StackRadar

CVE-2026-91776

High

Advisory

Published 30 Sept 2026In the index since 1 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
37th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,059
of 17,985 indexed, latest versions
Container images
1,072
deployed by those charts
Fix available
1 of 1
affected package

jackson-databind retains every unknown raw type ID

Carried by container images the latest versions of 1,059 of 17,985 indexed charts deploy, on 1,072 images.

Affected packageAffected versionsFixed inImages
jackson-databindmaven2.0.5, 2.2.3, 2.3.0, 2.3.3+122 more2.18.11, 2.21.7, 2.22.3, 3.1.7+1 more1,072
OSV records
GHSA-wv8q-qhhj-9h54
Trending
Rank 7 in indexed charts, since 1 Oct 2026. See the ranking →

Charts affected

1,059 by stars
ChartLatestAffected imagesRadar Score
hapi-fhirhapi-fhirVerified publisher0.1.01 of 1See more

hapi-fhir hapi-fhir 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
polyakov/hapi-fhir-jpaserver-example:latestdbcef69146b8
jackson-databind@2.3.3
2.18.11

Open the chart page →

7,349
hazelcast-jethazelcastVerified publisher1.17.11 of 1See more

hazelcast-jet hazelcast 1.17.1

1 of the 1 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
hazelcast/hazelcast-jet:4.5.3a825ecbe9fda
jackson-databind@2.11.4
2.18.11

Open the chart page →

6,624
hbasehbase0.1.72 of 4See more

hbase hbase 0.1.7

2 of the 4 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
ghcr.io/fleeksoft/hbase/hbase-base:2.4.13.2c144bdd688d7
jackson-databind@2.4.0
2.18.11
ghcr.io/fleeksoft/hbase/hdfs:3.3.3.2ac62269785ac
jackson-databind@2.13.2.2
2.18.11

Open the chart page →

11,187
nacosheidaodageshiwoVerified publisher0.1.51 of 1See more

nacos heidaodageshiwo 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
nacos/nacos-server:v2.1.0dcf04549c6d7
jackson-databind@2.12.2
2.18.11

Open the chart page →

4,086
hello-world-apihello-world-api0.0.51 of 1See more

hello-world-api hello-world-api 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
fabioformosa/hello-world-api:latest063873af085c
jackson-databind@2.18.3
2.18.11

Open the chart page →

1,520
helm-airportshelm-airports0.1.04 of 7See more

helm-airports helm-airports 0.1.0

4 of the 7 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
dina1993/airports-api:latestac731244aed1
jackson-databind@2.14.2
2.18.11
dina1993/airports-consumer:latest669d146a5e63
jackson-databind@2.14.2
2.18.11
dina1993/airports-producer:latest3d6b0dac1cb4
jackson-databind@2.14.2
2.18.11
wurstmeister/kafka:latest2d4bbf9cc83d
jackson-databind@2.10.5.1
2.18.11

Open the chart page →

14,964
airports-kafkahelm-airports-dan0.1.01 of 2See more

airports-kafka helm-airports-dan 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
jackson-databind@2.10.5.1
2.18.11

Open the chart page →

5,857
helm-airportshelm-airports-dan0.1.01 of 7See more

helm-airports helm-airports-dan 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
jackson-databind@2.10.5.1
2.18.11

Open the chart page →

7,597
airports-kafkahelm-airports-kafka0.1.01 of 2See more

airports-kafka helm-airports-kafka 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
jackson-databind@2.10.5.1
2.18.11

Open the chart page →

5,857
jenkinshelm-chart-for-jenkinsVerified publisher1.0.01 of 1See more

jenkins helm-chart-for-jenkins 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.7

Open the chart page →

3,140
pageshelm-chart-repos-camden1.0.01 of 3See more

pages helm-chart-repos-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-databind@2.11.0
2.18.11

Open the chart page →

21,119
springboothelmcharts1.0.01 of 1See more

springboot helmcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
kimb88/hello-world-spring-boot:latest0639155241cb
jackson-databind@2.9.6
2.18.11

Open the chart page →

6,488
metabasehelm-charts-nr0.14.41 of 1See more

metabase helm-charts-nr 0.14.4

1 of the 1 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
metabase/metabase:v0.45.21fb334ce4820
jackson-databind@2.13.4.2
2.18.11

Open the chart page →

2,661
wiremockhelm-charts-nr1.4.61 of 2See more

wiremock helm-charts-nr 1.4.6

1 of the 2 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
rodolpheche/wiremock:2.26.03be08a386092
jackson-databind@2.10.0
2.18.11

