StackRadar

CVE-2026-7246

High

Advisory

Published 30 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.2
base score, highest
EPSS
0.009
58th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
578
of 17,787 indexed, latest versions
Container images
616
deployed by those charts
Fix available
2 of 3
affected packages

Security update for python-click

Carried by container images the latest versions of 578 of 17,787 indexed charts deploy, on 616 images.

Affected packageAffected versionsFixed inImages
clickpypi6.7, 7.0, 7.1.1, 7.1.2+16 more8.3.3616
python-clickdeb8.1.3-2no fix listed8
python-clickrpm8.2.1-160000.2.28.2.1-160000.3.11
OSV records
DEBIAN-CVE-2026-7246PYSEC-2026-2132SUSE-SU-2026:22321-1
Also known as
GHSA-47fr-3ffg-hgmw

Charts affected

578 by stars
ChartLatestAffected imagesRadar Score
uptime-kumauptime-kumaVerified publisher4.2.01 of 1See more

uptime-kuma uptime-kuma 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
click@8.1.3
python-click@8.1.3-2
8.3.3
no fix listed

Open the chart page →

30,167
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
click@8.1.7
8.3.3

Open the chart page →

11,372
rook-cephrookOfficialVerified publisher1.20.71 of 2See more

rook-ceph rook 1.20.7

1 of the 2 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
rook/ceph:v1.20.72f970c425617
click@8.0.3
8.3.3

Open the chart page →

1,447
ceph-csi-cephfsceph-csiOfficialVerified publisher3.17.11 of 6See more

ceph-csi-cephfs ceph-csi 3.17.1

1 of the 6 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.17.10b62db8afc9b
click@8.0.3
8.3.3

Open the chart page →

4,061
ceph-csi-rbdceph-csiOfficialVerified publisher3.17.11 of 6See more

ceph-csi-rbd ceph-csi 3.17.1

1 of the 6 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.17.10b62db8afc9b
click@8.0.3
8.3.3

Open the chart page →

4,061
netboxbootcVerified publisher4.1.11 of 4See more

netbox bootc 4.1.1

1 of the 4 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.2.83d652dca5351
click@8.1.3
8.3.3

Open the chart page →

9,194
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
allegroai/clearml:2.0.0-613713ae38f7daf
click@8.1.8
8.3.3

Open the chart page →

10,648
locustdeliveryheroVerified publisher0.35.01 of 1See more

locust deliveryhero 0.35.0

1 of the 1 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
locustio/locust:2.32.2a0d4b88e42c1
click@8.1.7
8.3.3

Open the chart page →

2,660
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
click@8.3.1
8.3.3

Open the chart page →

19,497
stackgres-operatorstackgres-chartsOfficialVerified publisher1.19.11 of 2See more

stackgres-operator stackgres-charts 1.19.1

1 of the 2 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
quay.io/stackgres/operator:1.19.1f241b0b20326
click@8.1.7
8.3.3

Open the chart page →

2,138
ambassadordatawire6.9.51 of 2See more

ambassador datawire 6.9.5

1 of the 2 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
click@7.1.2
8.3.3

Open the chart page →

4,086
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
grafana/oncall:v1.16.5499851658393
click@8.2.1
8.3.3

Open the chart page →

16,251
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.14.3f09282d281f6
click@8.1.3
8.3.3

Open the chart page →

11,402
emissary-ingressdatawire7.1.8-ea1 of 1See more

emissary-ingress datawire 7.1.8-ea

1 of the 1 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
datawire/emissary:2.0.2-ea9716efbdd24b
click@7.1.2
8.3.3

Open the chart page →

4,918
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
click@8.1.3
8.3.3

Open the chart page →

7,706
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
click@8.1.3
8.3.3

Open the chart page →

6,012
daskdask2024.1.12 of 2See more

dask dask 2024.1.1

2 of the 2 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
ghcr.io/dask/dask:2024.1.0080150de7d86
click@8.1.7
8.3.3
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
click@8.1.7
8.3.3

Open the chart page →

12,830
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
click@8.1.7
8.3.3

Open the chart page →

6,040
edge-stackdatawire7.1.8-ea1 of 2See more

edge-stack datawire 7.1.8-ea

1 of the 2 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
datawire/aes:2.0.3-ea07f8fe4f4f8e
click@7.1.2
8.3.3

Open the chart page →

5,173
supersetcloudposse1.2.01 of 1See more

superset cloudposse 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
amancevice/superset:0.35.212a0a9e66550
click@6.7
8.3.3

