CVE-2026-69198
MediumAdvisory
Published 3 Aug 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.9
- base score, highest
- EPSS
- 0.004
- 35th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 128
- of 17,781 indexed, latest versions
- Container images
- 116
- deployed by those charts
- Fix available
- 1 of 1
- affected package
ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks
Carried by container images the latest versions of 128 of 17,781 indexed charts deploy, on 116 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| ip-addressnpm | 10.1.1, 10.2.0 | 10.2.2 | 116 |
- OSV records
- GHSA-4xrf-jv44-h6hh
Charts affected
128 by stars
Container images carrying it
116 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| library/ | be23f54a88d3 | ip-address | 10.2.2 | 3 |
| localstack/ | 4aef81c53168 | ip-address | 10.2.2 | 3 |
| ghcr.io/ | f4768de5f616 | ip-address | 10.2.2 | 3 |
| quay.io/ | 89bd85d7817f | ip-address | 10.2.2 | 3 |
| actualbudget/ | 552beab3dec8 | ip-address | 10.2.2 | 2 |
| epamedp/ | 687acf641097 | ip-address | 10.2.2 | 2 |
| homebridge/ | 77c685a40911 | ip-address | 10.2.2 | 2 |
| kutt/ | fa3d24a89b04 | ip-address | 10.2.2 | 2 |
| library/ | 159fe6464903 | ip-address | 10.2.2 | 2 |
| library/ | be80f76cf40e | ip-address | 10.2.2 | 2 |
| louislam/ | 9aeb4e51d038 | ip-address | 10.2.2 | 2 |
| louislam/ | a8610b3b4c38 | ip-address | 10.2.2 | 2 |
| n8nio/ | 14c4285bc303 | ip-address | 10.2.2 | 2 |
| opensearchproject/ | ca28e40a095f | ip-address | 10.2.2 | 2 |
| patrikx3/ | f19eb45b0694 | ip-address | 10.2.2 | 2 |
| requarks/ | 68f0d1848261 | ip-address | 10.2.2 | 2 |
| siscc/ | 12c5048f7402 | ip-address | 10.2.2 | 2 |
| ghcr.io/ | 4b696f960ac1 | ip-address | 10.2.2 | 2 |
| ghcr.io/ | a4e021c0f6a9 | ip-address | 10.2.2 | 2 |
| ghcr.io/ | 0e7bc9d34e86 | ip-address | 10.2.2 | 2 |
| archivebox/ | 1a5a37331091 | ip-address | 10.2.2 | 1 |
| budibase/ | 44fe6feab985 | ip-address | 10.2.2 | 1 |
| chainsafe/ | 5593f6e97912 | ip-address | 10.2.2 | 1 |
| chocobozzz/ | 052712130691 | ip-address | 10.2.2 | 1 |
| continuoussecuritytooling/ | f04ecefab64e | ip-address | 10.2.2 | 1 |
| cyfershepard/ | c4e2dfa8bddf | ip-address | 10.2.2 | 1 |
| dessalines/ | ee4c620d8e93 | ip-address | 10.2.2 | 1 |
| directus/ | 9c8470ea465c | ip-address | 10.2.2 | 1 |
| diygod/ | 1d4b508b6357 | ip-address | 10.2.2 | 1 |
| docmost/ | 41c8d777cf23 | ip-address | 10.2.2 | 1 |
| ducktors/ | 31ec9e83c844 | ip-address | 10.2.2 | 1 |
| eclipseaerios/ | a4b4c2e7fe62 | ip-address | 10.2.2 | 1 |
| epam/ | 21d91ad74755 | ip-address | 10.2.2 | 1 |
| epam/ | bd6b13695cdc | ip-address | 10.2.2 | 1 |
| ethpandaops/ | 1efa2fba6711 | ip-address | 10.2.2 | 1 |
| foggbh/ | 8b7a2e5ecf4e | ip-address | 10.2.2 | 1 |
| fosrl/ | 83a55f933b4d | ip-address | 10.2.2 | 1 |
| haohanyang/ | f4f8fe4e21f1 | ip-address | 10.2.2 | 1 |
| helmforge/ | bf11156e0ab5 | ip-address | 10.2.2 | 1 |
| joplin/ | 3f7b852959aa | ip-address | 10.2.2 | 1 |
| journeyapps/ | bf46f66e5dcc | ip-address | 10.2.2 | 1 |
| kitware/ | d7767d9b9da4 | ip-address | 10.2.2 | 1 |
| langgenius/ | 8dd9de6b6190 | ip-address | 10.2.2 | 1 |
| langgenius/ | ba1dd1d0bcea | ip-address | 10.2.2 | 1 |
| library/ | 1ef2e532ca4d | ip-address | 10.2.2 | 1 |
| library/ | 29773d6be407 | ip-address | 10.2.2 | 1 |
| library/ | 77196da4b0df | ip-address | 10.2.2 | 1 |
| library/ | e67514e5d0f6 | ip-address | 10.2.2 | 1 |
| library/ | f5d1cc40abc1 | ip-address | 10.2.2 | 1 |
| lissy93/ | d3c95edc0a8b | ip-address | 10.2.2 | 1 |