CVE-2026-1299

Medium

Advisory

Published 23 Jan 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.0; base score, highest
EPSS: 0.005; 44th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 512; of 17,787 indexed, latest versions
Container images: 494; deployed by those charts
Fix available: 9 of 14; affected packages

email BytesGenerator header injection due to unquoted newlines

Carried by container images the latest versions of 512 of 17,787 indexed charts deploy, on 494 images.

Affected package	Affected versions	Fixed in	Images
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+4 more	3.11.2-6+deb12u7	145
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	no fix listed	100
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+14 more	3.10.12-1~22.04.16	71
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+12 more	no fix listed	54
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+8 more	3.12.3-1ubuntu0.15	48
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	no fix listed	44
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	no fix listed	25
python3.13deb	3.13.5-2, 3.13.5-2+e30, 3.13.7-1ubuntu0.1	3.13.5-2+deb13u1, 3.13.5-2+e36	23
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	no fix listed	7
python-3.14apk	3.14.2-r2	3.14.3-r1	4
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	3.10.20	3
python-3.12apk	3.12.0-r1, 3.12.9-r1	3.12.12-r5	2
python-3.13apk	3.13.7-r0, 3.13.10-r0	3.13.12-r1	2
python3-corerpm	3.6.15-150300.10.97.1	3.6.15-150300.10.109.1	1

OSV records: BIT-python-2026-1299 CGA-3hhm-jg5q-r9v7 CGA-c9h2-43g4-m56x CGA-cgx7-5h45-6xr5 DEBIAN-CVE-2026-1299 UBUNTU-CVE-2026-1299 ECHO-addc-a9aa-706b SUSE-SU-2026:1090-1
Also known as: BIT-libpython-2026-1299, BIT-python-min-2026-1299, CGA-hw3w-x7mm-rxvx, CGA-jhj2-w2wm-p9wv, CGA-mg73-w7j6-v3ff, PSF-2026-8, USN-8509-1

Charts affected

512 by stars

Chart

Latest

Affected images

Radar Score

browserlessvictorlane

0.2.0

1 of 1 See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	python3.12@3.12.3-1ubuntu0.12	3.12.3-1ubuntu0.15

Open the chart page →

4,305

twenty-crmvictorlane

0.0.1

2 of 3 See more

twenty-crm victorlane 0.0.1

2 of the 3 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
redis/redis-stack-server :latest	798ab84d9f26	python3.10@3.10.12-1~22.04.11	3.10.12-1~22.04.16
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

13,459

calibre-webvista

0.1.3

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.15

Open the chart page →

7,628

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed

Open the chart page →

11,119

myweatherhelmwebapp1

1.3.50

2 of 8 See more

myweatherhelm webapp1 1.3.50

2 of the 8 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.15
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	no fix listed

Open the chart page →

9,130

myweatherhelm-schedulingwebapp1

1.3.92

2 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

2 of the 9 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.15
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	no fix listed

Open the chart page →

9,130

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	no fix listed

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	no fix listed

Open the chart page →

28,605

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	python3.6@3.6.9-1~18.04ubuntu1.1	no fix listed

