StackRadar

CVE-2026-6322

High

Advisory

Published 5 May 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
40th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
86
of 17,781 indexed, latest versions
Container images
90
deployed by those charts
Fix available
1 of 2
affected packages

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

Carried by container images the latest versions of 86 of 17,781 indexed charts deploy, on 90 images.

Affected packageAffected versionsFixed inImages
fast-urinpm2.1.0, 2.2.0, 2.3.0, 2.4.0+6 more2.4.1, 3.1.287
node-ajvdeb6.10.2-1, 8.12.0~ds+~2.1.1-4no fix listed3
OSV records
GHSA-v39h-62p7-jpjcUBUNTU-CVE-2026-6322

Charts affected

86 by stars
ChartLatestAffected imagesRadar Score
node-rednode-redVerified publisher0.40.21 of 1See more

node-red node-red 0.40.2

1 of the 1 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
nodered/node-red:4.1.2216e7403aab9
fast-uri@3.1.0
3.1.2

Open the chart page →

2,172
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
langgenius/dify-web:1.10.1-fix.1c306ac577912
fast-uri@3.1.0
3.1.2

Open the chart page →

19,391
unleashunleash5.6.81 of 2See more

unleash unleash 5.6.8

1 of the 2 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
unleashorg/unleash-server:7.5.09adb37e399ba
fast-uri@3.0.1
3.1.2

Open the chart page →

2,059
lemmyananace-chartsVerified publisher0.6.151 of 5See more

lemmy ananace-charts 0.6.15

1 of the 5 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
dessalines/lemmy-ui:0.19.20ee4c620d8e93
fast-uri@3.0.1
3.1.2

Open the chart page →

7,210
stacks-blockchain-apihirosystemsVerified publisher6.5.11 of 5See more

stacks-blockchain-api hirosystems 6.5.1

1 of the 5 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
hirosystems/stacks-blockchain-api:8.13.29c98b23c1515
fast-uri@2.4.0
2.4.1

Open the chart page →

8,364
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latestf4768de5f616
fast-uri@3.1.0
3.1.2

Open the chart page →

3,004
supabasetokens-studioVerified publisher1.0.02 of 14See more

supabase tokens-studio 1.0.0

2 of the 14 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
supabase/postgres-meta:v0.84.2d0a96973e9f1
fast-uri@2.2.0
2.4.1
supabase/storage-api:v1.12.0f983fb50bd95
fast-uri@2.2.0
2.4.1

Open the chart page →

23,123
netris-controllernetrisai2.8.21 of 14See more

netris-controller netrisai 2.8.2

1 of the 14 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
netrisai/controller-web-service-backend:4.6.0-0086e865080e86c
fast-uri@3.1.0
3.1.2

Open the chart page →

30,326
docmosthelmforgeVerified publisher1.2.111 of 4See more

docmost helmforge 1.2.11

1 of the 4 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
docmost/docmost:0.95.041c8d777cf23
fast-uri@3.0.6
3.1.2

Open the chart page →

5,564
foremancontane-githubOfficialVerified publisher0.6.01 of 1See more

foreman contane-github 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
contane/foreman:0.5.2efb98bdcc4e9
fast-uri@3.0.6
3.1.2

Open the chart page →

1,152
cosmocosmo-platformOfficialVerified publisher0.20.02 of 10See more

cosmo cosmo-platform 0.20.0

2 of the 10 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
fast-uri@2.2.0
2.4.1
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
fast-uri@3.0.6
3.1.2

Open the chart page →

28,839
coreinstill-aiOfficialVerified publisher0.1.751 of 15See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
instill/console:0.68.54cd70e2df5c6
fast-uri@3.0.6
3.1.2

Open the chart page →

30,816
activepiecesmeyerchartsVerified publisher0.1.61 of 1See more

activepieces meyercharts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
activepieces/activepieces:0.23.0c26188b44e62
fast-uri@2.3.0
2.4.1

