CVE-2026-1299

Medium

Advisory

Published 23 Jan 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.0; base score, highest
EPSS: 0.005; 44th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 512; of 17,787 indexed, latest versions
Container images: 494; deployed by those charts
Fix available: 9 of 14; affected packages

email BytesGenerator header injection due to unquoted newlines

Carried by container images the latest versions of 512 of 17,787 indexed charts deploy, on 494 images.

Affected package	Affected versions	Fixed in	Images
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+4 more	3.11.2-6+deb12u7	145
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	no fix listed	100
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+14 more	3.10.12-1~22.04.16	71
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+12 more	no fix listed	54
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+8 more	3.12.3-1ubuntu0.15	48
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	no fix listed	44
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	no fix listed	25
python3.13deb	3.13.5-2, 3.13.5-2+e30, 3.13.7-1ubuntu0.1	3.13.5-2+deb13u1, 3.13.5-2+e36	23
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	no fix listed	7
python-3.14apk	3.14.2-r2	3.14.3-r1	4
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	3.10.20	3
python-3.12apk	3.12.0-r1, 3.12.9-r1	3.12.12-r5	2
python-3.13apk	3.13.7-r0, 3.13.10-r0	3.13.12-r1	2
python3-corerpm	3.6.15-150300.10.97.1	3.6.15-150300.10.109.1	1

OSV records: BIT-python-2026-1299 CGA-3hhm-jg5q-r9v7 CGA-c9h2-43g4-m56x CGA-cgx7-5h45-6xr5 DEBIAN-CVE-2026-1299 UBUNTU-CVE-2026-1299 ECHO-addc-a9aa-706b SUSE-SU-2026:1090-1
Also known as: BIT-libpython-2026-1299, BIT-python-min-2026-1299, CGA-hw3w-x7mm-rxvx, CGA-jhj2-w2wm-p9wv, CGA-mg73-w7j6-v3ff, PSF-2026-8, USN-8509-1

Charts affected

512 by stars

Chart

Latest

Affected images

Radar Score

browserlessvictorlane

0.2.0

1 of 1 See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	python3.12@3.12.3-1ubuntu0.12	3.12.3-1ubuntu0.15

Open the chart page →

4,305

twenty-crmvictorlane

0.0.1

2 of 3 See more

twenty-crm victorlane 0.0.1

2 of the 3 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
redis/redis-stack-server :latest	798ab84d9f26	python3.10@3.10.12-1~22.04.11	3.10.12-1~22.04.16
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

13,459

calibre-webvista

0.1.3

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.15

Open the chart page →

7,628

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed

Open the chart page →

11,119

myweatherhelmwebapp1

1.3.50

2 of 8 See more

myweatherhelm webapp1 1.3.50

2 of the 8 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.15
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	no fix listed

Open the chart page →

9,130

myweatherhelm-schedulingwebapp1

1.3.92

2 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

2 of the 9 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.15
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	no fix listed

Open the chart page →

9,130

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	no fix listed

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	no fix listed

Open the chart page →

28,605

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	python3.6@3.6.9-1~18.04ubuntu1.1	no fix listed

Open the chart page →

10,843

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed

Open the chart page →

15,230

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

9,248

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

14,100

Container images carrying it

494 by charts deploying them

A fixed version is listed for 9 of the 14 affected packages.