Open the chart page →

2,721
cruise-controlhelm-cruise-controlVerified publisher2.3.01 of 2See more

cruise-control helm-cruise-control 2.3.0

1 of the 2 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
ghcr.io/devops-ia/kafka-cruise-control:jdk17-cc2.5.146-iam2.3.9981c4e73eca0
jackson-databind@2.16.2
2.18.11

Open the chart page →

2,442
chart-bookhelm-deploy-book0.1.01 of 3See more

chart-book helm-deploy-book 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
dannielkil/book-backend:lateste3b479a55a69
jackson-databind@2.13.3
2.18.11

Open the chart page →

10,484
jasperreportshelm-dojo8.0.0-v1.31 of 2See more

jasperreports helm-dojo 8.0.0-v1.3

1 of the 2 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
palopalepalo/jasperreports:8-v1.356b99b194d20
jackson-databind@2.13.2.2
2.18.11

Open the chart page →

7,598
alfiohelmforgeVerified publisher1.2.121 of 3See more

alfio helmforge 1.2.12

1 of the 3 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
alfio/alf.io:2.0-M5-26060c836a081446
jackson-databind@2.21.2
2.21.7

Open the chart page →

2,278
archiveboxhelmforgeVerified publisher1.1.131 of 1See more

archivebox helmforge 1.1.13

1 of the 1 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
archivebox/archivebox:0.9.708c21bb233130
jackson-databind@2.22.2
2.22.3

Open the chart page →

5,756
booklorehelmforgeVerified publisher2.0.21 of 3See more

booklore helmforge 2.0.2

1 of the 3 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
ghcr.io/booklore-app/booklore:v2.3.1d3d3af34bc2c
jackson-databind@2.21.4
2.21.7

Open the chart page →

2,352
ckanhelmforgeVerified publisher1.3.91 of 6See more

ckan helmforge 1.3.9

1 of the 6 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
ckan/ckan-solr:2.11-solr9ef8e5d3e6be1
jackson-databind@2.12.7.1
2.18.11

Open the chart page →

11,364
druidhelmforgeVerified publisher1.3.62 of 4See more

druid helmforge 1.3.6

2 of the 4 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
apache/druid:37.0.00116fb802786
jackson-databind@2.19.2
2.21.7
library/zookeeper:3.9.57d0f24ebb67b
jackson-databind@2.15.2
2.18.11

Open the chart page →

9,955
elasticsearchhelmforgeVerified publisher1.1.81 of 2See more

elasticsearch helmforge 1.1.8

1 of the 2 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
library/elasticsearch:9.5.3a4e2b3d21ad0
jackson-databind@2.21.5
2.21.7

Open the chart page →

433
jenkinshelmforgeVerified publisher1.0.91 of 1See more

jenkins helmforge 1.0.9

1 of the 1 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
jenkins/jenkins:2.568.3-lts-jdk21c1e4c349365f
jackson-databind@3.1.3
3.1.7

Open the chart page →

3,140
kibanahelmforgeVerified publisher1.1.81 of 3See more

kibana helmforge 1.1.8

1 of the 3 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
library/elasticsearch:9.5.19656a9ca03f8
jackson-databind@2.18.8
2.18.11

Open the chart page →

552
komgahelmforgeVerified publisher1.4.161 of 1See more

komga helmforge 1.4.16

1 of the 1 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
gotson/komga:1.27.19cf102f5fb78
jackson-databind@2.21.4
2.21.7

Open the chart page →

36,096
metabasehelmforgeVerified publisher1.2.301 of 3See more

metabase helmforge 1.2.30

1 of the 3 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
metabase/metabase:v0.63.181160b570cb11
jackson-databind@2.21.6
2.21.7

Open the chart page →

1,793
minecrafthelmforgeVerified publisher1.5.51 of 1See more

minecraft helmforge 1.5.5

1 of the 1 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
itzg/minecraft-server:2026.9.2de5d1b1a83eb
jackson-databind@2.22.2
2.22.3

Open the chart page →

4,730
webodmhelmforgeVerified publisher1.0.01 of 4See more

webodm helmforge 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
opendronemap/nodeodm:3.6.2fcd99eb23d8d
jackson-databind@2.4.5
2.18.11

Open the chart page →

22,340
zookeeperhelmforgeVerified publisher1.0.21 of 1See more

zookeeper helmforge 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
library/zookeeper:3.9.57d0f24ebb67b
jackson-databind@2.15.2
2.18.11

