CVE-2026-13346

Medium

Advisory

Published 29 Jul 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.5; base score, highest
EPSS: 0.003; 22nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,333; of 17,790 indexed, latest versions
Container images: 1,284; deployed by those charts
Fix available: 2 of 3; affected packages

Security update for python313-pip

Carried by container images the latest versions of 1,333 of 17,790 indexed charts deploy, on 1,284 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+68 more	26.2	1,277
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+25 more	no fix listed	141
python313-piprpm	24.2-150700.1.1	24.2-150700.3.3.1	2

OSV records: DEBIAN-CVE-2026-13346 PYSEC-2026-3721 UBUNTU-CVE-2026-13346 SUSE-SU-2026:4030-1
Also known as: GHSA-qwm4-qh6w-59xr

Charts affected

1,333 by stars

Chart

Latest

Affected images

Radar Score

tensor_apptensor-app

0.2.2

2 of 3 See more

tensor_app tensor-app 0.2.2

2 of the 3 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	pip@23.0.1	26.2
xeladock/mysql_dns :latest	4baf531453f1	pip@22.0.2 python-pip@22.0.2+dfsg-1	26.2 no fix listed

Open the chart page →

17,590

krokiteochenglim

1.0.1

1 of 5 See more

kroki teochenglim 1.0.1

1 of the 5 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
yuzutech/kroki-blockdiag :0.16.0	7c1917c66d96	pip@21.2.4	26.2

Open the chart page →

8,717

pagestest4322

1.0.0

1 of 3 See more

20,242

flask-contactstest-configmap

1.0.1

2 of 3 See more

flask-contacts test-configmap 1.0.1

2 of the 3 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.2
shashkist/flask-contacts-app :latest	581de1fd6084	pip@24.2	26.2

Open the chart page →

5,789

webapp1test-helm-chart-1

0.1.0

1 of 1 See more

webapp1 test-helm-chart-1 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
devopsjourney1/mywebapp :latest	bd1ec6838570	pip@22.0.4	26.2

Open the chart page →

1,469

asrtest-opea

1.0.0

1 of 1 See more

4,411

chatqnatest-opea

1.0.0

5 of 11 See more

chatqna test-opea 1.0.0

5 of the 11 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
opea/chatqna :1.0	38c51b791efa	pip@24.2	26.2
opea/embedding-tei :1.0	5c9639de61c1	pip@24.0	26.2
opea/llm-tgi :1.0	0c25aab3f106	pip@24.0	26.2
opea/reranking-tei :1.0	e48613afb191	pip@24.2	26.2
opea/retriever-redis :1.0	eb746b263705	pip@24.0	26.2

Open the chart page →

39,273

codegentest-opea

1.0.0

2 of 5 See more

codegen test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
opea/codegen :1.0	58f91683892d	pip@24.2	26.2
opea/llm-tgi :1.0	0c25aab3f106	pip@24.0	26.2

Open the chart page →

28,944

codetranstest-opea

1.0.0

2 of 5 See more

codetrans test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
opea/codetrans :1.0	e2436483b73d	pip@24.2	26.2
opea/llm-tgi :1.0	0c25aab3f106	pip@24.0	26.2

Open the chart page →

28,515

docsumtest-opea

1.0.0

2 of 5 See more

docsum test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
opea/docsum :1.0	3eaa91849512	pip@24.2	26.2
opea/llm-docsum-tgi :1.0	02f9e8fa5d71	pip@24.0	26.2

Open the chart page →

28,990

embedding-usvctest-opea

1.0.0

1 of 1 See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
opea/embedding-tei :1.0	5c9639de61c1	pip@24.0	26.2

Open the chart page →

5,203

guardrails-usvctest-opea

1.0.0

1 of 1 See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
opea/guardrails-tgi :1.0	262c6048aab8	pip@24.2	26.2

Open the chart page →

5,238

llm-uservicetest-opea

1.0.0

1 of 1 See more

4,737

reranking-usvctest-opea

1.0.0

1 of 1 See more

reranking-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
opea/reranking-tei :1.0	e48613afb191	pip@24.2	26.2

Open the chart page →

5,002

retriever-usvctest-opea

1.0.0

1 of 1 See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
opea/retriever-redis :1.0	eb746b263705	pip@24.0	26.2

