StackRadar

CVE-2026-113726

High

Advisory

Published 20 Oct 2026In the index since 22 Oct 2026
Severity
High
worst across findings
CVSS
7.8
base score, highest
EPSS
0.002
14th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
131
of 18,232 indexed, latest versions
Container images
166
deployed by those charts
Fix available
1 of 2
affected packages

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

Carried by container images the latest versions of 131 of 18,232 indexed charts deploy, on 166 images.

Affected packageAffected versionsFixed inImages
virtualenvpypi1.11.4, 15.1.0, 16.3.0, 16.6.0+58 more21.14.4166
python-virtualenvdeb1.11.4-1ubuntu1, 20.0.17-1ubuntu0.3, 20.17.1+ds-1, 20.25.0+ds-2+1 moreno fix listed9
OSV records
DEBIAN-CVE-2026-113726GHSA-5vjq-rrrf-7h2qUBUNTU-CVE-2026-113726

Charts affected

131 by stars
ChartLatestAffected imagesRadar Score
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
virtualenv@20.25.1
21.14.4

Open the chart page →

13,251
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
allegroai/clearml:2.0.0-613713ae38f7daf
virtualenv@20.28.0
21.14.4

Open the chart page →

73,887
kube-downscalerdeliveryheroVerified publisher0.7.61 of 1See more

kube-downscaler deliveryhero 0.7.6

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
virtualenv@20.23.1
21.14.4

Open the chart page →

88,638
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
virtualenv@20.14.1
21.14.4

Open the chart page →

9,736
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
virtualenv@20.32.0
21.14.4

Open the chart page →

61,045
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
virtualenv@20.25.0
21.14.4

Open the chart page →

8,090
stackstorm-hastackstormVerified publisher1.1.011 of 17See more

stackstorm-ha stackstorm 1.1.0

11 of the 17 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
stackstorm/st2actionrunner:3.888235ba70cad
virtualenv@20.4.0
21.14.4
stackstorm/st2api:3.86f56d239d280
virtualenv@20.4.0
21.14.4
stackstorm/st2auth:3.833ecfda16608
virtualenv@20.4.0
21.14.4
stackstorm/st2garbagecollector:3.84e3f8c7ca52d
virtualenv@20.4.0
21.14.4
stackstorm/st2notifier:3.8f190a6212195
virtualenv@20.4.0
21.14.4
stackstorm/st2rulesengine:3.8259503496ff9
virtualenv@20.4.0
21.14.4
stackstorm/st2scheduler:3.8b1de2055c362
virtualenv@20.4.0
21.14.4
stackstorm/st2sensorcontainer:3.8b1a338f64773
virtualenv@20.4.0
21.14.4
stackstorm/st2stream:3.81c8904a3bf67
virtualenv@20.4.0
21.14.4
stackstorm/st2timersengine:3.81bf35bfaf00c
virtualenv@20.4.0
21.14.4
stackstorm/st2workflowengine:3.819fdfffdbba8
virtualenv@20.4.0
21.14.4

Open the chart page →

724,770
home-assistantandrenarchyVerified publisher14.104.01 of 1See more

home-assistant andrenarchy 14.104.0

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
virtualenv@21.7.9
21.14.4

Open the chart page →

4,398
awx-operatorawx-operator-helm3.2.11 of 2See more

awx-operator awx-operator-helm 3.2.1

1 of the 2 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
quay.io/ansible/awx-operator:2.19.17302e0c8e5a7
virtualenv@20.25.0
21.14.4

Open the chart page →

11,585
thehivestrangebee-helmOfficialVerified publisher2.0.01 of 7See more

thehive strangebee-helm 2.0.0

1 of the 7 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
bitnamilegacy/cassandra:4.1.7-debian-12-r32b7a217999a1
virtualenv@20.28.0
21.14.4