Open the chart page →

3,994
openbashelm-openbasVerified publisher1.8.142 of 7See more

openbas helm-openbas 1.8.14

2 of the 7 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
openbas/platform:2.0.5d986d80b0a75
jackson-databind@2.17.3
2.18.11
opensearchproject/opensearch:3.3.2798cf28e226a
jackson-databind@2.17.1
2.18.11

Open the chart page →

29,071
pageshelm-repo1.0.01 of 3See more

pages helm-repo 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
jackson-databind@2.11.0
2.18.11

Open the chart page →

21,119
todo-apihelm-repo-sharif0.1.01 of 2See more

todo-api helm-repo-sharif 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
pavanelthepu/todo-api:1.0.2f47658e3b24c
jackson-databind@2.12.3
2.18.11

Open the chart page →

2,620
test-helm-charthelm-testVerified publisher0.1.01 of 1See more

test-helm-chart helm-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
prom/cloudwatch-exporter:cloudwatch_exporter-0.8.0fc4b9b9f5e15
jackson-databind@2.9.10.1
2.18.11

Open the chart page →

3,340
heronheron0.20.5-incubating1 of 2See more

heron heron 0.20.5-incubating

1 of the 2 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
apache/bookkeeper:4.14.5a7d9970c148f
jackson-databind@2.11.0
2.18.11

Open the chart page →

1,568
hivemq-edgehivemqOfficialVerified publisher0.1.361 of 1See more

hivemq-edge hivemq 0.1.36

1 of the 1 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
hivemq/hivemq-edge:2026.14d8250a233cea
jackson-databind@2.22.2
2.22.3

Open the chart page →

1,558
paperlesshpVerified publisher0.1.21 of 5See more

paperless hp 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
apache/tika:3.3.1.090b7fa1dc018
jackson-databind@2.21.3
2.21.7

Open the chart page →

31,485
eoloplanthttpd-eoloplant0.1.03 of 7See more

eoloplant httpd-eoloplant 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
codeurjc/planner:v1.0800cf520c245
jackson-databind@2.13.0
2.18.11
codeurjc/server:v1.0310bea5b1ee7
jackson-databind@2.13.4.2
2.18.11
codeurjc/toposervice:v1.09fb4c11e6a49
jackson-databind@2.14.1
2.18.11

Open the chart page →

36,714
sys-info-web-env-view-serverhuajuan-helm-charts0.1.11 of 2See more

sys-info-web-env-view-server huajuan-helm-charts 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
huajuan6848/env-view-server:0.0.1-SNAPSHOTa303f3d9f6e0
jackson-databind@2.15.2
2.18.11

Open the chart page →

2,062
nexus3huangchengwu-helm-chart0.1.01 of 1See more

nexus3 huangchengwu-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
sonatype/nexus3:3.53.04bd975493104
jackson-databind@2.14.1
2.18.11

Open the chart page →

4,698
prometheushuangchengwu-helm-chart0.1.02 of 3See more

prometheus huangchengwu-helm-chart 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
apache/skywalking-oap-server:9.2.0133d35d2c263
jackson-databind@2.13.2.2
2.18.11
apache/skywalking-ui:9.2.0295f1dc87d98
jackson-databind@2.13.2.2
2.18.11

Open the chart page →

18,223
skywalking-v1huangchengwu-helm-chart0.1.02 of 4See more

skywalking-v1 huangchengwu-helm-chart 0.1.0

2 of the 4 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
apache/skywalking-oap-server:8.9.1b4ec8c18d079
jackson-databind@2.12.2
2.18.11
apache/skywalking-ui:8.9.180530f0308a5
jackson-databind@2.12.2
2.18.11

Open the chart page →

22,294
mvfi4trustVerified publisher1.1.21 of 1See more

mvf i4trust 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
wistefan/mvf:lateste0887302b2d8
jackson-databind@2.12.1
2.18.11

Open the chart page →

7,661
vcwaltidi4trustVerified publisher0.0.191 of 1See more

vcwaltid i4trust 0.0.19

1 of the 1 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
quay.io/fiware/waltid:1.14.1-SNAPSHOT93889c3d8a34
jackson-databind@2.14.2
2.18.11

Open the chart page →

9,002
ibm-business-automation-insights-devibm-charts3.2.02 of 6See more

ibm-business-automation-insights-dev ibm-charts 3.2.0

2 of the 6 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
ibmcom/bai-elasticsearch-dev:19.0.25441dba2fa00
jackson-databind@2.8.11.2
2.18.11
ibmcom/bai-flink-dev:19.0.2e31ff09e8aad
jackson-databind@2.9.8
2.18.11

