CVE-2026-1299

Medium

Advisory

Published 23 Jan 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.0; base score, highest
EPSS: 0.005; 44th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 512; of 17,781 indexed, latest versions
Container images: 494; deployed by those charts
Fix available: 9 of 14; affected packages

email BytesGenerator header injection due to unquoted newlines

Carried by container images the latest versions of 512 of 17,781 indexed charts deploy, on 494 images.

Affected package	Affected versions	Fixed in	Images
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+4 more	3.11.2-6+deb12u7	145
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	no fix listed	100
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+14 more	3.10.12-1~22.04.16	71
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+12 more	no fix listed	54
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+8 more	3.12.3-1ubuntu0.15	48
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	no fix listed	44
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	no fix listed	25
python3.13deb	3.13.5-2, 3.13.5-2+e30, 3.13.7-1ubuntu0.1	3.13.5-2+deb13u1, 3.13.5-2+e36	23
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	no fix listed	7
python-3.14apk	3.14.2-r2	3.14.3-r1	4
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	3.10.20	3
python-3.12apk	3.12.0-r1, 3.12.9-r1	3.12.12-r5	2
python-3.13apk	3.13.7-r0, 3.13.10-r0	3.13.12-r1	2
python3-corerpm	3.6.15-150300.10.97.1	3.6.15-150300.10.109.1	1

OSV records: BIT-python-2026-1299 CGA-3hhm-jg5q-r9v7 CGA-c9h2-43g4-m56x CGA-cgx7-5h45-6xr5 DEBIAN-CVE-2026-1299 UBUNTU-CVE-2026-1299 ECHO-addc-a9aa-706b SUSE-SU-2026:1090-1
Also known as: BIT-libpython-2026-1299, BIT-python-min-2026-1299, CGA-hw3w-x7mm-rxvx, CGA-jhj2-w2wm-p9wv, CGA-mg73-w7j6-v3ff, PSF-2026-8, USN-8509-1

Charts affected

512 by stars

Chart

Latest

Affected images

Radar Score

browserlessvictorlane

0.2.0

1 of 1 See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	python3.12@3.12.3-1ubuntu0.12	3.12.3-1ubuntu0.15

Open the chart page →

4,305

twenty-crmvictorlane

0.0.1

2 of 3 See more

twenty-crm victorlane 0.0.1

2 of the 3 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
redis/redis-stack-server :latest	798ab84d9f26	python3.10@3.10.12-1~22.04.11	3.10.12-1~22.04.16
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

13,459

calibre-webvista

0.1.3

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.15

Open the chart page →

7,628

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed

Open the chart page →

11,119

myweatherhelmwebapp1

1.3.50

2 of 8 See more

myweatherhelm webapp1 1.3.50

2 of the 8 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.15
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	no fix listed

Open the chart page →

9,130

myweatherhelm-schedulingwebapp1

1.3.92

2 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

2 of the 9 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.15
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	no fix listed

Open the chart page →

9,130

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	no fix listed

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	no fix listed

Open the chart page →

28,605

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	python3.6@3.6.9-1~18.04ubuntu1.1	no fix listed

Open the chart page →

10,843

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed

Open the chart page →

15,230

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

9,248

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

14,100

Container images carrying it

494 by charts deploying them

A fixed version is listed for 9 of the 14 affected packages.