Open the chart page →

69,077
daskhubdask2024.1.11 of 9See more

daskhub dask 2024.1.1

1 of the 9 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
virtualenv@20.25.0
21.14.4

Open the chart page →

18,630
alerta-webalerta-webVerified publisher0.1.121 of 2See more

alerta-web alerta-web 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
hayk96/alerta-web:9.0.486377705e9e3
virtualenv@20.26.3
21.14.4

Open the chart page →

5,022
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
virtualenv@20.14.1
21.14.4

Open the chart page →

9,923
simple-krr-dashboardhelm-simple-krr-dashboardVerified publisher1.6.21 of 3See more

simple-krr-dashboard helm-simple-krr-dashboard 1.6.2

1 of the 3 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
ghcr.io/devops-ia/simple-krr-dashboard:1.6.34c625eff5410
virtualenv@21.7.8
21.14.4

Open the chart page →

3,659
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
virtualenv@21.1.0
21.14.4

Open the chart page →

6,889
kiali-operatorkiali2.33.01 of 1See more

kiali-operator kiali 2.33.0

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
quay.io/kiali/kiali-operator:v2.33.0035995403eed
virtualenv@20.29.3
21.14.4

Open the chart page →

1,904
kubeviouskubevious1.2.21 of 7See more

kubevious kubevious 1.2.2

1 of the 7 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
redislabs/redisearch:2.4.1433561794c5c8
virtualenv@20.16.3
21.14.4

Open the chart page →

18,135
machinarislib42Verified publisher0.2.01 of 1See more

machinaris lib42 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
ghcr.io/guydavis/machinaris:testf77fa53b89cb
virtualenv@20.39.1
21.14.4

Open the chart page →

26,707
pretixtechwolf12Verified publisher2026.8.01 of 3See more

pretix techwolf12 2026.8.0

1 of the 3 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
pretix/standalone:2026.8.0ec17c2f761f7
python-virtualenv@20.31.2+ds-1+deb13u1
virtualenv@20.31.2
no fix listed
21.14.4

Open the chart page →

11,400
mealieth-chartsVerified publisher0.5.11 of 1See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
virtualenv@20.35.4
21.14.4

Open the chart page →

5,414
clearml-agentallegroaiVerified publisher5.3.31 of 1See more

clearml-agent allegroai 5.3.3

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
allegroai/clearml-agent-k8s-base:1.24-21772827a01bb5
virtualenv@20.15.0
21.14.4

Open the chart page →

70,493
squestchristianhuthVerified publisher7.0.41 of 4See more

squest christianhuth 7.0.4

1 of the 4 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
virtualenv@20.39.1
21.14.4

Open the chart page →

5,373
archerydoubanVerified publisher0.4.31 of 6See more

archery douban 0.4.3

1 of the 6 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
hhyo/archery:v1.9.11aa41843419e
virtualenv@20.15.1
21.14.4

Open the chart page →

8,618
eoapieoapiOfficialVerified publisher0.17.31 of 7See more

eoapi eoapi 0.17.3

1 of the 7 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
ghcr.io/stac-utils/pgstac-pypgstac:v0.9.12672faad776b5
virtualenv@21.7.0
21.14.4

Open the chart page →

5,915
growthbookgrowthbook5.1.01 of 2See more

growthbook growthbook 5.1.0

1 of the 2 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
growthbook/growthbook:5.1.0c8a124f55dca
virtualenv@20.39.1
21.14.4

Open the chart page →

1,554
hpe-greenlake-file-csi-driverhpe-storageVerified publisher2.6.41 of 7See more

hpe-greenlake-file-csi-driver hpe-storage 2.6.4

1 of the 7 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
quay.io/hpestorage/filex-csi-driver:2.6.4b7f960bbf472
virtualenv@20.35.4
21.14.4

Open the chart page →

9,752
huehue1.0.31 of 3See more

hue hue 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
gethue/hue:latest7d5c1b9f8a79
virtualenv@20.36.1
21.14.4

