StackRadar

CVE-2026-89610

Critical

Advisory

Published 11 Sept 2026In the index since 22 Oct 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
184
of 18,219 indexed, latest versions
Container images
181
deployed by those charts
Fix available
None
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 184 of 18,219 indexed charts deploy, on 181 images.

Affected packageAffected versionsFixed inImages
linuxdeb6.1.27-1, 6.1.37-1, 6.1.38-4, 6.1.52-1+31 moreno fix listed181
OSV records
DEBIAN-CVE-2026-89610

Charts affected

184 by stars
ChartLatestAffected imagesRadar Score
falcofalcosecurity9.2.11 of 3See more

falco falcosecurity 9.2.1

1 of the 3 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
falcosecurity/falco-driver-loader:0.45.16cfd7418907e
linux@6.1.190-1
no fix listed

Open the chart page →

17,171
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
allegroai/clearml:2.0.0-613713ae38f7daf
linux@6.1.119-1
no fix listed

Open the chart page →

72,464
openprojectopenproject-helm-chartsOfficialVerified publisher13.15.11 of 5See more

openproject openproject-helm-charts 13.15.1

1 of the 5 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
openproject/hocuspocus:release-338001b288dc1359dfb5
linux@6.1.147-1
no fix listed

Open the chart page →

72,733
kube-downscalerdeliveryheroVerified publisher0.7.61 of 1See more

kube-downscaler deliveryhero 0.7.6

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
linux@6.1.27-1
no fix listed

Open the chart page →

88,003
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
linux@6.1.140-1
no fix listed

Open the chart page →

60,015
codefreshcodefresh-onpremOfficialVerified publisher2.12.231 of 42See more

codefresh codefresh-onprem 2.12.23

1 of the 42 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
bitnamilegacy/consul:1.21.4-debian-12-r133ae872fc99d
linux@6.1.147-1
no fix listed

Open the chart page →

70,040
supabasetokens-studioVerified publisher1.0.01 of 14See more

supabase tokens-studio 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
supabase/studio:20241021-9f9b08326d8070c55e9
linux@6.1.112-1
no fix listed

Open the chart page →

89,784
renterdartur9010Verified publisher1.4.41 of 2See more

renterd artur9010 1.4.4

1 of the 2 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
artur9010/wait-for:v1.0.06b4de3ce8b0e
linux@6.1.90-1
no fix listed

Open the chart page →

79,103
devtron-operatordevtron0.23.31 of 11See more

devtron-operator devtron 0.23.3

1 of the 11 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
quay.io/devtron/devtron-utils:dup-chart-repo-v1.1.095d6f0e05636
linux@6.1.55-1
no fix listed

Open the chart page →

119,903
wazuh-agentavistoVerified publisher4.12.21 of 1See more

wazuh-agent avisto 4.12.2

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ghcr.io/avistotelecom/docker-wazuh-agent:4.12.08766ba08bf1a
linux@6.1.140-1
no fix listed

Open the chart page →

60,099
thehivestrangebee-helmOfficialVerified publisher2.0.01 of 7See more

thehive strangebee-helm 2.0.0

1 of the 7 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:9.1.2-debian-12-r000176a47afa0
linux@6.1.147-1
no fix listed

Open the chart page →

67,968
uffizzi-controlleruffizzi-controller2.4.61 of 11See more

uffizzi-controller uffizzi-controller 2.4.6

1 of the 11 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
uffizzi/controller:latest0344805f267b
linux@6.1.69-1
no fix listed

Open the chart page →

94,807
dolibarrcowboysysopVerified publisher9.0.31 of 3See more

dolibarr cowboysysop 9.0.3

1 of the 3 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
dolibarr/dolibarr:22.0.47ad88fc9b13c
linux@6.1.172-1
no fix listed

Open the chart page →

50,840
glpiglpi-conteiner0.1.01 of 3See more

glpi glpi-conteiner 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
vdiogov/glpi-conteiner:latest6945f84f0058
linux@6.1.99-1
no fix listed

Open the chart page →

79,114
dolibarrhelmforgeVerified publisher1.2.221 of 3See more

dolibarr helmforge 1.2.22

1 of the 3 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
dolibarr/dolibarr:24.0.217692e7315b3
linux@6.1.187-1
no fix listed

Open the chart page →

26,256
kubeflowkubeflow1.6.21 of 45See more

kubeflow kubeflow 1.6.2

1 of the 45 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
library/python:3.7eedf63967cdb
linux@6.1.52-1
no fix listed