Open the chart page →

2,635
wgerwgerOfficialVerified publisher1.0.01 of 8See more

wger wger 1.0.0

1 of the 8 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
journeyapps/powersync-service:latestbf46f66e5dcc
fast-uri@3.0.6
3.1.2

Open the chart page →

8,491
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
fast-uri@3.1.0
3.1.2

Open the chart page →

4,016
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
fast-uri@3.1.0
3.1.2

Open the chart page →

1,991
data-fairdata354-helmVerified publisher1.1.22 of 12See more

data-fair data354-helm 1.1.2

2 of the 12 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
ghcr.io/data-fair/data-fair:3cc9498b64b5b
fast-uri@2.2.0
2.4.1
ghcr.io/data-fair/notify:3c739b74dabb0
fast-uri@3.0.6
3.1.2

Open the chart page →

38,346
enbuildenbuildVerified publisher0.0.502 of 6See more

enbuild enbuild 0.0.50

2 of the 6 container images this version deploys carry CVE-2026-6322.

Open the chart page →

31,510
iobrokereugen0.2.61 of 1See more

iobroker eugen 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
fast-uri@3.0.1
3.1.2

Open the chart page →

11,458
cap-captcha-serverf3k-techVerified publisher0.21.01 of 1See more

cap-captcha-server f3k-tech 0.21.0

1 of the 1 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
tiago2/cap:2.159f5ae4e261e
fast-uri@3.1.0
3.1.2

Open the chart page →

1,664
ghostfolioghostfolioVerified publisher0.5.41 of 3See more

ghostfolio ghostfolio 0.5.4

1 of the 3 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
fast-uri@3.1.0
3.1.2

Open the chart page →

3,123
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
fast-uri@3.1.0
3.1.2

Open the chart page →

15,712
chibisafel4gVerified publisher0.1.11 of 3See more

chibisafe l4g 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
chibisafe/chibisafe-server:latest3da4fcbc1a18
fast-uri@2.3.0
2.4.1

Open the chart page →

5,654
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
fast-uri@3.0.3
3.1.2

Open the chart page →

31,844
psa-restricted-patcherpsa-restricted-patcherVerified publisher0.10.11 of 1See more

psa-restricted-patcher psa-restricted-patcher 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/psa-restricted-patcher:maina53ef16b024a
fast-uri@2.1.0
2.4.1

Open the chart page →

1,401
rocketadminrocketadminOfficialVerified publisher1.0.421 of 1See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.17.710955ef540b9
fast-uri@3.1.0
3.1.2

Open the chart page →

5,482
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
fast-uri@3.0.6
3.1.2

Open the chart page →

5,213
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
dserio83/velero-ui:0.3.1b4e1ec6664d3
fast-uri@3.0.6
3.1.2

Open the chart page →

11,532
supabasesupabse0.8.02 of 11See more

supabase supabse 0.8.0

2 of the 11 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
supabase/postgres-meta:v0.96.6a84cc713585e
fast-uri@3.0.6
3.1.2
supabase/storage-api:v1.60.4c8eb9858eafe
fast-uri@3.1.0
3.1.2

Open the chart page →

18,075
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
fast-uri@3.0.1
3.1.2

Open the chart page →

12,581
wraftwraft0.1.121 of 9See more

wraft wraft 0.1.12

1 of the 9 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
fast-uri@3.1.0
3.1.2

Open the chart page →

10,090
adeptia-automate-mcpadeptia-automate-mcp1.0.02 of 2See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
fast-uri@3.1.0
3.1.2
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
fast-uri@3.1.0
3.1.2

Open the chart page →

3,600
lametric-nightscout-proxyaolde0.1.01 of 1See more

lametric-nightscout-proxy aolde 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
ghcr.io/aolde/lametric-nightscout-proxy:latest7d1951b6baf5
fast-uri@2.1.0
2.4.1

