StackRadar

CVE-2026-88840

Medium

Advisory

Published 24 Sept 2026In the index since 25 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
25
of 17,844 indexed, latest versions
Container images
22
deployed by those charts
Fix available
None
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 25 of 17,844 indexed charts deploy, on 22 images.

Affected packageAffected versionsFixed inImages
busyboxdeb1:1.21.0-1ubuntu1, 1:1.21.0-1ubuntu1.4, 1:1.27.2-2ubuntu3.4, 1:1.30.1-4ubuntu6.4+3 moreno fix listed22
OSV records
UBUNTU-CVE-2026-88840

Charts affected

25 by stars
ChartLatestAffected imagesRadar Score
oneuptimeoneuptimeOfficialVerified publisher14.0.21 of 7See more

oneuptime oneuptime 14.0.2

1 of the 7 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:26.7a50b4a1579a0
busybox@1:1.30.1-7ubuntu3.1
no fix listed

Open the chart page →

8,334
machinarislib42Verified publisher0.2.01 of 1See more

machinaris lib42 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
ghcr.io/guydavis/machinaris:test50a71a30f18e
busybox@1:1.36.1-6ubuntu3.1
no fix listed

Open the chart page →

36,219
observalobservalVerified publisher1.13.11 of 8See more

observal observal 1.13.1

1 of the 8 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:26.3810861a2e2d0
busybox@1:1.30.1-7ubuntu3.1
no fix listed

Open the chart page →

6,593
clickhouseclickhouse-alerthawkVerified publisher26.5.01 of 1See more

clickhouse clickhouse-alerthawk 26.5.0

1 of the 1 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:26.584d05b9c205e
busybox@1:1.30.1-7ubuntu3.1
no fix listed

Open the chart page →

1,904
dokudokuOfficialVerified publisher0.1.41 of 3See more

doku doku 0.1.4

1 of the 3 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:latesta73b5c0fb6f8
busybox@1:1.30.1-7ubuntu3.1
no fix listed

Open the chart page →

1,772
kubefarmkvaps0.13.41 of 6See more

kubefarm kvaps 0.13.4

1 of the 6 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
ghcr.io/kvaps/kubefarm-ltsp:v0.13.424efef013a53
busybox@1:1.30.1-4ubuntu6.4
no fix listed

Open the chart page →

12,668
clickhousesinextraVerified publisher0.22.01 of 1See more

clickhouse sinextra 0.22.0

1 of the 1 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:26.3.1092098d3b31dd
busybox@1:1.30.1-7ubuntu3.1
no fix listed

Open the chart page →

2,199
kafka-devwikimedia0.2.01 of 1See more

kafka-dev wikimedia 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
wurstmeister/zookeeper:latest7a7fd44a7210
busybox@1:1.21.0-1ubuntu1
no fix listed

Open the chart page →

41,846
alibaba-rsocket-brokeralibaba-rsocket-brokerVerified publisher0.1.31 of 1See more

alibaba-rsocket-broker alibaba-rsocket-broker 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
linuxchina/alibaba-rsocket-broker:1.1.3-k8sf758e2e567ee
busybox@1:1.27.2-2ubuntu3.4
no fix listed

Open the chart page →

93,258
opensipschetan-opensips0.1.01 of 1See more

opensips chetan-opensips 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
chetangautamm/repo:Opensips_Buildb4b94155ff5a
busybox@1:1.21.0-1ubuntu1.4
no fix listed

Open the chart page →

77,909
guestbookcloudnativeapp0.2.01 of 3See more

guestbook cloudnativeapp 0.2.0

1 of the 3 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
resouer/redis-slave:v2e2f198b49ba7
busybox@1:1.21.0-1ubuntu1
no fix listed

Open the chart page →

91,109
galaxy-stablecloudve2.0.02 of 5See more

galaxy-stable cloudve 2.0.0

2 of the 5 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
galaxy/galaxy-init:v18.010267bad550e6
busybox@1:1.21.0-1ubuntu1
no fix listed
galaxy/galaxy-stable:v18.018e577a626dfd
busybox@1:1.21.0-1ubuntu1
no fix listed

Open the chart page →

169,807
argocd-certificate-refreshdevtron0.10.81 of 1See more

argocd-certificate-refresh devtron 0.10.8

1 of the 1 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
quay.io/devtron/argocd-cert-refresh:v102b6db27eaf3d
busybox@1:1.30.1-7ubuntu3
no fix listed

Open the chart page →

13,525
argocd-certificate-refreshdevtron-labs0.10.81 of 1See more

argocd-certificate-refresh devtron-labs 0.10.8

1 of the 1 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
quay.io/devtron/argocd-cert-refresh:v102b6db27eaf3d
busybox@1:1.30.1-7ubuntu3
no fix listed

Open the chart page →

13,525
video-analytics-demogpu-operator0.1.91 of 3See more

video-analytics-demo gpu-operator 0.1.9

1 of the 3 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
anguda/ant-media:2.5c435285fc241
busybox@1:1.30.1-4ubuntu6.4
no fix listed

Open the chart page →

15,940
clickhousehelmforgeVerified publisher2.0.21 of 1See more

clickhouse helmforge 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:26.8.3d73903d1b61d
busybox@1:1.30.1-7ubuntu3.1
no fix listed