Open the chart page →

5,851
stackstorm-hastackstormVerified publisher1.1.011 of 17See more

stackstorm-ha stackstorm 1.1.0

11 of the 17 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
stackstorm/st2actionrunner:3.888235ba70cad
click@8.1.7
8.3.3
stackstorm/st2api:3.86f56d239d280
click@8.1.7
8.3.3
stackstorm/st2auth:3.833ecfda16608
click@8.1.7
8.3.3
stackstorm/st2garbagecollector:3.84e3f8c7ca52d
click@8.1.7
8.3.3
stackstorm/st2notifier:3.8f190a6212195
click@8.1.7
8.3.3
stackstorm/st2rulesengine:3.8259503496ff9
click@8.1.7
8.3.3
stackstorm/st2scheduler:3.8b1de2055c362
click@8.1.7
8.3.3
stackstorm/st2sensorcontainer:3.8b1a338f64773
click@8.1.7
8.3.3
stackstorm/st2stream:3.81c8904a3bf67
click@8.1.7
8.3.3
stackstorm/st2timersengine:3.81bf35bfaf00c
click@8.1.7
8.3.3
stackstorm/st2workflowengine:3.819fdfffdbba8
click@8.1.7
8.3.3

Open the chart page →

96,984
frigateblakeblackshear7.8.01 of 1See more

frigate blakeblackshear 7.8.0

1 of the 1 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
ghcr.io/blakeblackshear/frigate:0.14.122e3d0b486df
click@8.1.7
8.3.3

Open the chart page →

3,004
nautobotnautobotOfficialVerified publisher3.1.21 of 1See more

nautobot nautobot 3.1.2

1 of the 1 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
networktocode/nautobot:3.0-py3.13ed484336b1ad
click@8.3.2
8.3.3

Open the chart page →

4,344
syftopenmined0.9.52 of 6See more

syft openmined 0.9.5

2 of the 6 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
click@8.1.8
8.3.3
openmined/syft-seaweedfs:0.9.53a4144c0bb82
click@8.1.7
8.3.3

Open the chart page →

17,306
tbmq-clustertbmq-helm-chartOfficialVerified publisher2.1.01 of 3See more

tbmq-cluster tbmq-helm-chart 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
thingsboard/toolbox:1.13.01bd61a0da6d3
click@8.1.7
8.3.3

Open the chart page →

3,555
home-assistantalekcVerified publisher2.11.21 of 1See more

home-assistant alekc 2.11.2

1 of the 1 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
click@8.1.8
8.3.3

Open the chart page →

2,139
home-assistantandrenarchyVerified publisher14.103.01 of 1See more

home-assistant andrenarchy 14.103.0

1 of the 1 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.1612d76760b54
click@8.1.8
8.3.3

Open the chart page →

2,139
cluster-secretclutersecretVerified publisher0.7.01 of 1See more

cluster-secret clutersecret 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
quay.io/clustersecret/clustersecret:0.0.14a9f835d1b241
click@8.1.8
8.3.3

Open the chart page →

3,039
uptime-kumaduyet0.1.71 of 1See more

uptime-kuma duyet 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.18.5a84767d7934f
click@7.0
8.3.3

Open the chart page →

4,515
backstagerhdh-chartVerified publisher4.0.11 of 2See more

backstage rhdh-chart 4.0.1

1 of the 2 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
click@8.1.7
8.3.3

Open the chart page →

1,357
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.11.11da5c38c6a78
click@8.1.3
8.3.3

Open the chart page →

6,168
baserowbaserow-chartVerified publisher1.0.561 of 6See more

baserow baserow-chart 1.0.56

1 of the 6 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
baserow/backend:2.3.37c00549b3a6f
click@8.3.1
8.3.3

Open the chart page →

17,346
fadicetic0.3.11 of 25See more

fadi cetic 0.3.1

1 of the 25 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
amancevice/superset:0.35.212a0a9e66550
click@6.7
8.3.3

Open the chart page →

53,012
daskhubdask2024.1.11 of 9See more

daskhub dask 2024.1.1

1 of the 9 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
click@8.1.7
8.3.3

Open the chart page →

14,134
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
datamate/seafile-professional:11.0.202dd66b722464
click@8.2.1
8.3.3