Open the chart page →

40,047
ibm-kerify-devibm-charts1.0.01 of 1See more

ibm-kerify-dev ibm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
ibmcom/icp-sert-bats:3.2.0b558f2b444ae
jackson-databind@2.9.6
2.18.11

Open the chart page →

8,348
ibm-microclimateibm-charts0.1.03 of 8See more

ibm-microclimate ibm-charts 0.1.0

3 of the 8 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
jackson-databind@2.8.8
2.18.11
ibmcom/microclimate-theia:lateste17bdccc5030
jackson-databind@2.8.8
2.18.11
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.7

Open the chart page →

119,588
ibm-ws-dyn-agent-devibm-charts1.0.01 of 1See more

ibm-ws-dyn-agent-dev ibm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
ibmcom/ibm-workload-scheduler-agent-dynamic-dev:9.4.0.047e4dc1e27cdf
jackson-databind@2.9.4
2.18.11

Open the chart page →

19,680
ibm-events-operatoribm-helm6.0.0+20260126.110734.01 of 1See more

ibm-events-operator ibm-helm 6.0.0+20260126.110734.0

1 of the 1 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:latest39cae00160b3
jackson-databind@2.22.2
2.22.3

Open the chart page →

99
tolgeeicoretechVerified publisher0.49.91 of 3See more

tolgee icoretech 0.49.9

1 of the 3 container images this version deploys carry CVE-2026-91776.

Container imageDigestPackageFixed in
tolgee/tolgee:v3.224.11170242202255
jackson-databind@3.1.6
3.1.7

Open the chart page →

3,560

Container images carrying it

1,072 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/maximilianopizarro/openshift-integration-operator:v0.8.2d6fc43ac802e
jackson-databind@2.21.4
2.21.7
1
quay.io/maximilianopizarro/showroom-docs-mcp:latest1a6eff92827a
jackson-databind@2.21.2
2.21.7
1
quay.io/maximilianopizarro/workshop-pipelines:lateste383ba3e0966
jackson-databind@2.15.3
2.18.11
1
quay.io/microcks/microcks-operator:0.0.1196d1054d4a61
jackson-databind@2.19.2
2.21.7
1
quay.io/newrelic/synthetics-minion:2.2.2198c26e1b8f70
jackson-databind@2.10.1
2.18.11
1
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
jackson-databind@2.14.1
2.18.11
1
quay.io/opsmxpublic/ubi8-oes-audit-client:isd-spin-2025.10.01-cb1bfce-20251126103732a5b1887eab
jackson-databind@2.15.3
2.18.11
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
jackson-databind@2.15.3
2.18.11
1
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
jackson-databind@2.15.3
2.18.11
1
quay.io/poundex/tekton-ci-environment-injector:0.2.46dd65f22949c
jackson-databind@2.21.4
2.21.7
1
quay.io/poundex/tekton-stash-and-cache:0.2.2e854423caa09
jackson-databind@2.21.4
2.21.7
1
quay.io/seamware/consent-facade:0.0.14be844c750c7e
jackson-databind@2.17.2
2.18.11
1
quay.io/snowdrop/spring-boot-rest-http-example:2.7b1a054613715
jackson-databind@2.13.5
2.18.11
1
quay.io/srcmaxim/gradle-example-app:1.1.37c3fc28746ef
jackson-databind@2.12.3
2.18.11
1
quay.io/sshaaf/keycloak-mcp-server:0.4.0b7e9cba72f8a
jackson-databind@2.22.0
2.22.3
1
quay.io/streamshub/console-operator:0.11.0e40bbfeae125
jackson-databind@2.19.2
2.21.7
1
quay.io/strimzi/operator:latest39cae00160b3
jackson-databind@2.22.2
2.22.3
1
quay.io/strimzi/operator:0.45.158c727cd2e68
jackson-databind@2.16.2
2.18.11
1
quay.io/strimzi/operator:0.32.0c5e0e5dca750
jackson-databind@2.13.4.1
2.18.11
1
quay.io/strimzi/operator:0.36.1e9e03b31007c
jackson-databind@2.14.2
2.18.11
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
jackson-databind@2.17.2
2.18.11
1
registry.gitlab.com/dyff/workflows-aggregator:0.16.1126450354eba9
jackson-databind@2.13.5
2.18.11
1

syft 1.42.1 · advisories as of 3 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.