Open the chart page →

67,295
kuma-ingress-watcherkuma-ingress-watcherVerified publisher1.4.01 of 1See more

kuma-ingress-watcher kuma-ingress-watcher 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
ghcr.io/squent/kuma-ingress-watcher:1.7.014d45b2a1f00
virtualenv@20.29.1
21.14.4

Open the chart page →

3,182
music-assistant-serverlmatfyVerified publisher0.1.91 of 1See more

music-assistant-server lmatfy 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
virtualenv@20.36.1
21.14.4

Open the chart page →

9,005
locustlocustVerified publisher0.1.41 of 1See more

locust locust 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
hansehe/locust:1.1.0bc8e45262bc4
virtualenv@20.29.3
21.14.4

Open the chart page →

3,286
home-assistantloeken-at-homeVerified publisher2026.9.21 of 1See more

home-assistant loeken-at-home 2026.9.2

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
loeken/home-assistant:2026.9.2b1dff5b4c593
virtualenv@21.7.9
21.14.4

Open the chart page →

3,201
opta-agentopta-agentVerified publisher0.1.31 of 1See more

opta-agent opta-agent 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
runx1/opta-agent:latest0ca3867d3200
virtualenv@20.14.1
21.14.4

Open the chart page →

2,175
portraitportraitVerified publisher0.2.132 of 8See more

portrait portrait 0.2.13

2 of the 8 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
treskon/portrait-pythonruntime:DEV-latest694c098bcb52
virtualenv@21.7.4
21.14.4
treskon/portrait-web-setup:DEV-latesta475d80e4ecf
virtualenv@20.29.2
21.14.4

Open the chart page →

96,248
kube-resource-reportrlex0.10.11 of 2See more

kube-resource-report rlex 0.10.1

1 of the 2 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
hjacobs/kube-resource-report:22.11.0c173cd02f5af
virtualenv@20.17.0
21.14.4

Open the chart page →

1,663
alertasomeblackmagic0.2.31 of 2See more

alerta someblackmagic 0.2.3

1 of the 2 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
alerta/alerta-web:8.5.04786b9eaa606
virtualenv@20.10.0
21.14.4

Open the chart page →

4,490
ckanstatcan0.0.351 of 8See more

ckan statcan 0.0.35

1 of the 8 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
statcan/ckan:2.93921305425b8
virtualenv@20.0.17
python-virtualenv@20.0.17-1ubuntu0.3
21.14.4
no fix listed

Open the chart page →

103,022
verbacapverbacapVerified publisher1.0.71 of 1See more

verbacap verbacap 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
ghcr.io/mirio/verbacap:v1.5.084928e2fc4f2
virtualenv@20.26.1
21.14.4

Open the chart page →

3,054
airbyteairbyte-v2Verified publisher2.4.01 of 10See more

airbyte airbyte-v2 2.4.0

1 of the 10 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
airbyte/manifest-server:7.28.2deec511b51c3
virtualenv@20.39.1
21.14.4

Open the chart page →

16,214
arlas-aiasarlas-stackVerified publisher28.10.01 of 22See more

arlas-aias arlas-stack 28.10.0

1 of the 22 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
ghcr.io/developmentseed/titiler:0.22.48ac53eb38393
virtualenv@20.28.0
21.14.4

Open the chart page →

157,418
keystonearzu0.2.292 of 4See more

keystone arzu 0.2.29

2 of the 4 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
openstackhelm/heat:wallaby-ubuntu_focalf728510bab3c
virtualenv@20.7.2
21.14.4
openstackhelm/keystone:wallaby-ubuntu_focale07d75953d2e
virtualenv@20.7.2
21.14.4

Open the chart page →

25,098
asya-playgroundasya1.1.31 of 1See more

asya-playground asya 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
localstack/localstack:3.19d278167f2b7
virtualenv@20.25.0
21.14.4

