StackRadar

CVE-2026-90711

Critical

Advisory

Published 5 Oct 2026In the index since 6 Oct 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
0.003
24th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
634
of 18,035 indexed, latest versions
Container images
643
deployed by those charts
Fix available
1 of 1
affected package

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

Carried by container images the latest versions of 634 of 18,035 indexed charts deploy, on 643 images.

Affected packageAffected versionsFixed inImages
proxy-addrnpm1.1.5, 2.0.2, 2.0.3, 2.0.4+3 more2.0.8643
OSV records
GHSA-jqcg-44mw-7w3h
Trending
Rank 20 in indexed charts, since 6 Oct 2026. See the ranking →

Charts affected

634 by stars
ChartLatestAffected imagesRadar Score
iofoghelm-chartsVerified publisher0.1.11 of 3See more

iofog helm-charts 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
quay.io/ctrontesting/iofog-controller:latest10df27bc5560
proxy-addr@2.0.7
2.0.8

Open the chart page →

25,770
streamsheetshelm-chartsVerified publisher0.2.34 of 8See more

streamsheets helm-charts 0.2.3

4 of the 8 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
proxy-addr@2.0.6
2.0.8
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
proxy-addr@2.0.6
2.0.8
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
proxy-addr@2.0.6
2.0.8
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
proxy-addr@2.0.6
2.0.8

Open the chart page →

91,741
nodeapphelmcharts0.1.41 of 1See more

nodeapp helmcharts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
kaushaln1/helm_node_app:lateste9f2d5dfdba0
proxy-addr@2.0.7
2.0.8

Open the chart page →

1,096
backstagehelm-charts-nr0.1.151 of 2See more

backstage helm-charts-nr 0.1.15

1 of the 2 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
proxy-addr@2.0.6
2.0.8

Open the chart page →

10,546
hoppscotchhelm-charts-nr0.3.11 of 1See more

hoppscotch helm-charts-nr 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
proxy-addr@2.0.7
2.0.8

Open the chart page →

4,195
crucixhelm-crucix0.2.01 of 1See more

crucix helm-crucix 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
ghcr.io/calesthio/crucix:latest67c5244b6acf
proxy-addr@2.0.7
2.0.8

Open the chart page →

975
affinehelmforgeVerified publisher1.0.21See more

affine helmforge 1.0.2

1 container image this version deploys carries CVE-2026-90711.

Container imageDigestPackageFixed in
ghcr.io/toeverything/affine:0.27.4b649f5ce2384
proxy-addr@2.0.7
2.0.8

Open the chart page →

—
automatischhelmforgeVerified publisher1.3.91See more

automatisch helmforge 1.3.9

1 container image this version deploys carries CVE-2026-90711.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
proxy-addr@2.0.7
2.0.8

Open the chart page →

—
countlyhelmforgeVerified publisher1.2.81 of 3See more

countly helmforge 1.2.8

1 of the 3 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
countly/countly-server:25.05.4e3c238248f99
proxy-addr@2.0.7
2.0.8

Open the chart page →

75,877
ghosthelmforgeVerified publisher1.2.101 of 3See more

ghost helmforge 1.2.10

1 of the 3 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
library/ghost:6.65.090592b712b6b
proxy-addr@2.0.7
2.0.8

Open the chart page →

3,528
hoppscotchhelmforgeVerified publisher1.1.121 of 2See more

hoppscotch helmforge 1.1.12

1 of the 2 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2026.8.2e7ba6061a286
proxy-addr@2.0.7
2.0.8

Open the chart page →

2,311
immichhelmforgeVerified publisher1.2.101See more

immich helmforge 1.2.10

1 container image this version deploys carries CVE-2026-90711.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
proxy-addr@2.0.7
2.0.8

Open the chart page →

—
reactive-resumehelmforgeVerified publisher1.0.01 of 4See more

reactive-resume helmforge 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
proxy-addr@2.0.7
2.0.8

Open the chart page →

3,541
ryothelmforgeVerified publisher1.0.01 of 2See more

ryot helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
proxy-addr@2.0.7
2.0.8

Open the chart page →

6,897
strapihelmforgeVerified publisher2.3.151 of 3See more

strapi helmforge 2.3.15

1 of the 3 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
helmforge/strapi-base:5.52.270e9143d6d92
proxy-addr@2.0.7
2.0.8

Open the chart page →

2,680
twentyhelmforgeVerified publisher1.0.41See more

twenty helmforge 1.0.4

1 container image this version deploys carries CVE-2026-90711.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.43.0b2b662b1bef1
proxy-addr@2.0.7
2.0.8

