StackRadar

PYSEC-2026-4298

Critical

Advisory

Published 26 Apr 2024In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
0.003
22nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
46
of 18,137 indexed, latest versions
Container images
51
deployed by those charts
Fix available
1 of 1
affected package

python-jose algorithm confusion guard bypassed by DER-encoded public keys

Carried by container images the latest versions of 46 of 18,137 indexed charts deploy, on 51 images.

Affected packageAffected versionsFixed inImages
python-josepypi3.0.1, 3.1.0, 3.2.0, 3.3.0+2 more3.4.051
OSV records
GHSA-3qf3-8w2g-rqmxPYSEC-2026-4298GHSA-6c5p-j8vq-pqhjPYSEC-2024-232
Also known as
CVE-2024-33663, CVE-2026-85394

Charts affected

46 by stars
ChartLatestAffected imagesRadar Score
home-assistanthelm-hassVerified publisher0.3.861 of 1See more

home-assistant helm-hass 0.3.86

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.1130241f28d01
python-jose@3.5.0
no fix listed

Open the chart page →

2,886
netboxbootcVerified publisher4.1.11 of 4See more

netbox bootc 4.1.1

1 of the 4 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.2.83d652dca5351
python-jose@3.3.0
3.4.0

Open the chart page →

9,882
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
python-jose@3.3.0
3.4.0

Open the chart page →

9,143
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
python-jose@3.3.0
3.4.0

Open the chart page →

7,431
home-assistantalekcVerified publisher2.12.11 of 1See more

home-assistant alekc 2.12.1

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.1130241f28d01
python-jose@3.5.0
no fix listed

Open the chart page →

2,886
home-assistantandrenarchyVerified publisher14.104.01 of 1See more

home-assistant andrenarchy 14.104.0

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
python-jose@3.5.0
no fix listed

Open the chart page →

3,326
dyff-apidyff-apiVerified publisher0.57.151 of 1See more

dyff-api dyff-api 0.57.15

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
registry.gitlab.com/dyff/dyff-api:0.57.1555735b0b7d8c
python-jose@3.5.0
no fix listed

Open the chart page →

1,321
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
python-jose@3.3.0
3.4.0

Open the chart page →

9,424
home-assistanthome-assistantVerified publisher0.5.131 of 3See more

home-assistant home-assistant 0.5.13

1 of the 3 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.01b64d38f38d9
python-jose@3.5.0
no fix listed

Open the chart page →

3,098
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
python-jose@3.5.0
no fix listed

Open the chart page →

5,873
siemassist-iot-cybersecurity-monitroting-siem0.1.01 of 3See more

siem assist-iot-cybersecurity-monitroting-siem 0.1.0

1 of the 3 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_id-wzh:latest0aacefac9677
python-jose@3.1.0
3.4.0

Open the chart page →

12,535
squestchristianhuthVerified publisher7.0.21 of 4See more

squest christianhuth 7.0.2

1 of the 4 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
python-jose@3.4.0
no fix listed

Open the chart page →

5,048
rommcrystalnetVerified publisher0.2.201 of 3See more

romm crystalnet 0.2.20

1 of the 3 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
zurdi15/romm:2.3.12db88fe44c89
python-jose@3.3.0
3.4.0

Open the chart page →

2,053
dyff-orchestratordyff-orchestratorVerified publisher0.22.191 of 1See more

dyff-orchestrator dyff-orchestrator 0.22.19

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
registry.gitlab.com/dyff/dyff-orchestrator:0.22.199bd5d93aaff7
python-jose@3.5.0
no fix listed

Open the chart page →

1,724
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latest3e6710a7ab2a
python-jose@3.5.0
no fix listed

Open the chart page →

3,252
backendikusi-bk-chart1.0.32 of 3See more

backend ikusi-bk-chart 1.0.3

2 of the 3 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
kyovint/kyoimgtransactions:1.0.048c19e3ae9a3
python-jose@3.5.0
no fix listed
kyovint/kyoimgusers:1.0.080084149156e
python-jose@3.5.0
no fix listed

Open the chart page →

6,938
home-assistantloeken-at-homeVerified publisher2026.9.21 of 1See more

home-assistant loeken-at-home 2026.9.2

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
loeken/home-assistant:2026.9.2b1dff5b4c593
python-jose@3.5.0
no fix listed

Open the chart page →

2,136
clowder2ncsaVerified publisher1.9.73 of 12See more

clowder2 ncsa 1.9.7

3 of the 12 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
python-jose@3.3.0
3.4.0
clowder/clowder2-heartbeat:2.0.0-beta.414155326c7b9
python-jose@3.3.0
3.4.0
clowder/clowder2-messages:2.0.0-beta.4bf146f1ca24f
python-jose@3.3.0
3.4.0

Open the chart page →

46,322
home-assistantpree-helm-chartsVerified publisher1.84.01 of 1See more

home-assistant pree-helm-charts 1.84.0

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.1130241f28d01
python-jose@3.5.0
no fix listed

Open the chart page →

2,886
securosecuroVerified publisher0.16.41 of 4See more

securo securo 0.16.4

1 of the 4 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
ghcr.io/securo-finance/securo-backend:0.16.4e26dcb1bbef7
python-jose@3.5.0
no fix listed

Open the chart page →

3,932
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
dserio83/velero-api:0.3.16b3d9115fee2
python-jose@3.4.0
no fix listed