Open the chart page →

5,215

speecht5test-opea

1.0.0

1 of 1 See more

9,668

ttstest-opea

1.0.0

1 of 1 See more

4,395

web-retrievertest-opea

1.0.0

1 of 1 See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
opea/web-retriever-chroma :1.0	fe08165d7770	pip@24.2	26.2

Open the chart page →

5,368

tezos-nodetezos-node

1.0.0

1 of 4 See more

tezos-node tezos-node 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
oxheadalpha/tezos-k8s-utils :5.3.4	d9faed45bf1c	pip@21.2.4	26.2

Open the chart page →

5,322

thanhvt27-lab-k8sthanh-vt

0.1.4

1 of 5 See more

thanhvt27-lab-k8s thanh-vt 0.1.4

1 of the 5 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
pysga1996/python-redis-web :latest	fdeec30ad482	pip@22.0.4	26.2

Open the chart page →

4,663

kasa-exporterth-charts

0.1.0

1 of 1 See more

kasa-exporter th-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
thelande/kasa_exporter :v0.2.3	a1fdb8baa152	pip@24.0	26.2

Open the chart page →

1,515

pagesthiru-pages

1.0.0

1 of 3 See more

20,242

monitoringthl-charts

0.1.1

1 of 10 See more

monitoring thl-charts 0.1.1

1 of the 10 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.15.6	1f025ae37b7b	pip@21.2.4	26.2

Open the chart page →

18,940

pagesthuy-pages

1.0.0

1 of 3 See more

20,242

jenkinstnh

2.7.1

1 of 2 See more

jenkins tnh 2.7.1

1 of the 2 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
kiwigrid/k8s-sidecar :0.1.193	170069ff0976	pip@20.2.2	26.2

Open the chart page →

4,445

todolist-charttodolist-chart

0.1.7

2 of 10 See more

todolist-chart todolist-chart 0.1.7

2 of the 10 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
erenozcan17/flask_analytics :v3.1	c9b6f0dfbffc	pip@24.0	26.2
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.2

Open the chart page →

7,019

test0tohlejezkouska

0.1.0

1 of 2 See more

test0 tohlejezkouska 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
devopsjourney1/mywebapp :latest	bd1ec6838570	pip@22.0.4	26.2

Open the chart page →

3,318

netbirdtotmicro

1.8.2

1 of 4 See more

netbird totmicro 1.8.2

1 of the 4 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
netbirdio/dashboard :v2.22.2	15a3aab9a345	pip@20.3.4	26.2

Open the chart page →

6,017

traefik-external-dns-controllertraefik-external-dns-operator

2.2.0

1 of 1 See more

traefik-external-dns-controller traefik-external-dns-operator 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
ybucci/traefik-external-dns-controller :2.2.0	8d27ad8b5f73	pip@24.0	26.2

Open the chart page →

1,506

traefik-external-dns-operatortraefik-external-dns-operator

1.0.1

1 of 1 See more

traefik-external-dns-operator traefik-external-dns-operator 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
ybucci/traefik-external-dns-operator :1.0.0	f1fcc7c8d9fd	pip@24.3.1	26.2

Open the chart page →

1,083

synapsetranhailong

0.1.0

1 of 2 See more

synapse tranhailong 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
matrixdotorg/synapse :v1.78.0	def97fd537d8	pip@22.3.1	26.2

Open the chart page →

3,165

orchestratremolo

3.1.56

1 of 5 See more

orchestra tremolo 3.1.56

1 of the 5 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
ghcr.io/tremolosecurity/python-slim-nonroot/python3 :1.0.0	94f64e1f40cb	pip@23.1.2	26.2

Open the chart page →

2,874

tfy-grafanatruefoundry

0.1.21

1 of 3 See more

tfy-grafana truefoundry 0.1.21

1 of the 3 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :2.1.2	716b0b33ff2d	pip@25.3	26.2

Open the chart page →

1,064

truefoundry-monitoringtruefoundry

0.1.6

1 of 8 See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :2.1.2	716b0b33ff2d	pip@25.3	26.2

Open the chart page →

4,544

zookeepertwomartens

0.2.2

1 of 1 See more

zookeeper twomartens 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
confluentinc/cp-zookeeper :latest	7610a50b13e7	pip@9.0.3	26.2

Open the chart page →

1,733

jupyterhubuninettsigma2

1.6.0

1 of 5 See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
quay.io/nird-toolkit/jupyterhub-server :20221215-e6aa80e	cae8c0622533	pip@22.0.4	26.2

