CVE-2026-1299

Medium

Advisory

Published 23 Jan 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.0; base score, highest
EPSS: 0.005; 44th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 512; of 17,781 indexed, latest versions
Container images: 494; deployed by those charts
Fix available: 9 of 14; affected packages

email BytesGenerator header injection due to unquoted newlines

Carried by container images the latest versions of 512 of 17,781 indexed charts deploy, on 494 images.

Affected package	Affected versions	Fixed in	Images
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+4 more	3.11.2-6+deb12u7	145
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	no fix listed	100
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+14 more	3.10.12-1~22.04.16	71
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+12 more	no fix listed	54
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+8 more	3.12.3-1ubuntu0.15	48
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	no fix listed	44
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	no fix listed	25
python3.13deb	3.13.5-2, 3.13.5-2+e30, 3.13.7-1ubuntu0.1	3.13.5-2+deb13u1, 3.13.5-2+e36	23
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	no fix listed	7
python-3.14apk	3.14.2-r2	3.14.3-r1	4
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	3.10.20	3
python-3.12apk	3.12.0-r1, 3.12.9-r1	3.12.12-r5	2
python-3.13apk	3.13.7-r0, 3.13.10-r0	3.13.12-r1	2
python3-corerpm	3.6.15-150300.10.97.1	3.6.15-150300.10.109.1	1

OSV records: BIT-python-2026-1299 CGA-3hhm-jg5q-r9v7 CGA-c9h2-43g4-m56x CGA-cgx7-5h45-6xr5 DEBIAN-CVE-2026-1299 UBUNTU-CVE-2026-1299 ECHO-addc-a9aa-706b SUSE-SU-2026:1090-1
Also known as: BIT-libpython-2026-1299, BIT-python-min-2026-1299, CGA-hw3w-x7mm-rxvx, CGA-jhj2-w2wm-p9wv, CGA-mg73-w7j6-v3ff, PSF-2026-8, USN-8509-1

Charts affected

512 by stars

Chart

Latest

Affected images

Radar Score

browserlessvictorlane

0.2.0

1 of 1 See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	python3.12@3.12.3-1ubuntu0.12	3.12.3-1ubuntu0.15

Open the chart page →

4,305

twenty-crmvictorlane

0.0.1

2 of 3 See more

twenty-crm victorlane 0.0.1

2 of the 3 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
redis/redis-stack-server :latest	798ab84d9f26	python3.10@3.10.12-1~22.04.11	3.10.12-1~22.04.16
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

13,459

calibre-webvista

0.1.3

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.15

Open the chart page →

7,628

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed

Open the chart page →

11,119

myweatherhelmwebapp1

1.3.50

2 of 8 See more

myweatherhelm webapp1 1.3.50

2 of the 8 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.15
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	no fix listed

Open the chart page →

9,130

myweatherhelm-schedulingwebapp1

1.3.92

2 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

2 of the 9 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.15
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	no fix listed

Open the chart page →

9,130

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	no fix listed

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	no fix listed

Open the chart page →

28,605

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	python3.6@3.6.9-1~18.04ubuntu1.1	no fix listed

Open the chart page →

10,843

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed

Open the chart page →

15,230

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

9,248

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

14,100

Container images carrying it

494 by charts deploying them

A fixed version is listed for 9 of the 14 affected packages.

