p78q-w5fw
Trending
Rank 20 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

630 by stars
ChartLatestAffected imagesRadar Score
mariadbhuangchengwu-helm-chart0.1.01 of 1See more

mariadb huangchengwu-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:latestf1bba652ba57
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,745
ibexaibexaVerified publisher3.11.11 of 10See more

ibexa ibexa 3.11.1

1 of the 10 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.0.41bf577825b52a
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

7,576
metamcpicoretechVerified publisher0.3.111 of 2See more

metamcp icoretech 0.3.11

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:161a6ab3f5345e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,753
multicaicoretechVerified publisher0.6.21 of 4See more

multica icoretech 0.6.2

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
pgvector/pgvector:pg17ac08538c6f8b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,532
tolgeeicoretechVerified publisher0.52.12 of 3See more

tolgee icoretech 0.52.1

2 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.369e8582b781c
github.com/moby/sys/user@v0.1.0
0.4.1
tolgee/tolgee:v3.226.334ba5c490c19
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,638
plausible-analyticsimioVerified publisher0.4.21 of 5See more

plausible-analytics imio 0.4.2

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17.6-alpineef257d85f76e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

11,916
fpga-operatorinaccelVerified publisher2.8.21 of 7See more

fpga-operator inaccel 2.8.2

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
inaccel/daemon:latest093e1ea90ab8
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

7,394
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

20,681
thehiveittrident-oss0.1.01 of 6See more

thehive ittrident-oss 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/cassandra:4.00909b1681015
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,364
opencloudjacobcolvinVerified publisher0.2.31 of 13See more

opencloud jacobcolvin 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:alpine77f585114c32
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

48,354
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,651
unifi-network-applicationjanip81-helm-chartsVerified publisher0.2.91 of 3See more

unifi-network-application janip81-helm-charts 0.2.9

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:7.01f995ad6fdb9
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,338
jx-app-datadogjenkins-x0.0.101 of 2See more

jx-app-datadog jenkins-x 0.0.10

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
datadog/agent:6aad9994de6a7
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,866
api-key-managerjtektVerified publisher0.3.01 of 4See more

api-key-manager jtekt 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:172d2b8998d310
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

7,499
k8s-ai-srek8s-ai-sreVerified publisher3.1.21 of 1See more

k8s-ai-sre k8s-ai-sre 3.1.2

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
mohankrishna999/k8s-ai-agent:3.1.27f980f8c650c
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

845
deploydefenderk8s-custom-controllerVerified publisher0.1.31 of 1See more

deploydefender k8s-custom-controller 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/manzil-infinity180/deploydefender:ea3ab0bb646cdbeddd1aca483ecf650f9ac0d0847fbc6855c8b3
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

2,386
ghostk8s-home-lab-repo4.1.01 of 1See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/ghost:6.41.129773d6be407
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,162
kagentkagent0.10.31 of 6See more

kagent kagent 0.10.3

1 of the 6 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.6-alpine3.23885cf05d376c
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,558
postgresqlkagiso-me0.4.01 of 1See more

postgresql kagiso-me 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17.4-alpine7062a2109c4b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,481
rediskagiso-me0.1.61 of 1See more

redis kagiso-me 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redis:7.4.2-alpine02419de7eddf
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,277
dockerdkarljorgensen0.1.01 of 1See more

dockerd karljorgensen 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/docker:28.5.2-dind2a232a42256f
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

2,556
kc-chartkc-chart1.0.01 of 3See more

kc-chart kc-chart 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:latest9d48c42f8341
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

10,080
kestra-starterkestraOfficialVerified publisher2.0.52 of 5See more

kestra-starter kestra 2.0.5

2 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/docker:dind-rootless3acba49741f1
github.com/moby/sys/user@v0.4.0
0.4.1
library/postgres:17.5aadf2c0696f5
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

7,174
typebotiokitsune-itopsVerified publisher0.1.41 of 4See more

typebotio kitsune-itops 0.1.4

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

665
autopilotkrateo1.0.01 of 2See more

autopilot krateo 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:1665b16a8b326e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,636
world-dbkronkltdVerified publisher0.1.01 of 1See more

world-db kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghusta/postgres-world-db:latest879d0919fdcc
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,258
ksoc-pluginsksocOfficialVerified publisher1.9.101 of 5See more

ksoc-plugins ksoc 1.9.10

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
public.ecr.aws/n8h5y2v5/rad-security/rad-sbom:v1.1.34e97e0e7a2088
github.com/moby/sys/user@v0.2.0
0.4.1

Open the chart page →

5,250
kubeintellectkubeintellectVerified publisher2.5.01 of 2See more

kubeintellect kubeintellect 2.5.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,164
firefly-iiikubernetes-homelab-helm-chartsVerified publisher0.1.31 of 3See more

firefly-iii kubernetes-homelab-helm-charts 0.1.3

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,210
ghostkubernetes-homelab-helm-chartsVerified publisher0.1.22 of 2See more

ghost kubernetes-homelab-helm-charts 0.1.2

2 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
github.com/moby/sys/user@v0.1.0
0.4.1
library/mysql:86ea90827b110
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,020
portfolio-trackerkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

portfolio-tracker kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,896
scrutinykubernetes-homelab-helm-chartsVerified publisher0.2.21 of 3See more

scrutiny kubernetes-homelab-helm-charts 0.2.2

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/influxdb:2.8983c696655e8
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,555
umamikubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

umami kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17-alpineb0f9560a2de0
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,853
hertzbeatkubesphere-carryon-test1.4.11 of 4See more

hertzbeat kubesphere-carryon-test 1.4.1

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:86ea90827b110
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

