StackRadar

CVE-2026-89611

Critical

Advisory

Published 11 Sept 2026In the index since 22 Oct 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
184
of 18,219 indexed, latest versions
Container images
181
deployed by those charts
Fix available
None
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 184 of 18,219 indexed charts deploy, on 181 images.

Affected packageAffected versionsFixed inImages
linuxdeb6.1.27-1, 6.1.37-1, 6.1.38-4, 6.1.52-1+31 moreno fix listed181
OSV records
DEBIAN-CVE-2026-89611

Charts affected

184 by stars
ChartLatestAffected imagesRadar Score
falcofalcosecurity9.2.11 of 3See more

falco falcosecurity 9.2.1

1 of the 3 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
falcosecurity/falco-driver-loader:0.45.16cfd7418907e
linux@6.1.190-1
no fix listed

Open the chart page →

17,171
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
allegroai/clearml:2.0.0-613713ae38f7daf
linux@6.1.119-1
no fix listed

Open the chart page →

72,464
openprojectopenproject-helm-chartsOfficialVerified publisher13.15.11 of 5See more

openproject openproject-helm-charts 13.15.1

1 of the 5 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
openproject/hocuspocus:release-338001b288dc1359dfb5
linux@6.1.147-1
no fix listed

Open the chart page →

72,733
kube-downscalerdeliveryheroVerified publisher0.7.61 of 1See more

kube-downscaler deliveryhero 0.7.6

1 of the 1 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
linux@6.1.27-1
no fix listed

Open the chart page →

88,003
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
linux@6.1.140-1
no fix listed

Open the chart page →

60,015
codefreshcodefresh-onpremOfficialVerified publisher2.12.231 of 42See more

codefresh codefresh-onprem 2.12.23

1 of the 42 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
bitnamilegacy/consul:1.21.4-debian-12-r133ae872fc99d
linux@6.1.147-1
no fix listed

Open the chart page →

70,040
supabasetokens-studioVerified publisher1.0.01 of 14See more

supabase tokens-studio 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
supabase/studio:20241021-9f9b08326d8070c55e9
linux@6.1.112-1
no fix listed

Open the chart page →

89,784
renterdartur9010Verified publisher1.4.41 of 2See more

renterd artur9010 1.4.4

1 of the 2 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
artur9010/wait-for:v1.0.06b4de3ce8b0e
linux@6.1.90-1
no fix listed

Open the chart page →

79,103
devtron-operatordevtron0.23.31 of 11See more

devtron-operator devtron 0.23.3

1 of the 11 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
quay.io/devtron/devtron-utils:dup-chart-repo-v1.1.095d6f0e05636
linux@6.1.55-1
no fix listed

Open the chart page →

119,903
wazuh-agentavistoVerified publisher4.12.21 of 1See more

wazuh-agent avisto 4.12.2

1 of the 1 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
ghcr.io/avistotelecom/docker-wazuh-agent:4.12.08766ba08bf1a
linux@6.1.140-1
no fix listed

Open the chart page →

60,099
thehivestrangebee-helmOfficialVerified publisher2.0.01 of 7See more

thehive strangebee-helm 2.0.0

1 of the 7 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:9.1.2-debian-12-r000176a47afa0
linux@6.1.147-1
no fix listed

Open the chart page →

67,968
uffizzi-controlleruffizzi-controller2.4.61 of 11See more

uffizzi-controller uffizzi-controller 2.4.6

1 of the 11 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
uffizzi/controller:latest0344805f267b
linux@6.1.69-1
no fix listed

Open the chart page →

94,807
dolibarrcowboysysopVerified publisher9.0.31 of 3See more

dolibarr cowboysysop 9.0.3

1 of the 3 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
dolibarr/dolibarr:22.0.47ad88fc9b13c
linux@6.1.172-1
no fix listed

Open the chart page →

50,840
glpiglpi-conteiner0.1.01 of 3See more

glpi glpi-conteiner 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
vdiogov/glpi-conteiner:latest6945f84f0058
linux@6.1.99-1
no fix listed