Open the chart page →

269,860
uffizzi-appuffizzi-app1.3.01 of 14See more

uffizzi-app uffizzi-app 1.3.0

1 of the 14 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
uffizzi/controller:latest0344805f267b
linux@6.1.69-1
no fix listed

Open the chart page →

101,569
convertigoconvertigoOfficialVerified publisher8.4.61 of 5See more

convertigo convertigo 8.4.6

1 of the 5 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
linux@6.1.119-1
no fix listed

Open the chart page →

77,918
cosmocosmo-platformOfficialVerified publisher0.22.11 of 10See more

cosmo cosmo-platform 0.22.1

1 of the 10 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/otelcollector:0.18.15a6fe78d4d15
linux@6.1.124-1
no fix listed

Open the chart page →

93,108
flyte-binaryflyte2.0.521 of 4See more

flyte-binary flyte 2.0.52

1 of the 4 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
linux@6.1.172-1
no fix listed

Open the chart page →

44,482
anteonanteonVerified publisher2.6.41 of 13See more

anteon anteon 2.6.4

1 of the 13 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ddosify/selfhosted_backend:3.2.93c11e3182652
linux@6.1.85-1
no fix listed

Open the chart page →

98,339
dragonfly-stackdragonflyVerified publisher0.1.21 of 7See more

dragonfly-stack dragonfly 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
dragonflyoss/client:v0.1.82edf3e921f4e0
linux@6.1.90-1
no fix listed

Open the chart page →

91,919
enbuildenbuildVerified publisher0.0.501 of 6See more

enbuild enbuild 0.0.50

1 of the 6 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
linux@6.1.172-1
no fix listed

Open the chart page →

76,469
iobrokereugen0.2.61 of 1See more

iobroker eugen 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
linux@6.1.99-1
no fix listed

Open the chart page →

79,173
castopodh2mVerified publisher1.12.101 of 3See more

castopod h2m 1.12.10

1 of the 3 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
castopod/castopod:1.12.101fd37280cbb2
linux@6.1.106-3
no fix listed

Open the chart page →

75,821
harp-proxyharp0.8.11 of 1See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
makersquad/harp-proxy:0.8.1a40dd258c527
linux@6.1.133-1
no fix listed

Open the chart page →

62,072
valkey-clusterinnagoVerified publisher1.1.01 of 2See more

valkey-cluster innago 1.1.0

1 of the 2 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
valkey/valkey:8.0.1c5d4f082b76d
linux@6.1.106-3
no fix listed

Open the chart page →

67,933
food-managermoreillonVerified publisher0.5.01 of 2See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
moreillon/food-manager:lateste8fd856e593d
linux@6.1.137-1
no fix listed

Open the chart page →

69,868
clowder2ncsaVerified publisher1.9.71 of 12See more

clowder2 ncsa 1.9.7

1 of the 12 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:8.12.215d4647fd491
linux@6.1.76-1
no fix listed

Open the chart page →

120,451
openvaultopenvaultVerified publisher0.9.01 of 2See more

openvault openvault 0.9.0

1 of the 2 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
linux@6.1.140-1
no fix listed

Open the chart page →

61,541
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
treskon/portrait-web-setup:DEV-latesta475d80e4ecf
linux@6.1.128-1
no fix listed

Open the chart page →

94,776
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
linux@6.1.174-1
no fix listed

Open the chart page →

50,051
kimai2robjuz5.0.171 of 2See more

kimai2 robjuz 5.0.17

1 of the 2 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
kimai/kimai2:2.70.17ccc9597309b
linux@6.1.190-1
no fix listed

Open the chart page →

19,267
rocketadminrocketadminOfficialVerified publisher1.0.431 of 1See more

rocketadmin rocketadmin 1.0.43

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.23.70bd1abb0bfd1
linux@6.1.187-1
no fix listed

Open the chart page →

26,323
fluent-bitromanow-helm-chartsVerified publisher1.7.31 of 1See more

fluent-bit romanow-helm-charts 1.7.3

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
fluent/fluent-bit:4.0-debuge76397ef3983
linux@6.1.158-1
no fix listed

Open the chart page →

56,052
kyoorubxkubeVerified publisher0.1.102 of 9See more

kyoo rubxkube 0.1.10

2 of the 9 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ghcr.io/zoriya/kyoo_autosync:4.7.1fbba58ddb1a6
linux@6.1.119-1
no fix listed
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
linux@6.1.119-1
no fix listed

