opensearch-dashboards

Chart · Search · standard · v0.0.3

fijado por digestfirmada con cosignSPDX SBOMprocedencia SLSAamd64 · arm64Reconstruida 2026-10-07

The web UI for OpenSearch, for search, dashboards and visualizations. Ships without the security plugins, matching the opensearch image.

Versión

0.0.3 · última 0.0.2 0.0.1

La línea más reciente vive en la página base; las líneas más antiguas tienen su propia página para que puedas fijar y verificar exactamente esa versión.

Digest de imagen desplegado

sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38

Versión OCI del chart

oci://ghcr.io/quenchworks/charts/opensearch-dashboards:0.0.3

El chart fija su imagen por este digest firmado, así que nunca tienes que rastrearlo tú mismo. Las firmas, el SBOM y la procedencia se adjuntan al mismo digest.

Firmada

cosign sin llave

SBOM

SPDX, en la imagen

Procedencia

compilación SLSA

Arquitecturas

amd64, arm64

Se ejecuta como

nonroot (uid 1001)

Sistema de archivos raíz

solo lectura

Tamaño de la imagen

394.0 MB

Informe de seguridad (Trivy)

F· 0/10061 fixable · rebuild clears them

Detalle de vulnerabilidades

opensearch-dashboards 3.8.0 · 44 CVE

CVE	Gravedad	Paquete	Instalada	Corregida en	Título
CVE-2026-106445	CRITICAL	handlebars	4.7.9	4.7.10	handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass
CVE-2026-106446	CRITICAL	handlebars	4.7.9	4.7.10	handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)
CVE-2026-111497	CRITICAL	libbrotlicommon1	1.2.0-r5	1.2.0-r7	brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-111497	CRITICAL	libbrotlidec1	1.2.0-r5	1.2.0-r7	brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-111497	CRITICAL	libbrotlienc1	1.2.0-r5	1.2.0-r7	brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-91403	CRITICAL	ca-certificates-bundle	20260909-r2	20260909-r3	OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns
GHSA-cg2g-xh64-v4q7	CRITICAL	dompurify	3.4.16	3.4.17	DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
CVE-2026-105482	HIGH	nodejs-22	22.23.2-r1	22.23.4-r0	nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character
CVE-2026-106069	HIGH	nodejs-22	22.23.2-r1	22.23.4-r0	nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames
CVE-2026-111755	HIGH	follow-redirects	1.16.0	1.16.1	follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering
CVE-2026-111756	HIGH	follow-redirects	1.16.0	1.16.1	follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects
CVE-2026-111943	HIGH	ca-certificates-bundle	20260909-r2	20260909-r3	crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates
CVE-2026-116689	HIGH	follow-redirects	1.16.0	1.16.2	follow-redirects: follow-redirects: Information disclosure via cross-origin redirects
CVE-2026-118664	HIGH	decode-uri-component	0.5.0	0.5.1	decode-uri-component: decode-uri-component: Denial of Service via malformed percent-encoded input
CVE-2026-118772	HIGH	joi	18.2.9	17.13.9, 18.3.1	joi: joi: Denial of Service via inefficient regular expression in email validation
CVE-2026-118779	HIGH	node-forge	1.4.0	1.4.1	Forge (also called node-forge) is a native implementation of Transport ...
CVE-2026-118782	HIGH	node-forge	1.4.0	1.4.1	Forge (also called node-forge) is a native implementation of Transport ...
CVE-2026-119187	HIGH	node-forge	1.4.0	1.4.1	node-forge: node-forge: Denial of Service via call stack exhaustion in TLS record processing
CVE-2026-119188	HIGH	node-forge	1.4.0	1.4.1	node-forge: node-forge: Denial of Service via interleaved record during fragmented TLS handshake
CVE-2026-119190	HIGH	node-forge	1.4.0	1.4.1	Forge (also called node-forge) is a native implementation of Transport ...
CVE-2026-119202	HIGH	@hapi/content	6.0.2	6.0.3	@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service
GHSA-mrv2-3pqr-j5jr	HIGH	dompurify	3.4.16	3.4.17	DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
CVE-2026-85393	HIGH	node-forge	1.4.0	— sin corrección	node-forge: node-forge: Signature forgery vulnerability in RSA PKCS#1 v1.5 verification
CVE-2026-105481	MEDIUM	nodejs-22	22.23.2-r1	22.23.4-r0	nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse
CVE-2026-106072	MEDIUM	nodejs-22	22.23.2-r1	22.23.4-r0	nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification
CVE-2026-106074	MEDIUM	nodejs-22	22.23.2-r1	22.23.4-r0	nodejs: nodejs: predictable random values via snapshot entropy cache reuse
CVE-2026-106444	MEDIUM	handlebars	4.7.9	4.7.10	handlebars: Handlebars: Cross-Site Scripting via unescaped closing script tags in precompiled templates
CVE-2026-110180	MEDIUM	fast-uri	3.1.8	2.4.8, 3.1.9, 4.2.3	fast-uri: fast-uri: Security policy bypass via improper host canonicalization
CVE-2026-110306	MEDIUM	fast-uri	3.1.8	2.4.8, 3.1.9, 4.2.3	fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding
CVE-2026-111997	MEDIUM	ip-address	10.7.1	10.7.4	ip-address: ip-address: Denial of Service via excessive percent characters in IPv6 address input
CVE-2026-118764	MEDIUM	minimatch	10.2.5	11.0.1	minimatch: minimatch: Denial of Service via crafted glob pattern expansion
CVE-2026-118764	MEDIUM	minimatch	3.1.5	11.0.1	minimatch: minimatch: Denial of Service via crafted glob pattern expansion
CVE-2026-118773	MEDIUM	glob	11.1.0	14.0.2	glob: glob: Denial of Service (DoS) via incomplete traversal cancellation
CVE-2026-118777	MEDIUM	node-forge	1.4.0	1.4.1	Forge (also called node-forge) is a native implementation of Transport ...
CVE-2026-118778	MEDIUM	node-forge	1.4.0	1.4.1	node-forge: node-forge: Denial of Service via missing TLS server certificate
CVE-2026-119186	MEDIUM	node-forge	1.4.0	1.4.1	Forge (also called node-forge) is a native implementation of Transport ...
CVE-2026-106073	LOW	nodejs-22	22.23.2-r1	22.23.4-r0	nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()
CVE-2026-110095	LOW	fast-uri	3.1.8	2.4.8, 3.1.9, 4.2.3	fast-uri: fast-uri: Path traversal via improper relative URI normalization
CVE-2026-110725	LOW	fast-uri	3.1.8	2.4.8, 3.1.9, 4.2.3	fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths
CVE-2026-115897	LOW	serialize-javascript	7.0.5	7.1.3	serialize-javascript: serialize-javascript: Cross-Site Scripting via improper function escaping
CVE-2026-118775	LOW	node-forge	1.4.0	1.4.1	Forge (also called node-forge) is a native implementation of Transport ...
CVE-2026-118780	LOW	node-forge	1.4.0	1.4.1	Forge (also called node-forge) is a native implementation of Transport ...
CVE-2026-118781	LOW	node-forge	1.4.0	1.4.1	Forge (also called node-forge) is a native implementation of Transport ...
GHSA-c6gr-qvv4-5v3f	LOW	dompurify	3.4.16	3.4.17	DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