Open the chart page →

79,114
dolibarrhelmforgeVerified publisher1.2.221 of 3See more

dolibarr helmforge 1.2.22

1 of the 3 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
dolibarr/dolibarr:24.0.217692e7315b3
linux@6.1.187-1
no fix listed

Open the chart page →

26,256
kubeflowkubeflow1.6.21 of 45See more

kubeflow kubeflow 1.6.2

1 of the 45 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
library/python:3.7eedf63967cdb
linux@6.1.52-1
no fix listed

Open the chart page →

269,860
uffizzi-appuffizzi-app1.3.01 of 14See more

uffizzi-app uffizzi-app 1.3.0

1 of the 14 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
uffizzi/controller:latest0344805f267b
linux@6.1.69-1
no fix listed

Open the chart page →

101,569
convertigoconvertigoOfficialVerified publisher8.4.61 of 5See more

convertigo convertigo 8.4.6

1 of the 5 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
linux@6.1.119-1
no fix listed

Open the chart page →

77,918
cosmocosmo-platformOfficialVerified publisher0.22.11 of 10See more

cosmo cosmo-platform 0.22.1

1 of the 10 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/otelcollector:0.18.15a6fe78d4d15
linux@6.1.124-1
no fix listed

Open the chart page →

93,108
flyte-binaryflyte2.0.521 of 4See more

flyte-binary flyte 2.0.52

1 of the 4 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
linux@6.1.172-1
no fix listed

Open the chart page →

44,482
anteonanteonVerified publisher2.6.41 of 13See more

anteon anteon 2.6.4

1 of the 13 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
ddosify/selfhosted_backend:3.2.93c11e3182652
linux@6.1.85-1
no fix listed

Open the chart page →

98,339
dragonfly-stackdragonflyVerified publisher0.1.21 of 7See more

dragonfly-stack dragonfly 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
dragonflyoss/client:v0.1.82edf3e921f4e0
linux@6.1.90-1
no fix listed

Open the chart page →

91,919
enbuildenbuildVerified publisher0.0.501 of 6See more

enbuild enbuild 0.0.50

1 of the 6 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
linux@6.1.172-1
no fix listed

Open the chart page →

76,469
iobrokereugen0.2.61 of 1See more

iobroker eugen 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
linux@6.1.99-1
no fix listed

Open the chart page →

79,173
castopodh2mVerified publisher1.12.101 of 3See more

castopod h2m 1.12.10

1 of the 3 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
castopod/castopod:1.12.101fd37280cbb2
linux@6.1.106-3
no fix listed

Open the chart page →

75,821
harp-proxyharp0.8.11 of 1See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
makersquad/harp-proxy:0.8.1a40dd258c527
linux@6.1.133-1
no fix listed

Open the chart page →

62,072
valkey-clusterinnagoVerified publisher1.1.01 of 2See more

valkey-cluster innago 1.1.0

1 of the 2 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
valkey/valkey:8.0.1c5d4f082b76d
linux@6.1.106-3
no fix listed

Open the chart page →

67,933
food-managermoreillonVerified publisher0.5.01 of 2See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
moreillon/food-manager:lateste8fd856e593d
linux@6.1.137-1
no fix listed

Open the chart page →

69,868
clowder2ncsaVerified publisher1.9.71 of 12See more

clowder2 ncsa 1.9.7

1 of the 12 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:8.12.215d4647fd491
linux@6.1.76-1
no fix listed

Open the chart page →

120,451
openvaultopenvaultVerified publisher0.9.01 of 2See more

openvault openvault 0.9.0

1 of the 2 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
linux@6.1.140-1
no fix listed

Open the chart page →

61,541
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
treskon/portrait-web-setup:DEV-latesta475d80e4ecf
linux@6.1.128-1
no fix listed

Open the chart page →

94,776
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
linux@6.1.174-1
no fix listed