8,501
fpga-operatorkubesphere-stable2.7.41 of 7See more

fpga-operator kubesphere-stable 2.7.4

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
inaccel/daemon:latest093e1ea90ab8
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

7,394
kubestellar-uikubestellaruiVerified publisher0.1.11 of 4See more

kubestellar-ui kubestellarui 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redis:7.0-alpinec9d92d840fd0
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,758
kubevaletkubevaletVerified publisher0.3.211 of 3See more

kubevalet kubevalet 0.3.21

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17-alpineb0f9560a2de0
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

607
kubiya-runnerkubiya-helm-chartsOfficialVerified publisher0.9.42 of 9See more

kubiya-runner kubiya-helm-charts 0.9.4

2 of the 9 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
grafana/alloy:v1.5.101a63f4e032c
github.com/moby/sys/user@v0.3.0
0.4.1
ghcr.io/kubiyabot/tool-manager:0.5.80cca6760763a
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

25,164
kusionkusionstackVerified publisher0.14.12 of 3See more

kusion kusionstack 0.14.1

2 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
kusionstack/kusion:v0.14.0126c8f0b0976
github.com/moby/sys/user@v0.3.0
0.4.1
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

67,845
lagoon-docker-hostlagoon-chartsVerified publisher0.7.01 of 1See more

lagoon-docker-host lagoon-charts 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
uselagoon/docker-host:v3.6.12c89ed939b8b
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

2,962
pageslatif-pages1.0.01 of 3See more

pages latif-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pageslavanya-pages1.0.01 of 3See more

pages lavanya-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
librenmslibrenms10.2.12 of 5See more

librenms librenms 10.2.1

2 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:26.7.09d48c42f8341
github.com/moby/sys/user@v0.1.0
0.4.1
librenms/librenms:26.9.1.1814e3fb8d837
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,135
listmonklistmonk-chartVerified publisher2.0.11 of 2See more

listmonk listmonk-chart 2.0.1

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15c67d80f67f76
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,573
litefunctionslitefunctions0.1.13 of 19See more

litefunctions litefunctions 0.1.1

3 of the 19 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/docker:28.3.3-dinda56b3bdde893
github.com/moby/sys/user@v0.4.0
0.4.1
library/postgres:161a6ab3f5345e
github.com/moby/sys/user@v0.1.0
0.4.1
ghcr.io/project-zot/zot:v2.1.144183bd731bcc
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

18,776
pagesliviu884422-pages1.0.01 of 3See more

pages liviu884422-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
vnode-runtimeloftVerified publisher0.3.31 of 1See more

vnode-runtime loft 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vnode-runtime:0.3.3b065ec5a5239
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

3,142
logtidelogtideVerified publisher2.1.141 of 4See more

logtide logtide 2.1.14

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
timescale/timescaledb:latest-pg156343bdc87ca1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,950
oncall-hobbylovemew67Verified publisher0.0.51 of 2See more

oncall-hobby lovemew67 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redis:7.0.15352c1fdadc91
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

7,119
lumenvox-external-serviceslumenvox8.0.02 of 3See more

lumenvox-external-services lumenvox 8.0.0

2 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:8.2.12e0ce8c35124d
github.com/moby/sys/user@v0.1.0
0.4.1
library/postgres:17.5aadf2c0696f5
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

8,588

Container images carrying it

314 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/codefresh/dind:3.0.250885ab519dac
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/fossa/postgres:17.2-15af45ac79f38
github.com/moby/sys/user@v0.1.0
0.4.1
1
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/kubescape/kubescape:v4.0.14418fa941ecc0
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/kubescape/node-agent:v0.3.2192044ed750f5e
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/nuclio/dashboard:1.17.9-amd64708fe10f099a
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/openshift/origin-cli:latest10fef10863a3
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/operator-framework/catalogd:v1.8.06ff40fa6257f
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/operator-framework/olm40d0363f4aa6
github.com/moby/sys/user@v0.1.0
0.4.1
1
quay.io/operator-framework/olm:v0.46.04404599eb7b7
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/operator-framework/operator-controller:v1.8.0bca5dfcc67ca
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/rhdh/rhdh-hub-rhel9:latest4f8c0f8a8ee0
github.com/moby/sys/user@v0.4.0
0.4.1
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao:v2.6.2-gitlab13bc2e20d60d1
github.com/moby/sys/user@v0.4.0
0.4.1
1
registry.gitlab.com/xrow-public/ci-tools/tools:mainaa62b23f2b5e
github.com/moby/sys/user@v0.4.0
0.4.1
1

syft 1.42.1 · advisories as of 9 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.