Open the chart page →

1,186
colosseumbook-k8sinfra-v21.0.182 of 5See more

colosseum book-k8sinfra-v2 1.0.18

2 of the 5 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-cms:loge74b43c7f492
fast-uri@3.0.6
3.1.2
sysnet4admin/colosseum-prm:log5802bfcd7fed
fast-uri@3.0.6
3.1.2

Open the chart page →

26,996
openmctbryopsida0.1.11 of 1See more

openmct bryopsida 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/openmct:main38b6a50a62b2
fast-uri@3.0.1
3.1.2

Open the chart page →

951
dv-podcharonOfficialVerified publisher0.19.11 of 5See more

dv-pod charon 0.19.1

1 of the 5 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
obolnetwork/charon-dkg-sidecar:maine263be0a7440
fast-uri@3.1.0
3.1.2

Open the chart page →

7,405
mcp-for-argocdchristianhuthVerified publisher2.0.01 of 1See more

mcp-for-argocd christianhuth 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
ghcr.io/argoproj-labs/mcp-for-argocd:v0.9.0dffc6c719d86
fast-uri@3.1.0
3.1.2

Open the chart page →

1,947
kamaji-consoleclastixVerified publisher0.1.31 of 1See more

kamaji-console clastix 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
fast-uri@3.0.6
3.1.2

Open the chart page →

2,759
codehubcodehubVerified publisher6.2.181 of 5See more

codehub codehub 6.2.18

1 of the 5 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
jupyterhub/jupyterhub:5.4.63974ba945e65
node-ajv@8.12.0~ds+~2.1.1-4
no fix listed

Open the chart page →

13,220
cortezacorteza1.0.121 of 3See more

corteza corteza 1.0.12

1 of the 3 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
cortezaproject/corteza-server-corredor:2024.9.44ea78dfe5364
fast-uri@3.0.6
3.1.2

Open the chart page →

8,368
authfcryptexlabsVerified publisher0.12.131 of 4See more

authf cryptexlabs 0.12.13

1 of the 4 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
cryptexlabs/authf:0.12.11189c07411d7c
fast-uri@3.0.3
3.1.2

Open the chart page →

3,769
lodestarethereum-helm-chartsVerified publisher1.2.21 of 2See more

lodestar ethereum-helm-charts 1.2.2

1 of the 2 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
chainsafe/lodestar:latest5593f6e97912
fast-uri@3.1.0
3.1.2

Open the chart page →

2,522
qryn-helmgigapipeVerified publisher0.1.91 of 1See more

qryn-helm gigapipe 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
qxip/qryn:3.2.3977acc9c7a9fd
fast-uri@3.0.1
3.1.2

Open the chart page →

2,973
opentelemetry-demogpg-dev0.33.82 of 27See more

opentelemetry-demo gpg-dev 0.33.8

2 of the 27 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
fast-uri@3.0.1
3.1.2
ghcr.io/open-telemetry/demo:1.12.0-flagduif6bdafaa9075
fast-uri@3.0.1
3.1.2

Open the chart page →

49,025
automatischhelmforgeVerified publisher1.3.71 of 4See more

automatisch helmforge 1.3.7

1 of the 4 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
fast-uri@3.0.3
3.1.2

Open the chart page →

5,769
ryothelmforgeVerified publisher1.0.01 of 2See more

ryot helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
fast-uri@3.1.0
3.1.2

Open the chart page →

6,012
ilum-unity-catalogilumVerified publisher0.1.01 of 4See more

ilum-unity-catalog ilum 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
fast-uri@3.0.1
3.1.2

Open the chart page →

11,812
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
fast-uri@3.1.0
3.1.2

Open the chart page →

3,436
n8njanip81-helm-chartsVerified publisher0.1.41 of 1See more

n8n janip81-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
n8nio/n8n:1.86.08b39ed5a2de9
fast-uri@3.0.6
3.1.2

Open the chart page →

5,826
ghostk8s-home-lab-repo4.1.01 of 1See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-6322.

