StackRadarChart IndexLive demo

GHSA-pxh4-856f-4h89

High

Advisory

Published 22 Oct 2026In the index since 23 Oct 2026

Severity: High; worst across findings
CVSS: 7.4; base score, highest
EPSS: —; probability of exploitation
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 326; of 18,232 indexed, latest versions
Container images: 338; deployed by those charts
Fix available: 1 of 1; affected package

PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery

Carried by container images the latest versions of 326 of 18,232 indexed charts deploy, on 338 images.

Affected package	Affected versions	Fixed in	Images
pyjwtpypi	1.4.2, 1.5.3, 1.6.1, 1.6.4+17 more	2.14.0	338

OSV records: GHSA-pxh4-856f-4h89

Charts affected

326 by stars

Chart

Latest

Affected images

Radar Score

mariadb-initsmo-helm-chart

1 of 2 See more

mariadb-init smo-helm-chart 6.0.0

1 of the 2 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
oomk8s/readiness-check :2.0.2	875814cc853d	pyjwt@1.7.1	2.14.0

Open the chart page →

78,513

sdcsmo-helm-chart

1 of 14 See more

sdc smo-helm-chart 6.0.0

1 of the 14 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
oomk8s/readiness-check :2.0.2	875814cc853d	pyjwt@1.7.1	2.14.0

Open the chart page →

79,541

sdnc-ansible-serversmo-helm-chart

1 of 3 See more

sdnc-ansible-server smo-helm-chart 6.0.0

1 of the 3 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
oomk8s/readiness-check :2.0.2	875814cc853d	pyjwt@1.7.1	2.14.0

Open the chart page →

79,541

sdnc-portalsmo-helm-chart

1 of 3 See more

sdnc-portal smo-helm-chart 6.0.0

1 of the 3 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
oomk8s/readiness-check :2.0.2	875814cc853d	pyjwt@1.7.1	2.14.0

Open the chart page →

79,541

sdnc-promsmo-helm-chart

1 of 2 See more

sdnc-prom smo-helm-chart 6.0.0

1 of the 2 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
oomk8s/readiness-check :2.0.2	875814cc853d	pyjwt@1.7.1	2.14.0

Open the chart page →

78,513

sdnc-websmo-helm-chart

1 of 3 See more

sdnc-web smo-helm-chart 6.0.0

1 of the 3 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
oomk8s/readiness-check :2.0.2	875814cc853d	pyjwt@1.7.1	2.14.0

Open the chart page →

78,513

ueb-listenersmo-helm-chart

1 of 3 See more

ueb-listener smo-helm-chart 6.0.0

1 of the 3 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
oomk8s/readiness-check :2.0.2	875814cc853d	pyjwt@1.7.1	2.14.0

Open the chart page →

79,541

smtpsmtp

1 of 1 See more

smtp smtp 1.3.3

1 of the 1 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
registry.gitlab.com/xrow-public/helm-smtp/postfix :1.3.3	7eea4f0883dd	pyjwt@2.10.1	2.14.0

Open the chart page →

2,010

srebotsrebot

1 of 2 See more

srebot srebot 0.14.0

1 of the 2 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
ghcr.io/shadrus/srebot :0.14.0	9b4415e937b2	pyjwt@2.11.0	2.14.0

Open the chart page →

1,876

servicexssl-hep

1 of 16 See more

servicex ssl-hep 1.8.6

1 of the 16 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
sslhep/servicex_app :v1.8.6	c935e123030d	pyjwt@2.13.0	2.14.0

Open the chart page →

67,074

artifactory-cleanupsubshell

1 of 1 See more

artifactory-cleanup subshell 1.0.1

1 of the 1 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
devopshq/artifactory-cleanup :1.0.18	30e093bffa91	pyjwt@2.10.1	2.14.0

Open the chart page →

2,881

substra-backendsubstra

1 of 7 See more

substra-backend substra 26.15.3

1 of the 7 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
ghcr.io/substra/substra-backend :1.0.1	21967f54ec86	pyjwt@2.9.0	2.14.0

