CVE-2026-69198
MediumAdvisory
Published 3 Aug 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.9
- base score, highest
- EPSS
- 0.004
- 35th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 128
- of 17,781 indexed, latest versions
- Container images
- 116
- deployed by those charts
- Fix available
- 1 of 1
- affected package
ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks
Carried by container images the latest versions of 128 of 17,781 indexed charts deploy, on 116 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| ip-addressnpm | 10.1.1, 10.2.0 | 10.2.2 | 116 |
- OSV records
- GHSA-4xrf-jv44-h6hh
Charts affected
128 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| tenuretenureVerified publisher | 1.0.6 | 1 of 2See more | 2,522 |
| wikiwenerme | 2.2.0 | 1 of 2See more | 3,833 |
| discord-botxxczakiVerified publisher | 0.27.5 | 1 of 2See more | 474 |
| crowdsec-web-uizekker6Verified publisher | 0.51.0 | 1 of 1See more | 1,411 |
| lhciadnoctemVerified publisher | 0.1.0 | 1 of 1See more | 1,248 |
| outlineadnoctemVerified publisher | 0.1.2 | 1 of 1See more | 1,216 |
| turborepo-remote-cacheadriantr | 1.1.1 | 1 of 1See more | 523 |
| pangolinbdcode | 0.14.1 | 1 of 1See more | 1,901 |
| node-appbryopsida | 0.5.1 | 1 of 2See more | 14,352 |
| stocksalescluster-deploy | 0.1.3 | 1 of 1See more | 408 |
| kuberay-dashboarddanchevVerified publisher | 0.0.5 | 1 of 1See more | 551 |
| dial-admindialVerified publisher | 0.18.0 | 1 of 3See more | 4,046 |
| adventurelogdjjudas21Verified publisher | 0.1.1 | 1 of 3See more | 7,459 |
| clickhouse-monitoringduyet | 0.1.2 | 1 of 2See more | 1,049 |
| benchmarking-tooleclipse-aeriosVerified publisher | 1.0.0 | 1 of 1See more | 687 |
| node-redegebackVerified publisher | 2.0.13 | 1 of 1See more | 975 |
| uptime-kumaegebackVerified publisher | 2.0.12 | 1 of 1See more | 30,159 |
| edp-installepmdedpOfficialVerified publisher | 3.15.0 | 1 of 7See more | 2,033 |
| krci-portalepmdedpVerified publisher | 0.8.0 | 1 of 1See more | 839 |
| assertoorethereum-helm-chartsVerified publisher | 1.2.0 | 1 of 1See more | 2,891 |
| lodestarethereum-helm-chartsVerified publisher | 1.2.2 | 1 of 2See more | 2,522 |
| beeport-uiethersphereVerified publisher | 0.76.2 | 1 of 3See more | 7,368 |
| multichain-uiethersphereVerified publisher | 0.73.1 | 1 of 3See more | 7,368 |
| static-siteethersphereVerified publisher | 0.73.1 | 1 of 2See more | 6,851 |
| redis-uigin | 0.0.1 | 1 of 1See more | 1,053 |
| web-checkhajowielandVerified publisher | 1.0.1 | 1 of 1See more | 9,047 |
| archiveboxhelmforgeVerified publisher | 1.1.12 | 1 of 1See more | 7,633 |
| bytestashhelmforgeVerified publisher | 1.0.0 | 1 of 1See more | 739 |
| homarrhelmforgeVerified publisher | 1.2.8 | 1 of 1See more | 435 |
| matterbridgehelmforgeVerified publisher | 1.0.2 | 1 of 1See more | 895 |
| memoshelmforgeVerified publisher | 2.0.0 | 1 of 2See more | 792 |
| opencuthelmforgeVerified publisher | 1.1.9 | 1 of 5See more | 3,726 |
| paprahelmforgeVerified publisher | 1.0.0 | 1 of 1See more | 2,538 |
| pocket-idhelmforgeVerified publisher | 1.0.0 | 1 of 2See more | 453 |
| reactive-resumehelmforgeVerified publisher | 1.0.0 | 2 of 4See more | 3,025 |
| twentyhelmforgeVerified publisher | 1.0.0 | 1 of 5See more | 2,818 |
| bluesky-pdsijmacd | 1.0.0 | 1 of 2See more | 8,967 |
| ghostjanip81-helm-chartsVerified publisher | 0.1.2 | 1 of 1See more | 3,436 |
| zomboid-serverjanip81-helm-chartsVerified publisher | 0.1.21 | 1 of 3See more | 424 |
| homebridgejespernohrVerified publisher | 0.2.0 | 1 of 1See more | 2,149 |