Open the chart page →

1,772
deepflowkubesphere-stable6.2.6061 of 8See more

deepflow kubesphere-stable 6.2.606

1 of the 8 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
deepflowce/deepflow-agent:v6.2.6.529332fee7fc2
busybox@1:1.30.1-7ubuntu3
no fix listed

Open the chart page →

18,905
danboorumy0nVerified publisher0.0.21 of 1See more

danbooru my0n 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
busybox@1:1.30.1-7ubuntu3
no fix listed

Open the chart page →

103,865
danbooru-stackmy0nVerified publisher0.0.31 of 4See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
busybox@1:1.30.1-7ubuntu3
no fix listed

Open the chart page →

103,865
zookeeper-helm-chartnotesprojectchart0.1.01 of 1See more

zookeeper-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
wurstmeister/zookeeper:latest7a7fd44a7210
busybox@1:1.21.0-1ubuntu1
no fix listed

Open the chart page →

41,846
sebaopencord1.0.01 of 17See more

seba opencord 1.0.0

1 of the 17 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
voltha/voltha-envoy:1.6.059ab2a00f712
busybox@1:1.21.0-1ubuntu1
no fix listed

Open the chart page →

374,328
dokuopenlit0.1.41 of 3See more

doku openlit 0.1.4

1 of the 3 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:latest42acb460c63b
busybox@1:1.30.1-7ubuntu3.1
no fix listed

Open the chart page →

1,772
openpanelopenpanel0.9.01 of 6See more

openpanel openpanel 0.9.0

1 of the 6 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:25.10.2.65e019438e1e05
busybox@1:1.30.1-7ubuntu3.1
no fix listed

Open the chart page →

3,673
issuegenopsmxVerified publisher1.0.21 of 1See more

issuegen opsmx 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
opsmx11/issuegen:v2.1.05c50ca123d88
busybox@1:1.21.0-1ubuntu1
no fix listed

Open the chart page →

26,716
argocd-certificate-refreshromholdings0.10.81 of 1See more

argocd-certificate-refresh romholdings 0.10.8

1 of the 1 container images this version deploys carry CVE-2026-88840.

Container imageDigestPackageFixed in
quay.io/devtron/argocd-cert-refresh:v102b6db27eaf3d
busybox@1:1.30.1-7ubuntu3
no fix listed

Open the chart page →

13,525

Container images carrying it

22 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/devtron/argocd-cert-refresh:v102b6db27eaf3d
busybox@1:1.30.1-7ubuntu3
no fix listed
3
wurstmeister/zookeeper:latest7a7fd44a7210
busybox@1:1.21.0-1ubuntu1
no fix listed
2
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
busybox@1:1.30.1-7ubuntu3
no fix listed
2
anguda/ant-media:2.5c435285fc241
busybox@1:1.30.1-4ubuntu6.4
no fix listed
1
chetangautamm/repo:Opensips_Buildb4b94155ff5a
busybox@1:1.21.0-1ubuntu1.4
no fix listed
1
clickhouse/clickhouse-server:latest42acb460c63b
busybox@1:1.30.1-7ubuntu3.1
no fix listed
1
clickhouse/clickhouse-server:26.3810861a2e2d0
busybox@1:1.30.1-7ubuntu3.1
no fix listed
1
clickhouse/clickhouse-server:26.584d05b9c205e
busybox@1:1.30.1-7ubuntu3.1
no fix listed
1
clickhouse/clickhouse-server:26.3.1092098d3b31dd
busybox@1:1.30.1-7ubuntu3.1
no fix listed
1
clickhouse/clickhouse-server:26.7a50b4a1579a0
busybox@1:1.30.1-7ubuntu3.1
no fix listed
1
clickhouse/clickhouse-server:latesta73b5c0fb6f8
busybox@1:1.30.1-7ubuntu3.1
no fix listed
1
clickhouse/clickhouse-server:26.8.3d73903d1b61d
busybox@1:1.30.1-7ubuntu3.1
no fix listed
1
clickhouse/clickhouse-server:25.10.2.65e019438e1e05
busybox@1:1.30.1-7ubuntu3.1
no fix listed
1
deepflowce/deepflow-agent:v6.2.6.529332fee7fc2
busybox@1:1.30.1-7ubuntu3
no fix listed
1
galaxy/galaxy-init:v18.010267bad550e6
busybox@1:1.21.0-1ubuntu1
no fix listed
1
galaxy/galaxy-stable:v18.018e577a626dfd
busybox@1:1.21.0-1ubuntu1
no fix listed
1
linuxchina/alibaba-rsocket-broker:1.1.3-k8sf758e2e567ee
busybox@1:1.27.2-2ubuntu3.4
no fix listed
1
opsmx11/issuegen:v2.1.05c50ca123d88
busybox@1:1.21.0-1ubuntu1
no fix listed
1
resouer/redis-slave:v2e2f198b49ba7
busybox@1:1.21.0-1ubuntu1
no fix listed
1
voltha/voltha-envoy:1.6.059ab2a00f712
busybox@1:1.21.0-1ubuntu1
no fix listed
1
ghcr.io/guydavis/machinaris:test50a71a30f18e
busybox@1:1.36.1-6ubuntu3.1
no fix listed
1
ghcr.io/kvaps/kubefarm-ltsp:v0.13.424efef013a53
busybox@1:1.30.1-4ubuntu6.4
no fix listed
1

syft 1.42.1 · advisories as of 25 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.