CVE-2026-91381

Medium

Advisory

Published 23 Oct 2026In the index since 24 Oct 2026

Severity: Medium; worst across findings
CVSS: 5.5; base score, highest
EPSS: 0.002; 13th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 69; of 18,232 indexed, latest versions
Container images: 60; deployed by those charts
Fix available: None; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 69 of 18,232 indexed charts deploy, on 60 images.

Affected package	Affected versions	Fixed in	Images
openjdk-8deb	8u151-b12-0ubuntu0.16.04.2, 8u171-b11-0ubuntu0.16.04.1, 8u191-b12-2ubuntu0.16.04.1, 8u212-b03-0ubuntu1.18.04.1+12 more	no fix listed	24
openjdk-ltsdeb	11.0.3+7-1ubuntu2~18.04.1, 11.0.8+10-0ubuntu1~18.04.1, 11.0.11+9-0ubuntu2~20.04, 11.0.13+8-0ubuntu1~20.04+7 more	no fix listed	17
openjdk-17deb	17.0.3+7-0ubuntu0.20.04.1, 17.0.8+7-1~22.04, 17.0.9+9-1~20.04, 17.0.10+7-1~22.04.1+7 more	no fix listed	14
openjdk-21deb	21.0.7+6~us1-0ubuntu1~24.04, 21.0.11~8ea-1, 21.0.12.1+1-1~24.04.4, 21.0.12.1+1-1~26.04.4+1 more	no fix listed	9
openjdk-25deb	25.0.4.1+1-1~26.04.4, 25.0.4+7-1~24.04	no fix listed	3

OSV records: UBUNTU-CVE-2026-91381

Charts affected

69 by stars

Chart

Latest

Affected images

Radar Score

opencloudjacobcolvin

0.2.3

1 of 13 See more

opencloud jacobcolvin 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-91381.

Container image	Digest	Package	Fixed in
apache/tika :2.9.2.1-full	ae0b86d3c4d0	openjdk-17@17.0.11+9-1	no fix listed

Open the chart page →

50,645

k8s-dev-podk8s-dev-pod

0.3.1

1 of 1 See more

k8s-dev-pod k8s-dev-pod 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-91381.

Container image	Digest	Package	Fixed in
ghcr.io/bryopsida/k8s-dev-pod :main	82d0b161161d	openjdk-21@21.0.7+6~us1-0ubuntu1~24.04	no fix listed

Open the chart page →

74,842

unifik8sonlab

0.3.7

1 of 1 See more

unifi k8sonlab 0.3.7

1 of the 1 container images this version deploys carry CVE-2026-91381.

Container image	Digest	Package	Fixed in
jacobalberty/unifi :v10.0.162	896c0ab82d33	openjdk-17@17.0.15+6~us1-0ubuntu1~20.04	no fix listed

Open the chart page →

9,014

unifimidokura-community

0.0.6

1 of 1 See more

unifi midokura-community 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-91381.

Container image	Digest	Package	Fixed in
linuxserver/unifi-controller :7.3.83	ab105cc50322	openjdk-lts@11.0.19+7~us1-0ubuntu1~20.04.1	no fix listed

Open the chart page →

12,538

chirpstackmosquitto-helm-chart

0.5.0

1 of 8 See more

chirpstack mosquitto-helm-chart 0.5.0

1 of the 8 container images this version deploys carry CVE-2026-91381.

Container image	Digest	Package	Fixed in
apachepulsar/pulsar :2.9.0	d056c89b7131	openjdk-lts@11.0.11+9-0ubuntu2~20.04	no fix listed

Open the chart page →

104,063

pulsarmosquitto-helm-chart

0.2.0

1 of 1 See more

pulsar mosquitto-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-91381.

Container image	Digest	Package	Fixed in
apachepulsar/pulsar :2.10.0	3b262ab7a7d9	openjdk-lts@11.0.13+8-0ubuntu1~20.04	no fix listed

Open the chart page →

17,375

smilencsa

1.1.0

1 of 23 See more

smile ncsa 1.1.0

1 of the 23 container images this version deploys carry CVE-2026-91381.

Container image	Digest	Package	Fixed in
socialmediamacroscope/autophrase :0.1.5	70fb11d4f531	openjdk-8@8u382-ga-1~20.04.1	no fix listed

Open the chart page →

609,391

booksonicnicholaswilde

1.0.1

1 of 1 See more

booksonic nicholaswilde 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-91381.

Container image	Digest	Package	Fixed in
ghcr.io/linuxserver/booksonic :version-1.2	677efca1065d	openjdk-8@8u312-b07-0ubuntu1~18.04	no fix listed

Open the chart page →

18,335

onedevonedev

11.9.0

1 of 1 See more

onedev onedev 11.9.0

1 of the 1 container images this version deploys carry CVE-2026-91381.

Container image	Digest	Package	Fixed in
1dev/server :11.9.0	cd5b12fe5471	openjdk-lts@11.0.26+4-1ubuntu1~24.04	no fix listed

Open the chart page →

7,900

cdn-remoteopencord

0.2.4

1 of 3 See more

cdn-remote opencord 0.2.4

1 of the 3 container images this version deploys carry CVE-2026-91381.