Open the chart page →

8,642

phonebook-chartusuladams2

0.2.1

3 of 3 See more

phonebook-chart usuladams2 0.2.1

3 of the 3 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	pip@23.0.1	26.2
paulkellerman/resultserver-app :1.0	381eeccb0618	pip@22.3	26.2
paulkellerman/webserver-app :latest	5a37b74f61b9	pip@22.3	26.2

Open the chart page →

3,176

demo-backendv2fly

0.0.3

1 of 1 See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	pip@23.0.1	26.2

Open the chart page →

14,431

simple-prima-notavcnngr

0.5.3

1 of 4 See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
dpage/pgadmin4 :9.2	52cb72a9e3da	pip@24.3.1	26.2

Open the chart page →

4,770

telegram-rebotvcnngr

1.0.0

2 of 3 See more

telegram-rebot vcnngr 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
vcnngr/telegram-login :latest	1a849a997b6d	pip@24.0	26.2
vcnngr/telegram-rebot :latest	30f1f05e57a6	pip@24.0	26.2

Open the chart page →

5,060

devportalveecode-platform-next

0.1.23

1 of 1 See more

devportal veecode-platform-next 0.1.23

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
veecode/devportaldigest-pinned	a72cf5cb47b8	pip@22.3.1	26.2

Open the chart page →

1,812

unmanicvhdirk

0.1.4

1 of 1 See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
josh5/unmanic :0.2.6	4d49c4816260	pip@22.0.2 python-pip@22.0.2+dfsg-1ubuntu0.4	26.2 no fix listed

Open the chart page →

9,424

browserlessvictorlane

0.2.0

1 of 1 See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.2 no fix listed

Open the chart page →

4,364

bugsinkvictorlane

0.3.7

1 of 2 See more

4,128

pagesvictor-pages

1.0.0

1 of 3 See more

20,242

vinyl-lib-chartvinyl-lib

0.1.0

1 of 1 See more

vinyl-lib-chart vinyl-lib 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
kporwit/vinyl_lib_app :v0.1.1	217de0302218	pip@22.1.2	26.2

Open the chart page →

3,392

calibre-webvista

0.1.3

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	pip@25.2 python-pip@24.0+dfsg-1ubuntu1.2	26.2 no fix listed

Open the chart page →

7,679

vote-appvote-app

1.0.7

1 of 6 See more

vote-app vote-app 1.0.7

1 of the 6 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
thecloudspark/app-vote :1.0	c7da7417a86a	pip@21.1.1	26.2

Open the chart page →

3,031

voteappvoting-app-helm-charts-repo

1.0.0

1 of 5 See more

voteapp voting-app-helm-charts-repo 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
kodekloud/examplevotingapp_vote :v1	3a856afb02a3	pip@22.0.4	26.2

Open the chart page →

8,309

voteappvoting-app-helm-charts-repo-cloud

1.0.0

1 of 5 See more

voteapp voting-app-helm-charts-repo-cloud 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-13346.

Container image	Digest	Package	Fixed in
kodekloud/examplevotingapp_vote :v1	3a856afb02a3	pip@22.0.4	26.2