Container image	Digest	Package	Fixed in	Used by
statcan/ckan :2.9	3921305425b8	python3.8@3.8.5-1~20.04.3	no fix listed	1
streamnative/apache-pulsar-grafana-dashboard-k8s :0.0.16	11bceacec8fb	python3.8@3.8.5-1~20.04.3	no fix listed	1
substratusai/verba :v0.4.0-baseURL2	61695be635eb	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
supabase/studio :20241021-9f9b083	26d8070c55e9	python3.11@3.11.2-6+deb12u3	3.11.2-6+deb12u7	1
svtechnmaa/svtech_debuger :v1.0.3	a934ffd63d25	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16	1
svtechnmaa/svtech_grafana :v1.2.2	1d71314424aa	python2.7@2.7.18-1~20.04.3	no fix listed	1
svtechnmaa/svtech_rundeck :v1.2.2	6e368ace0977	python3.8@3.8.10-0ubuntu1~20.04.9	no fix listed	1
sysnet4admin/colosseum-cms :log	e74b43c7f492	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
sysnet4admin/colosseum-prm :log	5802bfcd7fed	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
teknas09/bird-pod :latest	12a1fa85c4aa	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
tensorflow/tensorflow :1.6.0-devel	1e3172090703	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	no fix listed no fix listed	1
theradius/loggia :0.4	63ba348546ec	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
thongngo3301/stakefish :latest	a341af5976e3	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
timescale/timescaledb-ha :pg15-latest	a8e3322e1cf9	python3.10@3.10.6-1~22.04.2ubuntu1	3.10.12-1~22.04.16	1
timescale/timescaledb-ha :pg14.6-ts2.9.1-p1	cdb9ae118899	python3.10@3.10.6-1~22.04.2	3.10.12-1~22.04.16	1
timescale/timescaledb-ha :pg17.2-ts2.18.2	e8d0a9cc3db5	python3.10@3.10.12-1~22.04.9	3.10.12-1~22.04.16	1
timescale/timescaledb-ha :pg14-ts2.6-latest	ed719c0cd19d	python3.10@3.10.4-3	3.10.12-1~22.04.16	1
timothyclarke/wptagent :2018-01-23	22c41e5ca7e2	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	no fix listed no fix listed	1
tinymediamanager/tinymediamanager :5.3.2	2b34dc85099e	python3.13@3.13.5-2	3.13.5-2+deb13u1	1
tpdock/freeradius :2.2.9	3da600c95a49	python2.7@2.7.12-1ubuntu0~16.04.2 python3.5@3.5.2-2ubuntu0~16.04.4	no fix listed no fix listed	1
treskon/portrait-web-setup :DEV-latest	a475d80e4ecf	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u7	1
trinodb/trino :405	ee80ab5eeab2	python3.10@3.10.6-1~22.04.2	3.10.12-1~22.04.16	1
trueosiris/vrising :latest	9356f98ad561	python3.10@3.10.12-1~22.04.15	3.10.12-1~22.04.16	1
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16	1
unitycatalog/unitycatalog-ui :main-aadc6fc	3a688197b218	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
vinanrra/7dtd-server :v0.4.4	f9534490bd2b	python3.6@3.6.9-1~18.04ubuntu1.9	no fix listed	1
vlebediantsev/notes-admin-front :latest	007c6670ff48	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
vlebediantsev/notes-project-front :latest	945675fd2636	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
vlebediantsev/registration-ms-front-app-host :latest	54f69d116c50	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
voltha/voltha-cli :1.6.0	c4e41e92f046	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.5	no fix listed no fix listed	1
voltha/voltha-envoy :1.6.0	59ab2a00f712	python3.4@3.4.3-1ubuntu1~14.04.5	no fix listed	1
voltha/voltha-netconf :1.6.0	37f80524c207	python2.7@2.7.12-1ubuntu0~16.04.3	no fix listed	1
voltha/voltha-ofagent :1.6.0	9ee8c1f4428c	python2.7@2.7.12-1ubuntu0~16.04.3	no fix listed	1
voltha/voltha-tester :1.7.0	655c3048a602	python2.7@2.7.12-1ubuntu0~16.04.4	no fix listed	1
voltha/voltha-voltha :1.6.0	ff596b62de59	python2.7@2.7.12-1ubuntu0~16.04.3	no fix listed	1
wazuh/wazuh-manager :4.4.1	21994f40e0da	python3.8@3.8.10-0ubuntu1~20.04.7	no fix listed	1
wger/server :2.6	997ead43aabd	python3.12@3.12.3-1ubuntu0.13	3.12.3-1ubuntu0.15	1
woojoong/wowza :latest	ec230db19652	python2.7@2.7.15~rc1-1ubuntu0.1	no fix listed	1
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16	1
xeladock/mysql_dns :latest	4baf531453f1	python3.10@3.10.4-3	3.10.12-1~22.04.16	1
xom4ekp2p/infini-route-attestators-public-mainnet-attester :latest	d0e0aa238b02	python3.11@3.11.2-6+deb12u2	3.11.2-6+deb12u7	1
xom4ekp2p/infini-route-attestators-public-mainnet-avs-webapi :latest	2745b5fd8785	python3.11@3.11.2-6+deb12u2	3.11.2-6+deb12u7	1
zabbix/zabbix-web-nginx-mysql :ubuntu-6.4-latest	0e5f69c4c54e	python3.12@3.12.3-1ubuntu0.4	3.12.3-1ubuntu0.15	1
zabbix/zabbix-web-nginx-pgsql :ubuntu-5.4.6	01de79c31391	python3.8@3.8.10-0ubuntu1~20.04.1	no fix listed	1
zabbix/zabbix-web-nginx-pgsql :ubuntu-7.0.23	7d4d58086515	python3.12@3.12.3-1ubuntu0.11	3.12.3-1ubuntu0.15	1
zabbix/zabbix-web-nginx-pgsql :ubuntu-6.0.8	99e9a090b516	python3.10@3.10.4-3ubuntu0.1	3.10.12-1~22.04.16	1
gcr.io/istio-release/pilot :release-1.0-latest-daily	5ea7b7f3632a	python3.5@3.5.2-2ubuntu0~16.04.5	no fix listed	1
gcr.io/istio-release/proxyv2 :release-1.0-latest-daily	8f9ff98fdbef	python3.5@3.5.2-2ubuntu0~16.04.5	no fix listed	1
gcr.io/ml-pipeline/metadata-writer :2.3.0	9bcfd2abc361	python3.11@3.11.2-6+deb12u3	3.11.2-6+deb12u7	1
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets :0.0.0-main	13e267ad7d94	python3.12@3.12.3-1ubuntu0.10	3.12.3-1ubuntu0.15	1