Open the chart page →

11,224
shynetatrox0.1.11 of 1See more

shynet atrox 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.12.0e821e31140f7
virtualenv@20.12.0
21.14.4

Open the chart page →

6,013
huebigdata-chartsVerified publisher1.0.41 of 2See more

hue bigdata-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
gethue/hue:4.10.05702b2c37ff9
virtualenv@20.4.7
21.14.4

Open the chart page →

85,358
couchpotatobryanalves0.3.01 of 1See more

couchpotato bryanalves 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
linuxserver/couchpotato:75e576ee-ls32c4d2766b9eb7
virtualenv@16.7.9
21.14.4

Open the chart page →

2,479
sickchillbryanalves0.3.01 of 1See more

sickchill bryanalves 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
virtualenv@16.7.9
21.14.4

Open the chart page →

3,109
camerahubcamerahub0.10.211 of 2See more

camerahub camerahub 0.10.21

1 of the 2 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
camerahub/camerahub:0.36.23a5af37dd6e1b
virtualenv@20.21.1
21.14.4

Open the chart page →

3,572
castai-hibernatecastaiVerified publisher0.2.121 of 1See more

castai-hibernate castai 0.2.12

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
castai/hibernate:v0.14da62858c8381
virtualenv@21.6.1
21.14.4

Open the chart page →

1,650
kube-ops-viewchristianhuthVerified publisher9.0.01 of 1See more

kube-ops-view christianhuth 9.0.0

1 of the 1 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
hjacobs/kube-ops-view:23.5.0a4fae38f93d7
virtualenv@20.21.1
21.14.4

Open the chart page →

1,556
galaxy-stablecloudve2.0.02 of 5See more

galaxy-stable cloudve 2.0.0

2 of the 5 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
galaxy/galaxy-init:v18.010267bad550e6
virtualenv@1.11.4
python-virtualenv@1.11.4-1ubuntu1
21.14.4
no fix listed
galaxy/galaxy-stable:v18.018e577a626dfd
virtualenv@1.11.4
python-virtualenv@1.11.4-1ubuntu1
21.14.4
no fix listed

Open the chart page →

160,787
pulsarcloudve0.2.01 of 2See more

pulsar cloudve 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-113726.

Container imageDigestPackageFixed in
galaxy/pulsar-kubernetes:0.15.7e50a890e24c9
python-virtualenv@20.17.1+ds-1
virtualenv@20.17.1+ds
no fix listed
21.14.4

Open the chart page →

8,183

Container images carrying it

166 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
virtualenv@20.25.0+ds
python-virtualenv@20.25.0+ds-2
21.14.4
no fix listed
1
ghcr.io/squent/kuma-ingress-watcher:1.7.014d45b2a1f00
virtualenv@20.29.1
21.14.4
1
ghcr.io/stac-utils/pgstac-pypgstac:v0.9.12672faad776b5
virtualenv@21.7.0
21.14.4
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
virtualenv@20.27.1
21.14.4
1
quay.io/ansible/awx-operator:2.19.17302e0c8e5a7
virtualenv@20.25.0
21.14.4
1
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
virtualenv@20.39.1
21.14.4
1
quay.io/hpestorage/filex-csi-driver:2.6.4b7f960bbf472
virtualenv@20.35.4
21.14.4
1
quay.io/kiali/kiali-operator:v2.33.0035995403eed
virtualenv@20.29.3
21.14.4
1
quay.io/kubev2v/forklift-operator:release-2.12c879733fd77e
virtualenv@21.7.0
21.14.4
1
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
virtualenv@20.35.4
21.14.4
1
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
virtualenv@20.35.4
21.14.4
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
virtualenv@20.35.4
21.14.4
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
virtualenv@20.35.4
21.14.4
1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
virtualenv@20.35.4
21.14.4
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
virtualenv@20.35.4
21.14.4
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
virtualenv@20.35.4
21.14.4
1

syft 1.42.1 · advisories as of 24 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.