Open the chart page →

50,051
kimai2robjuz5.0.171 of 2See more

kimai2 robjuz 5.0.17

1 of the 2 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
kimai/kimai2:2.70.17ccc9597309b
linux@6.1.190-1
no fix listed

Open the chart page →

19,267
rocketadminrocketadminOfficialVerified publisher1.0.431 of 1See more

rocketadmin rocketadmin 1.0.43

1 of the 1 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.23.70bd1abb0bfd1
linux@6.1.187-1
no fix listed

Open the chart page →

26,323
fluent-bitromanow-helm-chartsVerified publisher1.7.31 of 1See more

fluent-bit romanow-helm-charts 1.7.3

1 of the 1 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
fluent/fluent-bit:4.0-debuge76397ef3983
linux@6.1.158-1
no fix listed

Open the chart page →

56,052
kyoorubxkubeVerified publisher0.1.102 of 9See more

kyoo rubxkube 0.1.10

2 of the 9 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
ghcr.io/zoriya/kyoo_autosync:4.7.1fbba58ddb1a6
linux@6.1.119-1
no fix listed
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
linux@6.1.119-1
no fix listed

Open the chart page →

154,512
sentry-k8ssentry-k8sVerified publisher1.4.11 of 11See more

sentry-k8s sentry-k8s 1.4.1

1 of the 11 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
ghcr.io/getsentry/taskbroker:26.7.264d0da74a578
linux@6.1.177-1
no fix listed

Open the chart page →

53,689
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
linux@6.1.177-1
no fix listed

Open the chart page →

55,054
u-storeunifieVerified publisher1.2.01 of 1See more

u-store unifie 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
linux@6.1.90-1
no fix listed

Open the chart page →

86,409
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
linux@6.1.123-1
no fix listed

Open the chart page →

71,997
varnish-cachevarnishVerified publisher1.1.11 of 1See more

varnish-cache varnish 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
library/varnish:7.5.04d0bb287d87b
linux@6.1.129-1
no fix listed

Open the chart page →

60,661
anchore-admission-controlleranchore-charts0.9.31 of 2See more

anchore-admission-controller anchore-charts 0.9.3

1 of the 2 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
cfssl/cfssl:v1.6.5c9018c2ddf0b
linux@6.1.69-1
no fix listed

Open the chart page →

83,603
mathesarandrenarchyVerified publisher1.8.01 of 1See more

mathesar andrenarchy 1.8.0

1 of the 1 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
mathesar/mathesar:0.12.0091757cb01fe
linux@6.1.174-1
no fix listed

Open the chart page →

48,270
speech-to-phraseandrenarchyVerified publisher1.3.01 of 1See more

speech-to-phrase andrenarchy 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
rhasspy/wyoming-speech-to-phrase:1.4.3e532f0dbc6b2
linux@6.1.164-1
no fix listed

Open the chart page →

48,605
ddosifyanteonVerified publisher1.7.52 of 13See more

ddosify anteon 1.7.5

2 of the 13 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
linux@6.1.76-1
no fix listed
ddosify/selfhosted_backend:2.6.11ac323d52bfb4
linux@6.1.76-1
no fix listed

Open the chart page →

179,362
arlas-aiasarlas-stackVerified publisher28.10.02 of 22See more

arlas-aias arlas-stack 28.10.0

2 of the 22 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:9.0.1-debian-12-r0e6f6ddcce2f1
linux@6.1.135-1
no fix listed
ghcr.io/developmentseed/titiler:0.22.48ac53eb38393
linux@6.1.140-1
no fix listed

Open the chart page →

154,491
smartorchestratorassist-iot-smart-orchestrator4.0.03 of 14See more

smartorchestrator assist-iot-smart-orchestrator 4.0.0

3 of the 14 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
assistiot/smart-orchestrator_mcs:latest7d6a0d534c7f
linux@6.1.76-1
no fix listed
assistiot/smart-orchestrator_scheduler:latest38b003e55ff3
linux@6.1.85-1
no fix listed
assistiot/smart-orchestrator_scheduler_mc:latestb1dbe4d62a03
linux@6.1.52-1
no fix listed