Crítica

Alta

Media

Baja

Desconocida

Informe de seguridad (Trivy) · image opensearch-dashboards 3.8.0

Instala el chart

Despliega en Kubernetes con valores predeterminados reforzados. El chart fija su imagen por digest firmado, así que nunca tienes que rastrearlo tú mismo.

Instalar (última)

helm install my-opensearch-dashboards oci://ghcr.io/quenchworks/charts/opensearch-dashboards --version 0.0.3

Despliega la imagen (fijada por digest)

opensearch-dashboards3.8.0
F
ghcr.io/quenchworks/images/opensearch-dashboards@sha256:fe8e7e8565296ddd38037ff9c31590fe5901b70cf3b257d5a14ea9552a4edd38

Versión del chart: 0.0.3
Versión de la app: 3.8.0
Licencia del chart: Apache-2.0
Licencia de la app: Apache-2.0
Puerto del servicio: 5601
Firmado: cosign (sin llave)
Esquema de valores: sí
Última publicación: 2026-10-07

Claves de valores

image: repository digest pullPolicy
nameOverride
replicaCount
opensearch: hosts
extraConfig
resources: requests limits
service: type port
podLabels
podAnnotations
nodeSelector
affinity
tolerations
topologySpreadConstraints
priorityClassName
schedulerName
terminationGracePeriodSeconds
updateStrategy
extraEnvVars
extraEnvVarsCM
extraEnvVarsSecret
extraVolumes
extraVolumeMounts
initContainers
sidecars
lifecycleHooks
command
args
podSecurityContext
containerSecurityContext
livenessProbe
readinessProbe
customLivenessProbe
customReadinessProbe
customStartupProbe
serviceAccount: create name annotations
rbac: create
networkPolicy: enabled allowExternal opensearchPort
podDisruptionBudget: enabled minAvailable
ingress: enabled className annotations servicePort hosts tls

Verifica el chart

cosign verify ghcr.io/quenchworks/charts/opensearch-dashboards:0.0.3 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Transparencia

El chart publica sus atestaciones en GitHub y la imagen que despliega lleva las suyas en el mismo digest, verificables públicamente con los comandos anteriores. Ambos se registran en el registro de transparencia de Sigstore (Rekor), que cosign verify comprueba por ti.

Ver la imagen Ver en ArtifactHub Código del chart

Proyecto original: https://github.com/opensearch-project/OpenSearch-Dashboards