Open the chart page →

5,346

uptime-kumasupporttools

1 of 3 See more

uptime-kuma supporttools 2.6.0

1 of the 3 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
supporttools/uptime-kuma :v2.6	f8a49ed65809	pyjwt@1.7.0	2.14.0

Open the chart page →

5,500

tarkatarka

1 of 4 See more

tarka tarka 0.4.1

1 of the 4 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
ghcr.io/tarkyaio/tarka :0.4.1	e8d3f1512f06	pyjwt@2.12.1	2.14.0

Open the chart page →

4,178

the0the0

1 of 9 See more

the0 the0 0.15.1

1 of the 9 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
ghcr.io/alexanderwanyoike/the0/runtime :1.20.1	05ea40f8bc15	pyjwt@2.7.0	2.14.0

Open the chart page →

7,411

jupyterhubuninettsigma2

1 of 5 See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
quay.io/nird-toolkit/jupyterhub-server :20221215-e6aa80e	cae8c0622533	pyjwt@2.4.0	2.14.0

Open the chart page →

10,140

nemo-guardrailsupstreamyard

1 of 1 See more

nemo-guardrails upstreamyard 0.1.1

1 of the 1 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
upstreamyard/nemo-guardrails :0.24.1	9f673183cfc0	pyjwt@2.13.0	2.14.0

Open the chart page →

1,867

uptime-platformuptime-platform

1 of 3 See more

uptime-platform uptime-platform 0.1.3

1 of the 3 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
sashastudent/uptime-platform :latest	37a82b4e598e	pyjwt@2.13.0	2.14.0

Open the chart page →

971

vaultwardenvaultwarden-helm

1 of 2 See more

vaultwarden vaultwarden-helm 1.2.7

1 of the 2 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
ghcr.io/cloudnative-pg/postgresql :18.4-system-trixie	42708a75345b	pyjwt@2.13.0	2.14.0

Open the chart page →

2,302

simple-prima-notavcnngr

1 of 4 See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
dpage/pgadmin4 :9.2	52cb72a9e3da	pyjwt@2.10.1	2.14.0

Open the chart page →

6,890

browserlessvictorlane

1 of 1 See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	pyjwt@2.7.0	2.14.0

Open the chart page →

5,414

twenty-crmvictorlane

1 of 3 See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	pyjwt@2.3.0	2.14.0

Open the chart page →

72,635

wazuhwazuh-helm-eks

1 of 6 See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
wazuh/wazuh-manager :4.14.4	5a065930682d	pyjwt@2.10.1	2.14.0

Open the chart page →

7,539

supersetwbstack

1 of 1 See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
apache/superset :4.0.1	ab9467fd712c	pyjwt@2.4.0	2.14.0

Open the chart page →

78,312

juicefs-csi-driverwener

1 of 5 See more

juicefs-csi-driver wener 0.33.1

1 of the 5 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.33.1	103ac60b6b9c	pyjwt@2.6.0	2.14.0

Open the chart page →

33,783

juicefs-csi-driverwenerme

1 of 5 See more

juicefs-csi-driver wenerme 0.33.1

1 of the 5 container images this version deploys carry GHSA-pxh4-856f-4h89.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.33.1	103ac60b6b9c	pyjwt@2.6.0	2.14.0