Open the chart page →

—
homebridgehomeenterpriseinc0.5.01 of 1See more

homebridge homeenterpriseinc 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
oznu/homebridge:2021-12-19-ubuntu2e12d0e2dcce
proxy-addr@2.0.7
2.0.8

Open the chart page →

81,331
pi-gallery2homeenterpriseinc0.3.01 of 1See more

pi-gallery2 homeenterpriseinc 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
bpatrik/pigallery2:1.9.0-debian-buster21fbaa5fae61
proxy-addr@2.0.6
2.0.8

Open the chart page →

3,694
wikijshomeenterpriseinc1.4.01 of 1See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
requarks/wiki:canary-2.5.2438b5865a7386c
proxy-addr@2.0.7
2.0.8

Open the chart page →

4,609
hoppscotchhoppscotch0.1.11 of 1See more

hoppscotch hoppscotch 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
proxy-addr@2.0.7
2.0.8

Open the chart page →

4,376
townsquarehuscker-chartsVerified publisher1.0.41 of 2See more

townsquare huscker-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
ghcr.io/huscker/townsquare-backend:2.15.2e106681e7673
proxy-addr@2.0.7
2.0.8

Open the chart page →

4,082
crypto-watchdoghuseyinnurbaki0.1.01 of 1See more

crypto-watchdog huseyinnurbaki 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
hhaluk/crypto-watchdog:0.4.0a6555953d941
proxy-addr@2.0.6
2.0.8

Open the chart page →

2,755
ibm-app-navigatoribm-charts1.0.11 of 5See more

ibm-app-navigator ibm-charts 1.0.1

1 of the 5 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
ibmcom/app-nav-ui:1.0.1e2a86997b36b
proxy-addr@2.0.5
2.0.8

Open the chart page →

33,453
ibm-business-automation-insights-devibm-charts3.2.01 of 6See more

ibm-business-automation-insights-dev ibm-charts 3.2.0

1 of the 6 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
ibmcom/bai-admin-dev:19.0.202d882f2836e
proxy-addr@2.0.3
2.0.8

Open the chart page →

40,065
ibm-microclimateibm-charts0.1.03 of 8See more

ibm-microclimate ibm-charts 0.1.0

3 of the 8 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
proxy-addr@2.0.3
2.0.8
ibmcom/microclimate-portal:latested5505e5c7ec
proxy-addr@2.0.3
2.0.8
ibmcom/microclimate-theia:lateste17bdccc5030
proxy-addr@2.0.3
2.0.8

Open the chart page →

119,072
iframelyiframelyVerified publisher2.3.51 of 1See more

iframely iframely 2.3.5

1 of the 1 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
proxy-addr@2.0.7
2.0.8

Open the chart page →

3,683
bluesky-pdsijmacd1.0.01 of 2See more

bluesky-pds ijmacd 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.405e164855fa1
proxy-addr@2.0.7
2.0.8

Open the chart page →

10,261
ilum-marquezilumVerified publisher6.7.01 of 3See more

ilum-marquez ilum 6.7.0

1 of the 3 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
ilum/marquez-web:0.53.2716437a51a6c
proxy-addr@2.0.7
2.0.8

Open the chart page →

6,949
ilum-unity-catalogilumVerified publisher0.1.01 of 4See more

ilum-unity-catalog ilum 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
proxy-addr@2.0.7
2.0.8

Open the chart page →

12,896
erpnextimprowisedVerified publisher3.3.01 of 3See more

erpnext improwised 3.3.0

1 of the 3 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
frappe/frappe-socketio:v13.4.12095767a9e82
proxy-addr@2.0.7
2.0.8

Open the chart page →

8,109
infisicalinfisical-charts0.4.21 of 3See more

infisical infisical-charts 0.4.2

1 of the 3 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
infisical/infisical:latest3365445909be
proxy-addr@2.0.7
2.0.8

Open the chart page →

3,361
dtlinfradao0.0.11 of 1See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
proxy-addr@2.0.7
2.0.8

Open the chart page →

5,783
cloudshellinseefrlab4.3.01 of 2See more

cloudshell inseefrlab 4.3.0

1 of the 2 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
inseefrlab/shelly:cloudshell31f04ca7436b
proxy-addr@2.0.5
2.0.8

Open the chart page →

12,166
nocodbinseefrlab0.2.01 of 1See more

nocodb inseefrlab 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
nocodb/nocodb:latest4ccfc5114506
proxy-addr@2.0.7
2.0.8

Open the chart page →

873
interbtc-hydrainterlay0.1.153 of 4See more

interbtc-hydra interlay 0.1.15

3 of the 4 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
interlayhq/interbtc-hydra-processor:master-2c6e16e-1637088364423d567d47aa
proxy-addr@2.0.7
2.0.8
subsquid/hydra-indexer:5.0.0-alpha.37a7f8b9bad7ee
proxy-addr@2.0.7
2.0.8
subsquid/hydra-indexer-status-service:5.0.0-alpha.37a4136013909c
proxy-addr@2.0.7
2.0.8