Container image	Digest	Package	Fixed in
omecproject/cdn-antmedia :1.0.0	b4ae7d0d6b74	openjdk-8@8u212-b03-0ubuntu1.18.04.1 openjdk-lts@11.0.3+7-1ubuntu2~18.04.1	no fix listed no fix listed

Open the chart page →

67,411

unifiqaoru

1.1.9

1 of 2 See more

unifi qaoru 1.1.9

1 of the 2 container images this version deploys carry CVE-2026-91381.

Container image	Digest	Package	Fixed in
linuxserver/unifi-network-application :10.6.106-ls151	392031f6300b	openjdk-25@25.0.4.1+1-1~26.04.4	no fix listed

Open the chart page →

4,635

javareact-java

0.1.0

1 of 1 See more

java react-java 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-91381.

Container image	Digest	Package	Fixed in
project2team4/react :latest	3ff031a08887	openjdk-lts@11.0.14.1+1-0ubuntu1~20.04	no fix listed

Open the chart page →

17,187

unifistartechnica

0.1.3

1 of 2 See more

unifi startechnica 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-91381.

Container image	Digest	Package	Fixed in
jacobalberty/unifi :v7.1.66	4a3616625dda	openjdk-8@8u312-b07-0ubuntu1~18.04	no fix listed

Open the chart page →

16,825

rundecksvtech-public-helm-charts

1.0.0

1 of 2 See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-91381.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_rundeck :v1.2.2	6e368ace0977	openjdk-lts@11.0.19+7~us1-0ubuntu1~20.04.1	no fix listed

Open the chart page →

76,449

the0the0

0.16.0

1 of 9 See more

the0 the0 0.16.0

1 of the 9 container images this version deploys carry CVE-2026-91381.

Container image	Digest	Package	Fixed in
ghcr.io/alexanderwanyoike/the0/runtime :1.21.0	7fb8da98abeb	openjdk-17@17.0.20.1+1-1~24.04	no fix listed

Open the chart page →

7,905

openunison-operatortremolo

3.0.33

1 of 1 See more

openunison-operator tremolo 3.0.33

1 of the 1 container images this version deploys carry CVE-2026-91381.

Container image	Digest	Package	Fixed in
ghcr.io/openunison/openunison-kubernetes-operator :1.0.15	33fbac79f442	openjdk-21@21.0.12.1+1-1~24.04.4	no fix listed

Open the chart page →

1,217

orchestratremolo

3.1.58

2 of 5 See more

orchestra tremolo 3.1.58

2 of the 5 container images this version deploys carry CVE-2026-91381.

Container image	Digest	Package	Fixed in
ghcr.io/openunison/openunison-k8s :1.0.53	d8c8e5a4830f	openjdk-21@21.0.12.1+1-1~24.04.4	no fix listed
ghcr.io/openunison/openunison-kubernetes-operator :1.0.15	33fbac79f442	openjdk-21@21.0.12.1+1-1~24.04.4	no fix listed

Open the chart page →

4,151

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-91381.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	openjdk-lts@11.0.11+9-0ubuntu2~20.04	no fix listed

Open the chart page →

15,896

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-91381.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	openjdk-lts@11.0.11+9-0ubuntu2~20.04	no fix listed

Open the chart page →

31,434

Container images carrying it

60 by charts deploying them

A fixed version is listed for 0 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/kubelauncher/zookeeper	9a85b8701c5e	openjdk-17@17.0.20+8-1~26.04	no fix listed	1
ghcr.io/linuxserver/booksonic :version-1.2	677efca1065d	openjdk-8@8u312-b07-0ubuntu1~18.04	no fix listed	1
ghcr.io/linuxserver/booksonic-air :version-v2009.1.0	baa4fa9549dc	openjdk-8@8u292-b10-0ubuntu1~18.04	no fix listed	1
ghcr.io/openunison/openunison-k8s :1.0.53	d8c8e5a4830f	openjdk-21@21.0.12.1+1-1~24.04.4	no fix listed	1
ghcr.io/star-whale/server :0.6.15	8368359c8dd0	openjdk-lts@11.0.16+8-0ubuntu1~20.04	no fix listed	1
ghcr.io/voxpupuli/container-puppetdb :7.18.0-v1.5.0	a56dfe91f5b1	openjdk-17@17.0.10+7-1~22.04.1 openjdk-8@8u402-ga-2ubuntu1~22.04	no fix listed no fix listed	1
ghcr.io/voxpupuli/container-puppetserver :7.17.0-v1.5.0	916746209ac5	openjdk-17@17.0.10+7-1~22.04.1 openjdk-8@8u402-ga-2ubuntu1~22.04	no fix listed no fix listed	1
ghcr.io/voxpupuli/puppetserver :8.7.0-main	63873f3f698e	openjdk-17@17.0.13+11-2ubuntu1~22.04	no fix listed	1
quay.io/opsmxpublic/spin-sample-pipeline :v1.0.1	c6a934439421	openjdk-8@8u222-b10-1ubuntu1~16.04.1	no fix listed	1
registry.gitlab.com/crafty-controller/crafty-4 :latest	7b6e87514259	openjdk-17@17.0.20+8-1~24.04 openjdk-21@21.0.12+8-1~24.04 openjdk-25@25.0.4+7-1~24.04 openjdk-8@8u502-ga~us1-0ubuntu1~24.04 openjdk-lts@11.0.32+9-1ubuntu1~24.04	no fix listed no fix listed no fix listed no fix listed no fix listed	1