Open the chart page →

154,512
sentry-k8ssentry-k8sVerified publisher1.4.11 of 11See more

sentry-k8s sentry-k8s 1.4.1

1 of the 11 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ghcr.io/getsentry/taskbroker:26.7.264d0da74a578
linux@6.1.177-1
no fix listed

Open the chart page →

53,689
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
linux@6.1.177-1
no fix listed

Open the chart page →

55,054
u-storeunifieVerified publisher1.2.01 of 1See more

u-store unifie 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
linux@6.1.90-1
no fix listed

Open the chart page →

86,409
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
linux@6.1.123-1
no fix listed

Open the chart page →

71,997
varnish-cachevarnishVerified publisher1.1.11 of 1See more

varnish-cache varnish 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
library/varnish:7.5.04d0bb287d87b
linux@6.1.129-1
no fix listed

Open the chart page →

60,661
anchore-admission-controlleranchore-charts0.9.31 of 2See more

anchore-admission-controller anchore-charts 0.9.3

1 of the 2 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
cfssl/cfssl:v1.6.5c9018c2ddf0b
linux@6.1.69-1
no fix listed

Open the chart page →

83,603
mathesarandrenarchyVerified publisher1.8.01 of 1See more

mathesar andrenarchy 1.8.0

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
mathesar/mathesar:0.12.0091757cb01fe
linux@6.1.174-1
no fix listed

Open the chart page →

48,270
speech-to-phraseandrenarchyVerified publisher1.3.01 of 1See more

speech-to-phrase andrenarchy 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
rhasspy/wyoming-speech-to-phrase:1.4.3e532f0dbc6b2
linux@6.1.164-1
no fix listed

Open the chart page →

48,605
ddosifyanteonVerified publisher1.7.52 of 13See more

ddosify anteon 1.7.5

2 of the 13 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
linux@6.1.76-1
no fix listed
ddosify/selfhosted_backend:2.6.11ac323d52bfb4
linux@6.1.76-1
no fix listed

Open the chart page →

179,362
arlas-aiasarlas-stackVerified publisher28.10.02 of 22See more

arlas-aias arlas-stack 28.10.0

2 of the 22 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:9.0.1-debian-12-r0e6f6ddcce2f1
linux@6.1.135-1
no fix listed
ghcr.io/developmentseed/titiler:0.22.48ac53eb38393
linux@6.1.140-1
no fix listed

Open the chart page →

154,491
smartorchestratorassist-iot-smart-orchestrator4.0.03 of 14See more

smartorchestrator assist-iot-smart-orchestrator 4.0.0

3 of the 14 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
assistiot/smart-orchestrator_mcs:latest7d6a0d534c7f
linux@6.1.76-1
no fix listed
assistiot/smart-orchestrator_scheduler:latest38b003e55ff3
linux@6.1.85-1
no fix listed
assistiot/smart-orchestrator_scheduler_mc:latestb1dbe4d62a03
linux@6.1.52-1
no fix listed

Open the chart page →

275,366
astrotrekastria0.0.21 of 4See more

astrotrek astria 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
linux@6.1.106-3
no fix listed

Open the chart page →

102,399
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
linux@6.1.128-1
no fix listed

Open the chart page →

69,654
colosseumbook-k8sinfra-v21.0.182 of 5See more

colosseum book-k8sinfra-v2 1.0.18

2 of the 5 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-cms:loge74b43c7f492
linux@6.1.137-1
no fix listed
sysnet4admin/colosseum-prm:log5802bfcd7fed
linux@6.1.137-1
no fix listed