Open the chart page →

13,723
ansible-inspecansible-inspec0.2.171 of 2See more

ansible-inspec ansible-inspec 0.2.17

1 of the 2 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
python-jose@3.5.0
no fix listed

Open the chart page →

6,207
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
assistiot/open_api_backend:1.1.230812ba93555
python-jose@3.3.0
3.4.0

Open the chart page →

93,137
asya-playgroundasya1.1.31 of 1See more

asya-playground asya 1.1.3

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
localstack/localstack:3.19d278167f2b7
python-jose@3.3.0
3.4.0

Open the chart page →

10,991
ekorrecamptocamp30.1.11 of 1See more

ekorre camptocamp3 0.1.1

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
camptocamp/ekorre:0.1.035c91d5fda04
python-jose@3.1.0
3.4.0

Open the chart page →

5,536
csghubcsghubVerified publisher2.6.01 of 35See more

csghub csghub 2.6.0

1 of the 35 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
python-jose@3.5.0
no fix listed

Open the chart page →

67,811
wazuhcsic-charts0.1.01 of 4See more

wazuh csic-charts 0.1.0

1 of the 4 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.4.121994f40e0da
python-jose@3.1.0
3.4.0

Open the chart page →

16,221
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
python-jose@3.3.0
3.4.0

Open the chart page →

7,570
datacubedatacube-charts0.18.21 of 1See more

datacube datacube-charts 0.18.2

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
opendatacube/wms:latest1b90cdf68831
python-jose@3.0.1
3.4.0

Open the chart page →

97,463
restcubedatacube-charts0.2.91 of 1See more

restcube datacube-charts 0.2.9

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
opendatacube/restcube:latest91870111837c
python-jose@3.0.1
3.4.0

Open the chart page →

93,996
home-assistantegebackVerified publisher2.0.361 of 1See more

home-assistant egeback 2.0.36

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.8.314931c6b1375
python-jose@3.5.0
no fix listed

Open the chart page →

3,368
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
python-jose@3.3.0
3.4.0

Open the chart page →

5,724
medikeephelmforgeVerified publisher2.0.21 of 3See more

medikeep helmforge 2.0.2

1 of the 3 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
ghcr.io/afairgiant/medikeep:v0.71.0086579173033
python-jose@3.5.0
no fix listed

Open the chart page →

6,654
homeassistanthomeenterpriseinc0.3.01 of 1See more

homeassistant homeenterpriseinc 0.3.0

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2022.3.5565751f33794
python-jose@3.3.0
3.4.0

Open the chart page →

9,136
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
python-jose@3.3.0
3.4.0

Open the chart page →

7,839
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
python-jose@3.5.0
no fix listed

Open the chart page →

3,621
nubladolsst-sqre0.9.233 of 5See more

nublado lsst-sqre 0.9.23

3 of the 5 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
lsstsqre/prepuller:latest19c2dfc4e4ff
python-jose@3.2.0
3.4.0
lsstsqre/sciplat-hub:latest5e0ade6bed1c
python-jose@3.2.0
3.4.0
lsstsqre/wfdispatcher:lateste9feb99f524d
python-jose@3.2.0
3.4.0

Open the chart page →

6,548
mockoidcoidcmockVerified publisher0.0.11 of 1See more

mockoidc oidcmock 0.0.1

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
marcoimme/oidcmock:latestb6035c0721a8
python-jose@3.3.0
3.4.0

Open the chart page →

2,766
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.03 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

3 of the 40 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
ghcr.io/openrelik/openrelik-mediator:latest50ea049b2836
python-jose@3.5.0
no fix listed
ghcr.io/openrelik/openrelik-metrics:latest3d0f1ddeebf5
python-jose@3.5.0
no fix listed
ghcr.io/openrelik/openrelik-server:latestee689861c980
python-jose@3.5.0
no fix listed

Open the chart page →

242,362
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
python-jose@3.5.0
no fix listed

Open the chart page →

6,048
prompt-dbprompt-dbVerified publisher1.0.71 of 3See more

prompt-db prompt-db 1.0.7

1 of the 3 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
ghcr.io/erlkoenig91/prompt-db-backend:1.0.7ab120359810d
python-jose@3.3.0
3.4.0

Open the chart page →

4,184
kresusrm3lVerified publisher0.2.11 of 3See more

kresus rm3l 0.2.1

1 of the 3 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
bnjbvr/kresus:0.22.137e216b182c8
python-jose@3.3.0
3.4.0

Open the chart page →

17,706
weblateslamdev0.0.111 of 2See more

weblate slamdev 0.0.11

1 of the 2 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
weblate/weblate:3.11.3-182848df56ecd
python-jose@3.1.0
3.4.0

Open the chart page →

11,881
home-assistantsmall-hack2.1.01 of 1See more

home-assistant small-hack 2.1.0

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
python-jose@3.5.0
no fix listed

Open the chart page →

5,116
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
python-jose@3.3.0
3.4.0

Open the chart page →

6,733
wazuh-manager-filebeatwazuh-manager-filebeat0.1.0-gamma1 of 1See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry PYSEC-2026-4298.

Container imageDigestPackageFixed in
iosifache/wazuh-manager-filebeat:latest85df3f04b5da
python-jose@3.1.0
3.4.0

Open the chart page →

13,006

Container images carrying it

51 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
registry.gitlab.com/dyff/dyff-orchestrator:0.22.199bd5d93aaff7
python-jose@3.5.0
no fix listed
1

syft 1.42.1 · advisories as of 16 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.