Open the chart page →

10,843

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed

Open the chart page →

15,230

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

9,248

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

14,100

Container images carrying it

494 by charts deploying them

A fixed version is listed for 9 of the 14 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/appscode/gotenberg :8.25	f9104080d9a7	python3.13@3.13.5-2	3.13.5-2+deb13u1	1
ghcr.io/astriaorg/astrotrek :0.1.0	5889bea38e56	python3.11@3.11.2-6+deb12u3	3.11.2-6+deb12u7	1
ghcr.io/avistotelecom/docker-wazuh-agent :4.12.0	8766ba08bf1a	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
ghcr.io/base/node-reth :v1.1.1	8eb6e492fe3c	python3.12@3.12.3-1ubuntu0.13	3.12.3-1ubuntu0.15	1
ghcr.io/base-org/node :v0.11.1	1aba0ffe55ea	python3.10@3.10.12-1~22.04.7	3.10.12-1~22.04.16	1
ghcr.io/berriai/litellm-database :litellm_stable_release_branch-v1.75.5-stable	ab63d26a8a2c	python-3.13@3.13.7-r0	3.13.12-r1	1
ghcr.io/beslovas/duckdb-ui :1.3.2	72f35584026d	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
ghcr.io/brittonhayes/arma-reforger :latest	6fde1edc0983	python3.8@3.8.10-0ubuntu1~20.04.6	no fix listed	1
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	python3.12@3.12.3-1ubuntu0.12	3.12.3-1ubuntu0.15	1
ghcr.io/buanet/iobroker :v9.1.2	ca7dc7362968	python3.11@3.11.2-6+deb12u2	3.11.2-6+deb12u7	1
ghcr.io/camptocamp/tetragon-policy-builder :master	0e99f12bb040	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u7	1
ghcr.io/cfi2017/opencve-scheduler :3.0.0	8d943799621b	python3.11@3.11.2-6+deb12u4	3.11.2-6+deb12u7	1
ghcr.io/cosmo-tech/cosmotech-copilot-api :latest	a2be95de450c	python3.13@3.13.5-2	3.13.5-2+deb13u1	1
ghcr.io/cosmo-workspace/dev-code-server :v0.0.3	16fda01ae58a	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u7	1
ghcr.io/dask/dask-kubernetes-operator :2026.3.0	3225d2bc6b3c	python3.13@3.13.5-2	3.13.5-2+deb13u1	1
ghcr.io/developmentseed/titiler :0.22.4	8ac53eb38393	python@3.12.8-0	3.10.20	1
ghcr.io/dfir-iris/iriswebapp_app :v2.4.26	e59ebde55709	python3.13@3.13.5-2	3.13.5-2+deb13u1	1
ghcr.io/djerfy/zabbix-kubernetes-discovery :v1.4.20	7a50c07e7c69	python3.12@3.12.3-1ubuntu0.3	3.12.3-1ubuntu0.15	1
ghcr.io/drewburr-labs/mum-discord-bot :3.1.2	6e82914e1051	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
ghcr.io/edgelesssys/coordinator :v0.5.0	bcd5b8d4c45c	python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed	1
ghcr.io/flanksource/postgres :17.6-497383c	ebcf66281fc1	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
ghcr.io/graphprotocol/availability-oracle :sha-28312fd	472a25038957	python3.11@3.11.2-6+deb12u2	3.11.2-6+deb12u7	1
ghcr.io/grycap/im :latest	06a16d4f279f	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.15	1
ghcr.io/haveagitgat/tdarr :2.00.18.2	3fbe4c29d14c	python2.7@2.7.18-1~20.04.1 python3.8@3.8.10-0ubuntu1~20.04.4	no fix listed no fix listed	1
ghcr.io/htunn/ansible-inspec :0.2.12	cd25a5cc3f1b	python3.13@3.13.5-2	3.13.5-2+deb13u1	1
ghcr.io/jespernohr/dayz-dedicated-server :0.1.1	ec01d3ac7887	python3.12@3.12.3-1ubuntu0.2	3.12.3-1ubuntu0.15	1
ghcr.io/jfwenisch/discord-experiencebot :latest	b52ff07f9f0c	python3.6@3.6.9-1~18.04ubuntu1.12	no fix listed	1
ghcr.io/jfwenisch/steamcmd-manager :v0.4.5	dab685e668d9	python3.12@3.12.3-1ubuntu0.3	3.12.3-1ubuntu0.15	1
ghcr.io/jfwenisch/webtools :v0.1.4	4569cae83c70	python3.12@3.12.3-1ubuntu0.3	3.12.3-1ubuntu0.15	1
ghcr.io/jr0dd/puppeteer :v13.3.2	6047599cd78e	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed	1
ghcr.io/k8s-at-home/bazarr :v1.0.3	fdb5501cdfb9	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed	1
ghcr.io/k8s-at-home/haste-server :latest	827aa2f2389d	python3.8@3.8.10-0ubuntu1~20.04	no fix listed	1
ghcr.io/k8s-at-home/nzbget :v21.1	e5571acd10ce	python3.10@3.10.4-3ubuntu0.1	3.10.12-1~22.04.16	1
ghcr.io/k8s-at-home/nzbhydra2 :v3.14.2	ef3670f7e0a8	python3.8@3.8.5-1~20.04.2	no fix listed	1
ghcr.io/k8s-at-home/prowlarr :v0.3.0.1710	c863aa9875fa	python3.8@3.8.10-0ubuntu1~20.04.4	no fix listed	1
ghcr.io/k8s-at-home/qbittorrent :v4.4.2	61deadd1ec78	python3.8@3.8.10-0ubuntu1~20.04.4	no fix listed	1
ghcr.io/k8s-at-home/sabnzbd :v3.3.1	c2d6e775db5a	python3.8@3.8.5-1~20.04.3	no fix listed	1
ghcr.io/k8s-at-home/tautulli :v2.7.7	4ea617c30397	python3.8@3.8.10-0ubuntu1~20.04.1	no fix listed	1
ghcr.io/k8s-at-home/transmission :v3.00	6011182e3946	python3.8@3.8.10-0ubuntu1~20.04.5	no fix listed	1
ghcr.io/k8s-at-home/xteve :v2.2.0.200	292b3614670f	python3.8@3.8.10-0ubuntu1~20.04.4	no fix listed	1
ghcr.io/kamu-data/kamu-api-server :0.89.0	4ed7a896dd2b	python3.8@3.8.10-0ubuntu1~20.04.18	no fix listed	1
ghcr.io/kore3lab/kore-board.terminal :v0.5.5	f52e66eff50b	python3.6@3.6.9-1~18.04ubuntu1.9	no fix listed	1
ghcr.io/kubeflow/spark-operator/controller :2.2.1	865ff4da5686	python3.8@3.8.10-0ubuntu1~20.04.18	no fix listed	1
ghcr.io/kubiyabot/agent-manager :v0.4.13	757bdd779345	python3.13@3.13.5-2	3.13.5-2+deb13u1	1
ghcr.io/kvaps/kubefarm-ltsp :v0.13.4	24efef013a53	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed	1
ghcr.io/libreconnect/ferriscompany :0.1.0-rc6	ed86db9f0efe	python3.11@3.11.2-6+deb12u3	3.11.2-6+deb12u7	1
ghcr.io/lloesche/valheim-server :latest	20fde516ce31	python3.13@3.13.5-2	3.13.5-2+deb13u1	1
ghcr.io/maastrichtu-ids/rstudio :latest	981aa4c109e1	python3.12@3.12.3-1ubuntu0.5	3.12.3-1ubuntu0.15	1
ghcr.io/mcwarman/backstage-sample-app/backend :main	07aba09a594f	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
ghcr.io/middleware-labs/mw-kube-agent :1.12.0	9c7bc0f9bb35	python3.12@3.12.3-1ubuntu0.3	3.12.3-1ubuntu0.15	1