Container image	Digest	Package	Fixed in	Used by
hasura/graphql-engine :v2.34.0-ce	0111b0204136	python3.10@3.10.6-1~22.04.2ubuntu1.1	3.10.12-1~22.04.16	1
hasura/graphql-engine :v2.48.10	f6c1c4b957d2	python3.10@3.10.12-1~22.04.11	3.10.12-1~22.04.16	1
haugene/transmission-openvpn :4.0	059216cfae4b	python3.8@3.8.10-0ubuntu1~20.04	no fix listed	1
haveagitgat/tdarr :2.00.18	1256348872ce	python2.7@2.7.18-1~20.04.1 python3.8@3.8.10-0ubuntu1~20.04.4	no fix listed no fix listed	1
haveagitgat/tdarr_node :2.00.10	1e3f9328327d	python3.8@3.8.5-1~20.04	no fix listed	1
haveagitgat/tdarr_node :2.17.01	3ff0913202dd	python2.7@2.7.18-1~20.04.3 python3.8@3.8.10-0ubuntu1~20.04.8	no fix listed no fix listed	1
helicone/clickhouse-migration-runner :v2025.03.05-1	4c69b971a7e4	python3.8@3.8.10-0ubuntu1~20.04.13	no fix listed	1
helicone/supabase-migration-runner :v2025.03.05-1	4a913936c97b	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
hyperglance/init :wildfly	467ad8491bc3	python3.10@3.10.12-1~22.04.15	3.10.12-1~22.04.16	1
hyperglance/init :postgres	9fd5faf1fe80	python3.10@3.10.12-1~22.04.15	3.10.12-1~22.04.16	1
hyperglance/init :apache	b2f8c6d52623	python3.10@3.10.12-1~22.04.15	3.10.12-1~22.04.16	1
hyperledger/fabric-couchdb :0.4.10	c65891b6c237	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	no fix listed no fix listed	1
ibmcom/ibm-workload-scheduler-agent-dynamic-dev :9.4.0.04	7e4dc1e27cdf	python3.5@3.5.2-2ubuntu0~16.04.4	no fix listed	1
ibmcom/icp-swift-sample :latest	b5d8c6714dbc	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	no fix listed no fix listed	1
ibmcom/microclimate-theia :latest	e17bdccc5030	python2.7@2.7.12-1ubuntu0~16.04.2	no fix listed	1
ibmcom/skydive :0.22.0	395e60cc6e3d	python2.7@2.7.15~rc1-1ubuntu0.1	no fix listed	1
ildarmukhametzyanov/priceapp :0.1	15d23720a3ee	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
inseefrlab/shelly :cloudshell	31f04ca7436b	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16	1
instill/artifact-backend :b28766a	c4a393e601ed	python3.13@3.13.5-2	3.13.5-2+deb13u1	1
instill/mgmt-backend :d0933d4	ebe12f77a3f9	python3.13@3.13.5-2	3.13.5-2+deb13u1	1
instill/model-backend :611f0f2	e980125e5ba5	python3.13@3.13.5-2	3.13.5-2+deb13u1	1
intel/dlstreamer-pipeline-server :2022.1.1-ubuntu20	aa8f5483a2ef	python3.8@3.8.10-0ubuntu1~20.04.4	no fix listed	1
intel/multimodal-data-visualization-streaming :3.0	1a89327e499b	python3.8@3.8.10-0ubuntu1~20.04.5	no fix listed	1
intelowlproject/intelowl :v6.6.1	0b22e547ea6b	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
iofog/router :2.0.1	7260cf861479	python2.7@2.7.17-1~18.04ubuntu1.1	no fix listed	1
iomesh/csi-driver :v2.8.0	1a151f602451	python3.10@3.10.12-1~22.04.4	3.10.12-1~22.04.16	1
iomesh/csi-driver :v2.7.2	5d3f9bf9240b	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16	1
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed	1
ispras/svacer :11-2-0	42aa9fa9f189	python3.10@3.10.12-1~22.04.10	3.10.12-1~22.04.16	1
istio/install-cni :1.10.3	2232f365aed6	python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed	1
istio/node-agent-k8s :1.2.9	268ab879ea51	python3.5@3.5.2-2ubuntu0~16.04.5	no fix listed	1
istio/operator :1.10.3	655eefa11c84	python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed	1
istio/pilot :1.10.0	294ca55bd1cc	python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed	1
istio/pilot :1.2.9	c09319753454	python3.5@3.5.2-2ubuntu0~16.04.5	no fix listed	1
istio/pilot :1.10.3	e7e110a421c2	python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed	1
istio/proxyv2 :1.2.9	0c78be035e98	python3.5@3.5.2-2ubuntu0~16.04.5	no fix listed	1
istio/proxyv2 :1.9.6	87a9db561d2e	python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed	1
istio/proxyv2 :1.10.0	88c6c693e67a	python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed	1
jaedb/iris :latest	048cfbf58d57	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u7	1
jakowenko/double-take :1.6.0	b858bac9e32a	python3.8@3.8.10-0ubuntu1~20.04.1	no fix listed	1
jedi132000/nextapp :latest	dc2a81e92f23	python3.8@3.8.10-0ubuntu1~20.04.5	no fix listed	1
jmferrer/azure-devops-agent :latest	030f68ec6998	python3.5@3.5.2-2ubuntu0~16.04.9	no fix listed	1
josh5/unmanic :0.2.6	4d49c4816260	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16	1
jupyterhub/jupyterhub :5.4.6	3974ba945e65	python3.12@3.12.3-1ubuntu0.13	3.12.3-1ubuntu0.15	1
jupyterhub/k8s-hub :0.11.1	b6b4a1a34bf0	python3.8@3.8.5-1~20.04	no fix listed	1
jupyterhub/k8s-hub :1.2.0	e4770285aaf7	python3.8@3.8.10-0ubuntu1~20.04.1	no fix listed	1
kennethreitz/httpbin :latest	599fe5e50731	python3.6@3.6.6-1~18.04	no fix listed	1
kfirfer/phppgadmin :7.13.0-2	2efb4a5d74a3	python3.8@3.8.10-0ubuntu1~20.04.6	no fix listed	1
kinseii/wazuh-agent :4.14.1	7160eb143728	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
knspar/phronetis :0.1.46	09499d2dc91a	python3.12@3.12.3-1ubuntu0.5	3.12.3-1ubuntu0.15	1