Container image	Digest	Package	Fixed in	Used by
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	no fix listed	2
a10networks/acos-prometheus-exporter :latest	8dc58d434d71	python3.6@3.6.9-1~18.04ubuntu1	no fix listed	1
aboogie/login_test_backend :new	9c41a4483ac8	python3.11@3.11.2-6+deb12u2	3.11.2-6+deb12u7	1
adwerx/github-actions-runner :2.276.1-20.04-1	840d2b078682	python3.8@3.8.5-1~20.04	no fix listed	1
airsonicadvanced/airsonic-advanced :latest	f7cbafac2806	python3.8@3.8.5-1~20.04.3	no fix listed	1
akeyless/base :latest	759e4289fae8	python3.12@3.12.3-1ubuntu0.13	3.12.3-1ubuntu0.15	1
allegroai/clearml :2.0.0-613	713ae38f7daf	python3.11@3.11.2-6+deb12u4	3.11.2-6+deb12u7	1
allegroai/clearml-agent-k8s-base :1.24-21	772827a01bb5	python3.6@3.6.9-1~18.04ubuntu1.7	no fix listed	1
andrewgolikov55/intel-gpu-exporter :latest	fcc001b61c0e	python3.10@3.10.12-1~22.04.2	3.10.12-1~22.04.16	1
andrewmackrodt/firefox-x11 :142.0.1-r1	33f9080470c9	python3.10@3.10.12-1~22.04.11	3.10.12-1~22.04.16	1
anujdatar/cups :25.07.01	685df04a643b	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
apache/airflow :2.8.4-python3.9	64e58748b6b9	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
apache/airflow :2.10.2-python3.9	ce90bdc3d2af	python3.11@3.11.2-6+deb12u3	3.11.2-6+deb12u7	1
apache/airflow :2.8.1	e5560ad0b86e	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
apache/gravitino-iceberg-rest :1.3.0	80136ae753ee	python3.10@3.10.12-1~22.04.15	3.10.12-1~22.04.16	1
apache/hertzbeat :1.8.0	75d48a62748f	python3.12@3.12.3-1ubuntu0.11	3.12.3-1ubuntu0.15	1
apache/hertzbeat-collector :1.8.0	a2bab1be574c	python3.12@3.12.3-1ubuntu0.11	3.12.3-1ubuntu0.15	1
apachepulsar/pulsar :3.1.0	16f9fdab3fa6	python3.10@3.10.12-1~22.04.2	3.10.12-1~22.04.16	1
apachepulsar/pulsar :2.10.0	3b262ab7a7d9	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed	1
apachepulsar/pulsar :3.0.7	9c9947de139d	python3.10@3.10.12-1~22.04.6	3.10.12-1~22.04.16	1
apachepulsar/pulsar :2.9.0	d056c89b7131	python3.8@3.8.10-0ubuntu1~20.04.1	no fix listed	1
apachepulsar/pulsar :2.8.2	d538416d5afe	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed	1
apache/ranger :2.7.0	76c176e8a0e4	python3.10@3.10.12-1~22.04.10	3.10.12-1~22.04.16	1
artur9010/wait-for :v1.0.0	6b4de3ce8b0e	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
arunvelsriram/utils :latest	655ad18fd8d6	python3.12@3.12.3-1ubuntu0.7	3.12.3-1ubuntu0.15	1
assistiot/cybersecurity-monitoring_ir-cas :latest	6a107f224c34	python2.7@2.7.18-1~20.04.3	no fix listed	1
assistiot/open_api_backend :1.1.2	30812ba93555	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16	1
assistiot/smart-orchestrator_mcs :latest	7d6a0d534c7f	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
assistiot/smart-orchestrator_scheduler :latest	38b003e55ff3	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
assistiot/smart-orchestrator_scheduler_mc :latest	b1dbe4d62a03	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
assistiot/video_augmentation :runner-cpu-latest	e5ae539ce2cb	python3.8@3.8.10-0ubuntu1~20.04.7	no fix listed	1
atlassian/confluence-server :7.10.0	3b9222ab32ef	python3.10@3.10.6-1~22.04.1	3.10.12-1~22.04.16	1
atlassian/jira-software :8.14.0	37bc46cbec1a	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16	1
atlassian/jira-software :9.7.2	64a75aa4ec4e	python3.12@3.12.3-1ubuntu0.5	3.12.3-1ubuntu0.15	1
avinash263/pyredis263 :latest	aa2b8727f1a6	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
baserow/backend :1.31.1	e0b3c8130b91	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u7	1
baserow/baserow :1.30.1	df0c42eb67e8	python3.11@3.11.2-6+deb12u4	3.11.2-6+deb12u7	1
bbernhard/signal-cli-rest-api :0.57	549ad08d7e14	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed	1
beanbag/reviewboard :latest	6b840f546e1c	python3.11@3.11.0~rc1-1~22.04.1	no fix listed	1
beyzkaya/blog-backend :v1.0.1	12a6a3d1c5f9	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
bicarus/elrond-rosetta :v1.3.50.0	b1dab0721e1c	python3.8@3.8.10-0ubuntu1~20.04.6	no fix listed	1
bitnamilegacy/cassandra :4.1.7-debian-12-r3	2b7a217999a1	python@3.11.11-0	3.10.20	1
blakeblackshear/frigate :0.10.0-amd64	ae269270ad9e	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed	1
bloxstaking/ssv-node :v2.2.0	bf6d7d2fdc93	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u7	1
bnjbvr/kresus :0.22.1	37e216b182c8	python3.11@3.11.2-6+deb12u4	3.11.2-6+deb12u7	1
boky/postfix :5.1.0	aafc77238423	python3.13@3.13.5-2	3.13.5-2+deb13u1	1
boky/postfix :4.4.0	f3f247fd4252	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u7	1
browserless/chrome :1.48.0-chrome-stable	c81ae5585b47	python3.8@3.8.10-0ubuntu1~20.04	no fix listed	1
carlosmz87/test_helm_backend :latest	8ffa63aa995d	python3.11@3.11.2-6+deb12u4	3.11.2-6+deb12u7	1
castopod/castopod :1.12.10	1fd37280cbb2	python3.11@3.11.2-6+deb12u3	3.11.2-6+deb12u7	1