Container imageDigestPackageFixed in
library/ghost:6.41.129773d6be407
fast-uri@3.1.0
3.1.2

Open the chart page →

3,092

Container images carrying it

90 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
sysnet4admin/colosseum-cms:loge74b43c7f492
fast-uri@3.0.6
3.1.2
1
sysnet4admin/colosseum-prm:log5802bfcd7fed
fast-uri@3.0.6
3.1.2
1
th0th/node-red:4.0.3-debiand06fa39f7406
fast-uri@3.0.1
3.1.2
1
tiago2/cap:2.159f5ae4e261e
fast-uri@3.1.0
3.1.2
1
treskon/portrait-ui:DEV-lateste7970783bc8d
fast-uri@3.0.3
3.1.2
1
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
fast-uri@3.0.1
3.1.2
1
unleashorg/unleash-enterprise:7.5.0245aeba40053
fast-uri@3.1.0
3.1.2
1
unleashorg/unleash-proxy:v1.4.82538f89e2685
fast-uri@3.0.2
3.1.2
1
unleashorg/unleash-server:7.5.09adb37e399ba
fast-uri@3.0.1
3.1.2
1
veecode/devportalc443520aebf7
fast-uri@3.1.0
3.1.2
1
ghcr.io/aolde/lametric-nightscout-proxy:latest7d1951b6baf5
fast-uri@2.1.0
2.4.1
1
ghcr.io/argoproj-labs/mcp-for-argocd:v0.9.0dffc6c719d86
fast-uri@3.1.0
3.1.2
1
ghcr.io/bryopsida/openmct:main38b6a50a62b2
fast-uri@3.0.1
3.1.2
1
ghcr.io/bryopsida/psa-restricted-patcher:maina53ef16b024a
fast-uri@2.1.0
2.4.1
1
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
fast-uri@3.0.1
3.1.2
1
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
fast-uri@3.0.6
3.1.2
1
ghcr.io/colanode/server:latest7006cac874fd
fast-uri@3.1.0
3.1.2
1
ghcr.io/curium-rocks/k8s-jacoco-operator:maina558ceae6cdb
fast-uri@2.1.0
2.4.1
1
ghcr.io/curium-rocks/k8s-mutating-webhook:mainaaab005242ae
fast-uri@2.1.0
2.4.1
1
ghcr.io/curium-rocks/k8s-validating-webhook:main8344061b2f22
fast-uri@2.1.0
2.4.1
1
ghcr.io/curium-rocks/kube-admission-controller-starter:maine9716966f30b
fast-uri@2.1.0
2.4.1
1
ghcr.io/data-fair/data-fair:3cc9498b64b5b
fast-uri@2.2.0
2.4.1
1
ghcr.io/data-fair/notify:3c739b74dabb0
fast-uri@3.0.6
3.1.2
1
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
fast-uri@3.1.0
3.1.2
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
fast-uri@3.1.0
3.1.2
1
ghcr.io/jeboehm/fetchmailmgr:0.3.2126c4691b28a4
fast-uri@3.0.6
3.1.2
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
fast-uri@3.0.6
3.1.2
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
fast-uri@3.0.6
3.1.2
1
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
fast-uri@3.0.1
3.1.2
1
ghcr.io/open-telemetry/demo:1.12.0-flagduif6bdafaa9075
fast-uri@3.0.1
3.1.2
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
fast-uri@3.1.0
3.1.2
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
fast-uri@3.0.1
3.1.2
1
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
fast-uri@3.1.0
3.1.2
1
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
fast-uri@2.2.0
2.4.1
1
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
fast-uri@3.0.6
3.1.2
1
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
fast-uri@3.0.5
3.1.2
1
quay.io/netwarps/walletconnect-relay:v2.1.3-rc.15d90b9c193e0
fast-uri@2.1.0
2.4.1
1
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
fast-uri@3.1.0
3.1.2
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
fast-uri@3.1.0
3.1.2
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
fast-uri@3.1.0
3.1.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.