Open the chart page →

138,645

Container images carrying it

181 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
falcosecurity/falco-driver-loader:0.45.16cfd7418907e
linux@6.1.190-1
no fix listed
1
felipecs8/app-db-connection-test:v129e06c9c6385
linux@6.1.119-1
no fix listed
1
firefart/requesttracker:5.0.40d6249906d8c
linux@6.1.55-1
no fix listed
1
fiware/biz-ecosystem-logic-proxy:11.20.3d551a13e8278
linux@6.1.137-1
no fix listed
1
fluent/fluent-bit:4.0-debuge76397ef3983
linux@6.1.158-1
no fix listed
1
gulacedia/web-dvwa-new:v367b467d961ca
linux@6.1.27-1
no fix listed
1
helicone/supabase-migration-runner:v2025.03.05-14a913936c97b
linux@6.1.52-1
no fix listed
1
hjacobs/kube-janitor:23.7.0fbb303ed463c
linux@6.1.27-1
no fix listed
1
hjacobs/kube-web-view:23.8.0431f1bf013d0
linux@6.1.38-4
no fix listed
1
ildarmukhametzyanov/priceapp:0.115d23720a3ee
linux@6.1.52-1
no fix listed
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
linux@6.1.69-1
no fix listed
1
jaedb/iris:latest048cfbf58d57
linux@6.1.135-1
no fix listed
1
kimai/kimai2:2.70.17ccc9597309b
linux@6.1.190-1
no fix listed
1
knspar/phronetis-operator:0.1.60c4f0543ee58
linux@6.1.90-1
no fix listed
1
laly9999/node-app:1dd0e503913e1
linux@6.1.137-1
no fix listed
1
library/drupal:11.4.10-php8.5-apache-bookworm116fbf35120e
linux@6.1.190-1
no fix listed
1
library/haproxy:2.9.6fc5748ff7c72
linux@6.1.76-1
no fix listed
1
library/matomo:5.1.2-apache2415789e1602
linux@6.1.119-1
no fix listed
1
library/mediawiki:1.43.08b19e819f2e1
linux@6.1.129-1
no fix listed
1
library/nextcloud:31.0.6-apache588609d76b21
linux@6.1.140-1
no fix listed
1
library/node:lts3d27e5c11e57
linux@6.1.187-1
no fix listed
1
library/node:208f693eaa7e0a
linux@6.1.164-1
no fix listed
1
library/python:3.8d41127070014
linux@6.1.106-3
no fix listed
1
library/varnish:7.5.04d0bb287d87b
linux@6.1.129-1
no fix listed
1
library/wordpress:6.4.3-apache8ae66efb09a2
linux@6.1.76-1
no fix listed
1
logiqai/flash:v3.10.265b996bc7bdc
linux@6.1.106-3
no fix listed
1
makersquad/harp-proxy:0.8.1a40dd258c527
linux@6.1.133-1
no fix listed
1
mathesar/mathesar:0.12.0091757cb01fe
linux@6.1.174-1
no fix listed
1
mautic/mautic:7-apacheeb8cc73d97e1
linux@6.1.174-1
no fix listed
1
microslac/auth:latest5c1eb1f5c64d
linux@6.1.38-4
no fix listed
1
microslac/conversations:latest1b24afcd71ff
linux@6.1.38-4
no fix listed
1
microslac/teams:latest0f75997fcbe5
linux@6.1.38-4
no fix listed
1
microslac/users:latest216ea6832a56
linux@6.1.38-4
no fix listed
1
middlewareeng/middleware:0.3.1747d880812f1
linux@6.1.140-1
no fix listed
1
mintproject/model-catalog-fastapi:7dd88dc5bf1fe6a6d4703ea0a077afee45cb256102260d20a21f
linux@6.1.135-1
no fix listed
1
moodlehq/moodle-php-apache:8.4-bookworm922af5166835
linux@6.1.180-1
no fix listed
1
moreillon/api-proxy:latestd7d4a5463525
linux@6.1.137-1
no fix listed
1
moreillon/food-manager:lateste8fd856e593d
linux@6.1.137-1
no fix listed
1
moreillon/group-manager:latest3caa8f710ee0
linux@6.1.164-1
no fix listed
1
moreillon/user-manager-mongoose:v5.0.1d2ee0423b797
linux@6.1.55-1
no fix listed
1
muhammedgamal/fp23:latest74b4cd69b6fa
linux@6.1.90-1
no fix listed
1
oled01/automx2:2025.1.105d3e398e675
linux@6.1.140-1
no fix listed
1
opea/codegen-ui:1.02bee4eb66f3e
linux@6.1.76-1
no fix listed
1
opea/codetrans-ui:1.03ef121f34610
linux@6.1.76-1
no fix listed
1
opea/docsum-ui:1.07f854e9bffaf
linux@6.1.76-1
no fix listed
1
openproject/hocuspocus:release-338001b288dc1359dfb5
linux@6.1.147-1
no fix listed
1
opensign/opensign0ebc230eed21
linux@6.1.129-1
no fix listed
1
phan2410/dummy-service:0.0.89c6ed6de26ca
linux@6.1.129-1
no fix listed
1
phan2410/falcon-asgi-server:0.1.04a86d138832d
linux@6.1.129-1
no fix listed
1
prefecthq/prefect:2.20.4-python3.101df4b5b6238a
linux@6.1.99-1
no fix listed
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.