Open the chart page →

27,358
geonode-k8sgeonode-k8sVerified publisher2.0.01 of 10See more

geonode-k8s geonode-k8s 2.0.0

1 of the 10 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
geopython/pycsw:3.0.0-beta284662ea6b78b
click@8.3.1
8.3.3

Open the chart page →

14,043
kubeflowkubeflow1.6.24 of 45See more

kubeflow kubeflow 1.6.2

4 of the 45 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
kserve/models-web-app:v0.8.063ea05e73842
click@8.1.3
8.3.3
kubeflownotebookswg/jupyter-web-app:v1.6.1d762690e21c1
click@8.1.3
8.3.3
kubeflownotebookswg/tensorboards-web-app:v1.6.10876fef1973b
click@8.1.3
8.3.3
kubeflownotebookswg/volumes-web-app:v1.6.17299fa94db15
click@8.1.3
8.3.3

Open the chart page →

97,040
clustersecretpatrungel0.2.01 of 1See more

clustersecret patrungel 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
flag5/clustersecret:0.0.94ad5748bfcc6
click@8.0.3
8.3.3

Open the chart page →

1,841
netboxstartechnicaVerified publisher5.1.01 of 4See more

netbox startechnica 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
click@8.1.7
8.3.3

Open the chart page →

1,650
k8s-telegram-sendertelegram-senderVerified publisher0.0.11 of 1See more

k8s-telegram-sender telegram-sender 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
danuk/telegram-sender:0.0.1026560388070
click@8.1.3
8.3.3

Open the chart page →

3,048
zenmlzenml0.96.41 of 1See more

zenml zenml 0.96.4

1 of the 1 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
zenmldocker/zenml-server:0.96.409027a6312ee
click@8.2.1
8.3.3

Open the chart page →

1,201
alerta-webalerta-webVerified publisher0.1.121 of 2See more

alerta-web alerta-web 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
hayk96/alerta-web:9.0.486377705e9e3
click@8.1.7
8.3.3

Open the chart page →

3,569
cmak-operatorcmak-operatorVerified publisher2.2.21 of 3See more

cmak-operator cmak-operator 2.2.2

1 of the 3 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
ghcr.io/eshepelyuk/dckr/cmak2zk:1.2.022de6314c31e
click@7.1.2
8.3.3

Open the chart page →

4,605
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
click@8.1.7
8.3.3

Open the chart page →

17,475
dask-kubernetes-operatordask2026.3.01 of 1See more

dask-kubernetes-operator dask 2026.3.0

1 of the 1 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
click@8.3.1
8.3.3

Open the chart page →

9,348
openshift-secured-pgadmineximiaitVerified publisher0.2.01 of 2See more

openshift-secured-pgadmin eximiait 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
dpage/pgadmin4:7.537946e4f3e7b
click@8.1.4
8.3.3

Open the chart page →

14,545
openshift-secured-redisInsighteximiaitVerified publisher0.9.21 of 2See more

openshift-secured-redisInsight eximiait 0.9.2

1 of the 2 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
redislabs/redisinsight:1.14.0b03ab1426d0d
click@8.1.3
8.3.3

Open the chart page →

13,874
healthchecksgabe565Verified publisher0.17.01 of 1See more

healthchecks gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/healthchecks:version-v3.9b5c6bfb00b03
click@8.1.8
8.3.3

Open the chart page →

2,285
esphomegeek-cookbookVerified publisher8.4.21 of 1See more

esphome geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
esphome/esphome:1.18.03f51ec10e823
click@7.1.2
8.3.3

Open the chart page →

3,717
frigategeek-cookbookVerified publisher8.2.21 of 1See more

frigate geek-cookbook 8.2.2

1 of the 1 container images this version deploys carry CVE-2026-7246.

Container imageDigestPackageFixed in
blakeblackshear/frigate:0.10.0-amd64ae269270ad9e
click@7.1.2
8.3.3