| ghostk8s-home-lab-repo | 4.1.0 | 1 of 1See more | 3,092 |
| k8s-jacoco-operatork8s-jacoco-operator | 0.4.0 | 1 of 4See more | 2,437 |
| cdashkitwareVerified publisher | 0.19.0 | 1 of 3See more | 12,062 |
| ghostkubernetes-homelab-helm-chartsVerified publisher | 0.1.2 | 1 of 2See more | 2,756 |
| homebridgelbenicio-communityVerified publisher | 0.1.15 | 1 of 1See more | 2,149 |
| uptime-kumalbenicio-communityVerified publisher | 0.1.1 | 1 of 1See more | 33,242 |
| libredb-studiolibredb-studio-oci | 0.1.63 | 1 of 1See more | 1,222 |
| node-redlmatfyVerified publisher | 0.1.6 | 1 of 1See more | 1,809 |
| uptime-kumaloeken-at-homeVerified publisher | 2.3.2 | 1 of 1See more | 33,242 |
| logtidelogtideVerified publisher | 2.1.14 | 2 of 4See more | 2,774 |
Container images carrying it
116 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| library/ | be23f54a88d3 | ip-address | 10.2.2 | 3 |
| localstack/ | 4aef81c53168 | ip-address | 10.2.2 | 3 |
| ghcr.io/ | f4768de5f616 | ip-address | 10.2.2 | 3 |
| quay.io/ | 89bd85d7817f | ip-address | 10.2.2 | 3 |
| actualbudget/ | 552beab3dec8 | ip-address | 10.2.2 | 2 |
| epamedp/ | 687acf641097 | ip-address | 10.2.2 | 2 |
| homebridge/ | 77c685a40911 | ip-address | 10.2.2 | 2 |
| kutt/ | fa3d24a89b04 | ip-address | 10.2.2 | 2 |
| library/ | 159fe6464903 | ip-address | 10.2.2 | 2 |
| library/ | be80f76cf40e | ip-address | 10.2.2 | 2 |
| louislam/ | 9aeb4e51d038 | ip-address | 10.2.2 | 2 |
| louislam/ | a8610b3b4c38 | ip-address | 10.2.2 | 2 |
| n8nio/ | 14c4285bc303 | ip-address | 10.2.2 | 2 |
| opensearchproject/ | ca28e40a095f | ip-address | 10.2.2 | 2 |
| patrikx3/ | f19eb45b0694 | ip-address | 10.2.2 | 2 |
| requarks/ | 68f0d1848261 | ip-address | 10.2.2 | 2 |
| siscc/ | 12c5048f7402 | ip-address | 10.2.2 | 2 |
| ghcr.io/ | 4b696f960ac1 | ip-address | 10.2.2 | 2 |
| ghcr.io/ | a4e021c0f6a9 | ip-address | 10.2.2 | 2 |
| ghcr.io/ | 0e7bc9d34e86 | ip-address | 10.2.2 | 2 |
| archivebox/ | 1a5a37331091 | ip-address | 10.2.2 | 1 |
| budibase/ | 44fe6feab985 | ip-address | 10.2.2 | 1 |
| chainsafe/ | 5593f6e97912 | ip-address | 10.2.2 | 1 |
| chocobozzz/ | 052712130691 | ip-address | 10.2.2 | 1 |
| continuoussecuritytooling/ | f04ecefab64e | ip-address | 10.2.2 | 1 |
| cyfershepard/ | c4e2dfa8bddf | ip-address | 10.2.2 | 1 |
| dessalines/ | ee4c620d8e93 | ip-address | 10.2.2 | 1 |
| directus/ | 9c8470ea465c | ip-address | 10.2.2 | 1 |
| diygod/ | 1d4b508b6357 | ip-address | 10.2.2 | 1 |
| docmost/ | 41c8d777cf23 | ip-address | 10.2.2 | 1 |
| ducktors/ | 31ec9e83c844 | ip-address | 10.2.2 | 1 |
| eclipseaerios/ | a4b4c2e7fe62 | ip-address | 10.2.2 | 1 |
| epam/ | 21d91ad74755 | ip-address | 10.2.2 | 1 |
| epam/ | bd6b13695cdc | ip-address | 10.2.2 | 1 |
| ethpandaops/ | 1efa2fba6711 | ip-address | 10.2.2 | 1 |
| foggbh/ | 8b7a2e5ecf4e | ip-address | 10.2.2 | 1 |
| fosrl/ | 83a55f933b4d | ip-address | 10.2.2 | 1 |
| haohanyang/ | f4f8fe4e21f1 | ip-address | 10.2.2 | 1 |
| helmforge/ | bf11156e0ab5 | ip-address | 10.2.2 | 1 |
| joplin/ | 3f7b852959aa | ip-address | 10.2.2 | 1 |
| journeyapps/ | bf46f66e5dcc | ip-address | 10.2.2 | 1 |
| kitware/ | d7767d9b9da4 | ip-address | 10.2.2 | 1 |
| langgenius/ | 8dd9de6b6190 | ip-address | 10.2.2 | 1 |
| langgenius/ | ba1dd1d0bcea | ip-address | 10.2.2 | 1 |
| library/ | 1ef2e532ca4d | ip-address | 10.2.2 | 1 |
| library/ | 29773d6be407 | ip-address | 10.2.2 | 1 |
| library/ | 77196da4b0df | ip-address | 10.2.2 | 1 |
| library/ | e67514e5d0f6 | ip-address | 10.2.2 | 1 |
| library/ | f5d1cc40abc1 | ip-address | 10.2.2 | 1 |
| lissy93/ | d3c95edc0a8b | ip-address | 10.2.2 | 1 |