Open the chart page →

7,783
interlay-firesquidinterlay0.1.112 of 4See more

interlay-firesquid interlay 0.1.11

2 of the 4 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
interlayhq/interbtc-hydra-processor:0.10.55b2c414307b9
proxy-addr@2.0.7
2.0.8
subsquid/substrate-explorer:firesquid0889a857f192
proxy-addr@2.0.7
2.0.8

Open the chart page →

5,204
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
proxy-addr@2.0.6
2.0.8

Open the chart page →

8,604
iteqiteqOfficialVerified publisher0.3.31 of 3See more

iteq iteq 0.3.3

1 of the 3 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
ghcr.io/teq-cloud/iteq-api:0.3.3-beta0d9587179ed5
proxy-addr@2.0.7
2.0.8

Open the chart page →

940
keyoxide-webittrident-oss0.2.31 of 1See more

keyoxide-web ittrident-oss 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
keyoxide/keyoxide:stable96f27a71269d
proxy-addr@2.0.7
2.0.8

Open the chart page →

2,517
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
proxy-addr@2.0.7
2.0.8

Open the chart page →

4,551
n8njanip81-helm-chartsVerified publisher0.1.41 of 1See more

n8n janip81-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
n8nio/n8n:1.86.08b39ed5a2de9
proxy-addr@2.0.7
2.0.8

Open the chart page →

7,063
zomboid-serverjanip81-helm-chartsVerified publisher0.1.211 of 3See more

zomboid-server janip81-helm-charts 0.1.21

1 of the 3 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
ghcr.io/fpsacha/zomboid-panel:v1.0.6605e16dd56cfb
proxy-addr@2.0.7
2.0.8

Open the chart page →

662
hello-kubernetes-chartjhidalgo3-githubVerified publisher3.0.01 of 1See more

hello-kubernetes-chart jhidalgo3-github 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
jhidalgo3/hello-kubernetes:1.0.0.1397bf5ddfa8628d79f5
proxy-addr@2.0.7
2.0.8

Open the chart page →

1,065
annotation-tooljtektVerified publisher0.1.51 of 2See more

annotation-tool jtekt 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
moreillon/api-proxy:a3e8b41e9e578c9653b6
proxy-addr@2.0.6
2.0.8

Open the chart page →

2,752
image-storage-servicejtektVerified publisher0.5.11 of 4See more

image-storage-service jtekt 0.5.1

1 of the 4 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
proxy-addr@2.0.7
2.0.8

Open the chart page →

24,912
polygonal-annotation-tooljtektVerified publisher0.1.51 of 2See more

polygonal-annotation-tool jtekt 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
moreillon/api-proxy:a3e8b41e9e578c9653b6
proxy-addr@2.0.6
2.0.8

Open the chart page →

2,652
shinsei-managerjtektVerified publisher0.2.04 of 8See more

shinsei-manager jtekt 0.2.0

4 of the 8 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
moreillon/api-proxy:latestd7d4a5463525
proxy-addr@2.0.7
2.0.8
moreillon/group-manager:latest3caa8f710ee0
proxy-addr@2.0.7
2.0.8
moreillon/user-manager:v5.0.2e1c9bfab5c16
proxy-addr@2.0.7
2.0.8
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
proxy-addr@2.0.7
2.0.8

Open the chart page →

68,829
time-series-storagejtektVerified publisher0.1.101 of 2See more

time-series-storage jtekt 0.1.10

1 of the 2 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
public.ecr.aws/jtekt-corporation/time-series-storage-service:v1.5.1046ef5c9ed50
proxy-addr@2.0.7
2.0.8

Open the chart page →

18,504
docker-hub-rssjuniorjpdj0.1.331 of 1See more

docker-hub-rss juniorjpdj 0.1.33

1 of the 1 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
ghcr.io/theconnman/docker-hub-rss:0.6.238eba84b2be8
proxy-addr@2.0.7
2.0.8

Open the chart page →

2,166
todo-appjunktext-via-aws1.2.101 of 1See more

todo-app junktext-via-aws 1.2.10

1 of the 1 container images this version deploys carry CVE-2026-90711.

Container imageDigestPackageFixed in
junktext/getting-started:1.0.34d44adf5a4da2
proxy-addr@2.0.7
2.0.8

Open the chart page →

1,680

Container images carrying it

643 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

No deployed image carries CVE-2026-90711.

syft 1.42.1 · advisories as of 6 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.