Open the chart page →

33,783

Container images carrying it

338 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/paperless-ngx/paperless-ngx :2.13.1	0642357c5dbd	pyjwt@2.9.0	2.14.0	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.13	4b05bcd28e69	pyjwt@2.10.1	2.14.0	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.3	57ad9565bff3	pyjwt@2.10.1	2.14.0	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.5	665f2f5cc548	pyjwt@2.10.1	2.14.0	1
ghcr.io/paperless-ngx/paperless-ngx :2.10.1	a132c2ac7c57	pyjwt@2.8.0	2.14.0	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.14	b89f83345532	pyjwt@2.10.1	2.14.0	1
ghcr.io/porelli/firefox-sync :syncstorage-rs-mysql-0.18.2	7d244e514216	pyjwt@2.10.1	2.14.0	1
ghcr.io/qubiva/qubiva :v0.3.2	cdf1e3329bfe	pyjwt@2.13.0	2.14.0	1
ghcr.io/runwhen-contrib/runwhen-local :0.12.4	914e75d9f445	pyjwt@2.13.0	2.14.0	1
ghcr.io/securo-finance/securo-backend :0.16.5	0e40c6858fb3	pyjwt@2.13.0	2.14.0	1
ghcr.io/shadrus/srebot :0.14.0	9b4415e937b2	pyjwt@2.11.0	2.14.0	1
ghcr.io/sissbruecker/linkding :1.45.0	61b2eb9eed8e	pyjwt@2.10.1	2.14.0	1
ghcr.io/substra/substra-backend :1.0.1	21967f54ec86	pyjwt@2.9.0	2.14.0	1
ghcr.io/tandoorrecipes/recipes :1.5.31	063eb446e298	pyjwt@2.10.1	2.14.0	1
ghcr.io/tarkyaio/tarka :0.4.1	e8d3f1512f06	pyjwt@2.12.1	2.14.0	1
ghcr.io/tauffer-consulting/domino-rest :latest	8bf880fe8c73	pyjwt@2.4.0	2.14.0	1
ghcr.io/unique-ag/ai/search-proxy :2026.42.3	2f87faa4af66	pyjwt@2.13.0	2.14.0	1
ghcr.io/vinny1892/octantis :latest	45459c0910fc	pyjwt@2.12.1	2.14.0	1
ghcr.io/wizarrrr/wizarr :4.2.0-beta.3	d19d886d5090	pyjwt@2.8.0	2.14.0	1
public.ecr.aws/datadog/agent :7.73.0	f4925b15ce94	pyjwt@2.10.1	2.14.0	1
public.ecr.aws/outerbounds/metaflow_metadata_service :v2.4.13	f7567ce3419d	pyjwt@2.9.0	2.14.0	1
quay.io/cephcsi/cephcsi :v3.5.1	28a674af1df2	pyjwt@1.6.1	2.14.0	1
quay.io/cloudnativetoolkit/cli-tools :v1.1-v1.8.2	d6fd2a9e3273	pyjwt@2.4.0	2.14.0	1
quay.io/galaxyproject/galaxy-min :26.1.1	2c324c9789f5	pyjwt@2.12.1	2.14.0	1
quay.io/hewlettpackardenterprise/squest :2.8.4	65694109877e	pyjwt@2.10.1	2.14.0	1
quay.io/ibmgaragecloud/cli-tools :v0.15	9663f06adcb1	pyjwt@2.3.0	2.14.0	1
quay.io/jupyterhub/k8s-hub :4.3.5	113e372cf71b	pyjwt@2.12.1	2.14.0	1
quay.io/jupyterhub/k8s-hub :3.2.1	2528c6e57587	pyjwt@2.8.0	2.14.0	1
quay.io/jupyterhub/k8s-hub :4.3.4	92f883d09270	pyjwt@2.12.1	2.14.0	1
quay.io/k3rnel-pan1c/uptime-kuma :1.19.3	f975fde9329b	pyjwt@1.7.1	2.14.0	1
quay.io/medik8s/fence-agents-remediation-operator :v0.8.0	fab0089a9d65	pyjwt@2.13.0	2.14.0	1
quay.io/nird-toolkit/jupyterhub-server :20221215-e6aa80e	cae8c0622533	pyjwt@2.4.0	2.14.0	1
quay.io/ortelius/ms-validate-user :main-v10.0.1694-g98ed94	b5054bd4e97a	pyjwt@2.10.1	2.14.0	1
quay.io/stackgres/operator :1.19.3	7fdfd631a281	pyjwt@2.8.0	2.14.0	1
registry.gitlab.com/crafty-controller/crafty-4 :latest	7b6e87514259	pyjwt@2.8.0	2.14.0	1
registry.gitlab.com/open-forms/forms-catalogue :latest	4eaf9c911f33	pyjwt@1.7.1	2.14.0	1
registry.gitlab.com/open-forms/request-registry :latest	0886cbbc5f95	pyjwt@1.7.1	2.14.0	1
registry.gitlab.com/xrow-public/helm-smtp/postfix :1.3.3	7eea4f0883dd	pyjwt@2.10.1	2.14.0	1