StackRadar

CVE-2026-91991

Medium

Advisory

Published 1 Sept 2026In the index since 16 Sept 2026
Severity
Medium
worst across findings
CVSS
5.4
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
22
of 17,790 indexed, latest versions
Container images
21
deployed by those charts
Fix available
1 of 2
affected packages

Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`

Carried by container images the latest versions of 22 of 17,790 indexed charts deploy, on 21 images.

Affected packageAffected versionsFixed inImages
python-tornadodeb6.2.0-3+deb12u1no fix listed1
tornadopypi6.5.5, 6.5.6, 6.5.76.5.820
OSV records
DEBIAN-CVE-2026-91991GHSA-wwv5-g3v4-889x

Charts affected

22 by stars
ChartLatestAffected imagesRadar Score
baserowbaserow-chartVerified publisher1.0.561 of 6See more

baserow baserow-chart 1.0.56

1 of the 6 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
baserow/backend:2.3.37c00549b3a6f
tornado@6.5.7
6.5.8

Open the chart page →

17,413
matrixzekker6Verified publisher3.30.01 of 4See more

matrix zekker6 3.30.0

1 of the 4 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.160.078de1d10bef0
tornado@6.5.7
6.5.8

Open the chart page →

5,579
calibre-webk8s-home-lab-repo9.1.11 of 1See more

calibre-web k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
tornado@6.5.7
6.5.8

Open the chart page →

4,526
wgerwgerOfficialVerified publisher1.0.01 of 8See more

wger wger 1.0.0

1 of the 8 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
wger/server:2.6997ead43aabd
tornado@6.5.7
6.5.8

Open the chart page →

8,634
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
tornado@6.5.7
6.5.8

Open the chart page →

5,971
jupyterhub-outpostjupyter-jscVerified publisher2.4.11 of 1See more

jupyterhub-outpost jupyter-jsc 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
tornado@6.5.5
6.5.8

Open the chart page →

1,679
palworldpalworld-server-chartVerified publisher2.7.11 of 1See more

palworld palworld-server-chart 2.7.1

1 of the 1 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
thijsvanloef/palworld-server-docker:v2.7.1401d3eb5c053
tornado@6.5.5
6.5.8

Open the chart page →

3,715
litellmalareira0.3.01 of 1See more

litellm alareira 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm:main-stablec8756e7b9a61
tornado@6.5.7
6.5.8

Open the chart page →

83
galaxycloudve6.8.61 of 3See more

galaxy cloudve 6.8.6

1 of the 3 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
tornado@6.5.5
6.5.8

Open the chart page →

5,603
codehubcodehubVerified publisher6.2.181 of 5See more

codehub codehub 6.2.18

1 of the 5 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
jupyterhub/jupyterhub:5.4.63974ba945e65
tornado@6.5.6
6.5.8

Open the chart page →

13,312
datagrokdatagrok1.0.31 of 7See more

datagrok datagrok 1.0.3

1 of the 7 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
datagrok/grok_spawner:latest8c2d48c1545c
tornado@6.5.7
6.5.8

Open the chart page →

2,371
mopidygeek-cookbookVerified publisher0.1.21 of 1See more

mopidy geek-cookbook 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
jaedb/iris:latest048cfbf58d57
python-tornado@6.2.0-3+deb12u1
no fix listed

Open the chart page →

13,077
helixhelix1.4.31 of 2See more

helix helix 1.4.3

1 of the 2 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
tornado@6.5.5
6.5.8

Open the chart page →

5,586
jupyterhubhelmforgeVerified publisher1.0.61 of 3See more

jupyterhub helmforge 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
tornado@6.5.5
6.5.8

Open the chart page →

5,361
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
tornado@6.5.5
6.5.8

Open the chart page →

17,966
esphomejeffrescVerified publisher0.2.21 of 1See more

esphome jeffresc 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.4.078a82d810709
tornado@6.5.5
6.5.8

Open the chart page →

5,103
palworld-serverk8s-chartsVerified publisher1.2.11 of 1See more

palworld-server k8s-charts 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
thijsvanloef/palworld-server-docker:v2.5.0b4ac9ee22483
tornado@6.5.5
6.5.8

Open the chart page →

3,493
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
onyxdotapp/onyx-backend:latest473fdffe4e67
tornado@6.5.7
6.5.8

Open the chart page →

6,392
safe-stacksafe-global0.1.01 of 9See more

safe-stack safe-global 0.1.0

1 of the 9 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
safeglobal/safe-transaction-service:latest80db836cc5d5
tornado@6.5.7
6.5.8

Open the chart page →

19,707
safe-transaction-servicesafe-global0.1.01 of 6See more

safe-transaction-service safe-global 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
safeglobal/safe-transaction-service:latest80db836cc5d5
tornado@6.5.7
6.5.8

Open the chart page →

16,739
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
tornado@6.5.5
6.5.8

Open the chart page →

5,242
backendsignalen4.24.01 of 4See more

backend signalen 4.24.0

1 of the 4 container images this version deploys carry CVE-2026-91991.

Container imageDigestPackageFixed in
signalen/backend:2.50.14760256000738
tornado@6.5.7
6.5.8

Open the chart page →

11,711

Container images carrying it

21 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
safeglobal/safe-transaction-service:latest80db836cc5d5
tornado@6.5.7
6.5.8
2
baserow/backend:2.3.37c00549b3a6f
tornado@6.5.7
6.5.8
1
datagrok/grok_spawner:latest8c2d48c1545c
tornado@6.5.7
6.5.8
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
tornado@6.5.5
6.5.8
1
jaedb/iris:latest048cfbf58d57
python-tornado@6.2.0-3+deb12u1
no fix listed
1
jupyterhub/jupyterhub:5.4.63974ba945e65
tornado@6.5.6
6.5.8
1
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
tornado@6.5.5
6.5.8
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
tornado@6.5.5
6.5.8
1
matrixdotorg/synapse:v1.160.078de1d10bef0
tornado@6.5.7
6.5.8
1
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
tornado@6.5.7
6.5.8
1
onyxdotapp/onyx-backend:latest473fdffe4e67
tornado@6.5.7
6.5.8
1
signalen/backend:2.50.14760256000738
tornado@6.5.7
6.5.8
1
thijsvanloef/palworld-server-docker:v2.7.1401d3eb5c053
tornado@6.5.5
6.5.8
1
thijsvanloef/palworld-server-docker:v2.5.0b4ac9ee22483
tornado@6.5.5
6.5.8
1
wger/server:2.6997ead43aabd
tornado@6.5.7
6.5.8
1
ghcr.io/berriai/litellm:main-stablec8756e7b9a61
tornado@6.5.7
6.5.8
1
ghcr.io/esphome/esphome:2026.4.078a82d810709
tornado@6.5.5
6.5.8
1
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
tornado@6.5.7
6.5.8
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
tornado@6.5.5
6.5.8
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
tornado@6.5.5
6.5.8
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
tornado@6.5.5
6.5.8
1

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.