{"schema_version":"1.7.5","id":"CGA-2xv8-pf5x-hq9x","published":"2026-01-19T17:03:42.434433Z","modified":"2026-09-07T02:02:29.333081025Z","withdrawn":"2026-09-07T02:02:29.333080847Z","related":["CVE-2026-23490","GHSA-63vm-454h-vhhq"],"affected":[{"package":{"name":"airflow-2","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/airflow-2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.0-r24"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"airflow-3","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/airflow-3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-r2"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"ansible-operator","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/ansible-operator"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.42.0-r6"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"ansible-operator-fips","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/ansible-operator-fips"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.42.0-r4"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"apache-beam-python-3.11-sdk","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/apache-beam-python-3.11-sdk"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.71.0-r0"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"authentik","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/authentik"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.10.3-r5"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"authentik-fips","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/authentik-fips"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.10.3-r2"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"barman-cloudnative-pg","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/barman-cloudnative-pg"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.0-r1"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"dask-kubernetes","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/dask-kubernetes"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.7.0-r6"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"gitlab-toolbox-ce-18.6","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/gitlab-toolbox-ce-18.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6.4-r0"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"gitlab-toolbox-ce-18.7","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/gitlab-toolbox-ce-18.7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.7.2-r0"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"gitlab-toolbox-ce-fips-18.6","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/gitlab-toolbox-ce-fips-18.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6.4-r0"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"gitlab-toolbox-ce-fips-18.7","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/gitlab-toolbox-ce-fips-18.7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.7.2-r0"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"k8s-sidecar","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/k8s-sidecar"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-r0"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"katib-earlystopping","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/katib-earlystopping"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-r4"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"kserve-storage-controller","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/kserve-storage-controller"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0-r9"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"kubeflow-jupyter-web-app","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/kubeflow-jupyter-web-app"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-r10"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"kubeflow-pipelines-apiserver","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/kubeflow-pipelines-apiserver"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-r9"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"kubeflow-pipelines-visualization-server","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/kubeflow-pipelines-visualization-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-r4"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"kubeflow-volumes-web-app","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/kubeflow-volumes-web-app"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-r9"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"label-studio","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/label-studio"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-r2"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"litellm","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/litellm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.80.15.0-r1"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"localstack","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/localstack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.0-r4"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"metaflow-service","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/metaflow-service"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-r3"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"mlflow","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/mlflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1-r3"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"mlflow-iamguarded-compat","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/mlflow-iamguarded-compat"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1-r3"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"open-webui","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/open-webui"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2-r1"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"pgadmin4","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/pgadmin4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.11-r2"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"py3-cassandra-medusa","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/py3-cassandra-medusa"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.0-r2"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"py3.10-duplicity","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/py3.10-duplicity"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-r2"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"py3.11-duplicity","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/py3.11-duplicity"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-r2"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"py3.12-duplicity","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/py3.12-duplicity"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-r2"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"py3.13-duplicity","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/py3.13-duplicity"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-r2"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"request-1276","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/request-1276"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.0-r3"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"spamcheck","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/spamcheck"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-r6"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"superset-5.0","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/superset-5.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-r13"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"airflow-3","ecosystem":"Wolfi","purl":"pkg:apk/wolfi/airflow-3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-r2"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"dask-kubernetes","ecosystem":"Wolfi","purl":"pkg:apk/wolfi/dask-kubernetes"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.7.0-r6"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"k8s-sidecar","ecosystem":"Wolfi","purl":"pkg:apk/wolfi/k8s-sidecar"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-r0"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"katib-earlystopping","ecosystem":"Wolfi","purl":"pkg:apk/wolfi/katib-earlystopping"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-r4"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"kserve-storage-controller","ecosystem":"Wolfi","purl":"pkg:apk/wolfi/kserve-storage-controller"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0-r9"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"kubeflow-jupyter-web-app","ecosystem":"Wolfi","purl":"pkg:apk/wolfi/kubeflow-jupyter-web-app"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-r10"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"kubeflow-pipelines-apiserver","ecosystem":"Wolfi","purl":"pkg:apk/wolfi/kubeflow-pipelines-apiserver"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-r9"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"kubeflow-pipelines-visualization-server","ecosystem":"Wolfi","purl":"pkg:apk/wolfi/kubeflow-pipelines-visualization-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-r4"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"kubeflow-volumes-web-app","ecosystem":"Wolfi","purl":"pkg:apk/wolfi/kubeflow-volumes-web-app"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-r9"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"mlflow","ecosystem":"Wolfi","purl":"pkg:apk/wolfi/mlflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1-r3"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"mlflow-iamguarded-compat","ecosystem":"Wolfi","purl":"pkg:apk/wolfi/mlflow-iamguarded-compat"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1-r3"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"open-webui","ecosystem":"Wolfi","purl":"pkg:apk/wolfi/open-webui"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2-r1"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"py3-cassandra-medusa","ecosystem":"Wolfi","purl":"pkg:apk/wolfi/py3-cassandra-medusa"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.0-r2"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}},{"package":{"name":"superset-5.0","ecosystem":"Wolfi","purl":"pkg:apk/wolfi/superset-5.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-r13"}]}],"database_specific":{"source":"https://packages.cgr.dev/chainguard/osv/CGA-2xv8-pf5x-hq9x.json"}}]}