Open the chart page →

10,652

Container images carrying it

616 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
marcoimme/oidcmock:latestb6035c0721a8
click@8.3.1
8.3.3
1
mawad98/backstage-pyactions:demo99422c56a274
click@8.3.1
8.3.3
1
mher/flower:2.051c3c3db5be3
click@8.1.6
8.3.3
1
milesmcc/shynet:v0.13.1ba54f7797a6b
click@8.1.3
8.3.3
1
milesmcc/shynet:v0.12.0e821e31140f7
click@8.0.3
8.3.3
1
miltex/python-api:1.0.0dab12a7748d5
click@7.1.2
8.3.3
1
mindsdb/mindsdb:latest163011c09299
click@8.3.2
8.3.3
1
mintproject/data-catalog:9be70359feabe03ed55bfdbf92c20a7e43ab928b67d2f2103085
click@7.1.2
8.3.3
1
mintproject/model-catalog-fastapi:7dd88dc5bf1fe6a6d4703ea0a077afee45cb256102260d20a21f
click@8.1.3
8.3.3
1
mondata/mlflow:v2.3.0.s3.gc6f94c6caf8bf
click@8.1.3
8.3.3
1
moonrailgun/tianji:1.11.2b528c8f8fcc4
click@8.1.7
8.3.3
1
moreillon/face-recognition-fastapi:x86bacb2ddd8394
click@8.0.3
8.3.3
1
mshanley80/httpbin2022:latest5b189a70c0fb
click@8.1.3
8.3.3
1
muhammedgamal/fp23:latest74b4cd69b6fa
click@8.1.7
8.3.3
1
nabinchhetri/flask-app:v2.0be189fbf3411
click@8.1.3
8.3.3
1
nathanielvarona/pritunl-slack-app:0.1.10b746a34e5597
click@8.1.7
8.3.3
1
neilpeterson/aks-helloworld:v1fb47732ef36b
click@6.7
8.3.3
1
neilpeterson/chart-tweet:latest64fd8dab075f
click@6.7
8.3.3
1
netboxcommunity/netbox:v3.2.83d652dca5351
click@8.1.3
8.3.3
1
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
click@8.1.7
8.3.3
1
networktocode/nautobot:3.0-py3.13ed484336b1ad
click@8.3.2
8.3.3
1
neuvector/prometheus-exporter:1.0.181d78ed4eef40
click@8.1.7
8.3.3
1
ngoduykhanh/powerdns-admin:0.2.3099371dd9ba6
click@7.1.2
8.3.3
1
ngoduykhanh/powerdns-admin:latest9898a7cf37d2
click@8.1.3
8.3.3
1
octoprint/octoprint:1.4.0106c26efcd8a
click@7.1.2
8.3.3
1
octoprint/octoprint:1.6.1ea3bffae2470
click@7.1.2
8.3.3
1
oled01/automx2:2025.1.105d3e398e675
click@8.2.1
8.3.3
1
omecproject/mme-exporter:paging-latestbcc5f19fd676
click@7.0
8.3.3
1
omkara25/simple-microservice-app-order-service:v2.18327546c7aac
click@8.2.1
8.3.3
1
omkara25/simple-microservice-app-payment-service:v2afff40172b6b
click@8.2.1
8.3.3
1
omkara25/simple-microservice-app-user-service:v2d62cba548580
click@8.2.1
8.3.3
1
opea/asr:1.025dd26d9cd09
click@8.1.7
8.3.3
1
opea/chatqna:1.038c51b791efa
click@8.1.7
8.3.3
1
opea/codegen:1.058f91683892d
click@8.1.7
8.3.3
1
opea/codetrans:1.0e2436483b73d
click@8.1.7
8.3.3
1
opea/docsum:1.03eaa91849512
click@8.1.7
8.3.3
1
opea/guardrails-tgi:1.0262c6048aab8
click@8.1.7
8.3.3
1
opea/guardrails-tgi:latestf68bec6a1271
click@8.1.8
8.3.3
1
opea/llm-docsum-tgi:1.002f9e8fa5d71
click@8.1.7
8.3.3
1
opea/speecht5:1.0249afad3d268
click@8.1.7
8.3.3
1
opea/tts:1.0257ae94709e9
click@8.1.7
8.3.3
1
opea/web-retriever-chroma:1.0fe08165d7770
click@8.1.7
8.3.3
1
opencsghq/agenticflow:ee-v0.6-52f03fead54db
click@8.2.1
8.3.3
1
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
click@8.3.1
8.3.3
1
opencsghq/csgship-agentic:v0.4.02cd29671a03e
click@8.2.1
8.3.3
1
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
click@8.2.1
8.3.3
1
opencsghq/label-studio:v2.5.047e22aa71870
click@8.1.7
8.3.3
1
opencsghq/label-studio:v2.4.0b4e849fcf94a
click@8.1.7
8.3.3
1
opendatacube/explorer:latest120457ffcd69
click@8.1.8
8.3.3
1
opendatacube/pipelines:wofs-1.225d810e8504b8
click@6.7
8.3.3
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.