Open the chart page →

275,366
astrotrekastria0.0.21 of 4See more

astrotrek astria 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
linux@6.1.106-3
no fix listed

Open the chart page →

102,399
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
linux@6.1.128-1
no fix listed

Open the chart page →

69,654
colosseumbook-k8sinfra-v21.0.182 of 5See more

colosseum book-k8sinfra-v2 1.0.18

2 of the 5 container images this version deploys carry CVE-2026-89611.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-cms:loge74b43c7f492
linux@6.1.137-1
no fix listed
sysnet4admin/colosseum-prm:log5802bfcd7fed
linux@6.1.137-1
no fix listed

Open the chart page →

138,645

Container images carrying it

181 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
linux@6.1.128-1
no fix listed
1
ghcr.io/krateoplatformops/deployment-service:1.2.59da9f93f2f731
linux@6.1.76-1
no fix listed
1
ghcr.io/krateoplatformops/finops-database-handler:0.5.32550427988e3
linux@6.1.90-1
no fix listed
1
ghcr.io/krateoplatformops/finops-webservice-api-mock:0.1.00877e9452d14
linux@6.1.76-1
no fix listed
1
ghcr.io/krateoplatformops/terminal-client:0.1.36c7c965e739c
linux@6.1.99-1
no fix listed
1
ghcr.io/krateoplatformops/terminal-server:0.1.3f5fd8ba6fea3
linux@6.1.99-1
no fix listed
1
ghcr.io/libreconnect/ferriscompany:0.1.0-rc6ed86db9f0efe
linux@6.1.112-1
no fix listed
1
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
linux@6.1.124-1
no fix listed
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
linux@6.1.158-1
no fix listed
1
ghcr.io/nefelim4ag/pingdom-operator:0.0.15f8c7afdcf439
linux@6.1.99-1
no fix listed
1
ghcr.io/opencost/opencost-parquet-exporter:v0.2.1ce85ef0ce665
linux@6.1.124-1
no fix listed
1
ghcr.io/open-telemetry/demo:1.12.0-quoteservice87eb325d306f
linux@6.1.112-1
no fix listed
1
ghcr.io/open-telemetry/demo:1.12.0-emailservicea1f5cebb5240
linux@6.1.69-1
no fix listed
1
ghcr.io/rodg/rtmp-controller:latest67f99a5beab7
linux@6.1.27-1
no fix listed
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
linux@6.1.123-1
no fix listed
1
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
linux@6.1.140-1
no fix listed
1
ghcr.io/wgbh-mla/pbcore-util:pr-66e04659a3baa
linux@6.1.159-1
no fix listed
1
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
linux@6.1.55-1
no fix listed
1
ghcr.io/wundergraph/cosmo/otelcollector:0.18.15a6fe78d4d15
linux@6.1.124-1
no fix listed
1
ghcr.io/zoriya/kyoo_autosync:4.7.1fbba58ddb1a6
linux@6.1.119-1
no fix listed
1
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
linux@6.1.119-1
no fix listed
1
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
linux@6.1.90-1
no fix listed
1
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
linux@6.1.112-1
no fix listed
1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
linux@6.1.90-1
no fix listed
1
public.ecr.aws/jtekt-corporation/time-series-storage-service:v1.5.1046ef5c9ed50
linux@6.1.55-1
no fix listed
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
linux@6.1.115-1
no fix listed
1
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
linux@6.1.69-1
no fix listed
1
quay.io/mittwald/kube-httpcache:stable2169032c5840
linux@6.1.140-1
no fix listed
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
linux@6.1.38-4
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
linux@6.1.172-1
no fix listed
1
registry.gitlab.com/school_guy/docker-typo3:13.4.30-197d868ed76185d7270d
linux@6.1.174-1
no fix listed
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.