Open the chart page →

8,309

Container images carrying it

1,284 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/mealie-recipes/mealie :v3.25.1	6066c29eca95	pip@26.0.1	26.2	1
ghcr.io/mealie-recipes/mealie :v1.4.0	b56da41cf178	pip@23.1	26.2	1
ghcr.io/mealie-recipes/mealie :v3.7.0	bb2939094eed	pip@25.0.1	26.2	1
ghcr.io/microboxlabs/miot-harness :0.1.0	d548e9ae4b84	pip@25.0.1	26.2	1
ghcr.io/miguelndecarvalho/speedtest-exporter :v3.2.2	9e36964bce26	pip@21.1.2	26.2	1
ghcr.io/mirio/verbacap :v1.5.0	84928e2fc4f2	pip@23.3.1	26.2	1
ghcr.io/mlops-for-all/mlflow-tracking-server :3.8-1.30.1-v1.0.0	d30e631684c3	pip@23.1.2	26.2	1
ghcr.io/mshade/kronic :v0.1.4	66e3043851cd	pip@24.0	26.2	1
ghcr.io/music-assistant/server :2.7.5	3522e8a7a8f0	pip@25.3	26.2	1
ghcr.io/music-assistant/server :2.9.9	50666a6f8d7f	pip@26.1.2	26.2	1
ghcr.io/music-assistant/server :2.8.7	eef3ee7810d0	pip@25.3	26.2	1
ghcr.io/mweinelt/kea-exporter :v0.7.1	d7b77020e924	pip@25.0.1	26.2	1
ghcr.io/nefelim4ag/pingdom-operator :0.0.15	f8c7afdcf439	pip@24.0	26.2	1
ghcr.io/nicolargo/klances :0.1.3	74d6d33376eb	pip@25.0.1	26.2	1
ghcr.io/noahburrell0/sealed-secrets-ui :v0.1.4	7e7368fb472d	pip@24.3.1	26.2	1
ghcr.io/nowakeai/svc-lb-mux :0.1.3	7d8fb8e996b6	pip@26.1.2	26.2	1
ghcr.io/obeone/ollama-exporter :latest	f43af285c6e0	pip@24.0	26.2	1
ghcr.io/observal/observal-api :1.13.1	153b8b893232	pip@26.1.2	26.2	1
ghcr.io/openappsec/openappsec-waf-webhook :1.1.34	5b979b962043	pip@23.0.1	26.2	1
ghcr.io/opencost/opencost-parquet-exporter :v0.2.1	ce85ef0ce665	pip@24.0	26.2	1
ghcr.io/openrelik/openrelik-mediator :latest	42efc445b19e	pip@25.0.1	26.2	1
ghcr.io/openrelik/openrelik-metrics :latest	3d0f1ddeebf5	pip@25.0.1	26.2	1
ghcr.io/openrelik/openrelik-server :latest	ce1132261523	pip@25.0.1	26.2	1
ghcr.io/openrelik/openrelik-worker-analyzer-config :latest	1269d3d8d2c2	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed	1
ghcr.io/openrelik/openrelik-worker-analyzer-logs :latest	b175cc61959a	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed	1
ghcr.io/openrelik/openrelik-worker-capa :latest	71323a4f3fc5	pip@26.1.2	26.2	1
ghcr.io/openrelik/openrelik-worker-chromecreds :latest	76d4fbcc6ff0	pip@26.1.2	26.2	1
ghcr.io/openrelik/openrelik-worker-cloud-logs :latest	a5d7e3cf71d3	pip@26.1.2	26.2	1
ghcr.io/openrelik/openrelik-worker-containers :latest	a6d5abe94706	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.2 no fix listed	1
ghcr.io/openrelik/openrelik-worker-dfindexeddb :latest	31966a825782	pip@26.1.2	26.2	1
ghcr.io/openrelik/openrelik-worker-floss :latest	7a331eb83c6a	pip@26.1.2	26.2	1
ghcr.io/openrelik/openrelik-worker-grep :latest	470ff3529746	pip@26.1.2	26.2	1
ghcr.io/openrelik/openrelik-worker-os-creds :latest	7fc7ec101f08	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed	1
ghcr.io/openrelik/openrelik-worker-plaso :latest	75537ea8c851	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.2 no fix listed	1
ghcr.io/openrelik/openrelik-worker-strings :latest	6e05055b701f	pip@26.1.2	26.2	1
ghcr.io/openrelik/openrelik-worker-yara :latest	bd7fbf4505b5	pip@26.1.2	26.2	1
ghcr.io/open-telemetry/demo :3.0.0-recommendation	6510027907f9	pip@26.1.2	26.2	1
ghcr.io/open-telemetry/demo :3.0.0-mcp	654f860148ba	pip@26.1.2	26.2	1
ghcr.io/open-telemetry/demo :3.0.0-chatbot	66ba53497f1f	pip@26.1.2	26.2	1
ghcr.io/open-telemetry/demo :1.12.0-loadgenerator	85c9935ff31b	pip@24.2	26.2	1
ghcr.io/open-telemetry/demo :1.12.0-recommendationservice	b294a4278407	pip@24.2	26.2	1
ghcr.io/open-telemetry/demo :3.0.0-agent	df5ee05e23e3	pip@26.1.2	26.2	1
ghcr.io/open-webui/terminals :latest	5d2fd44366a4	pip@25.0.1	26.2	1
ghcr.io/open-webui/terminals-operator :latest	6287ce8be502	pip@25.0.1	26.2	1
ghcr.io/oznu/homebridge :2022-07-08	ff2af53897e7	pip@20.0.2 python-pip@20.0.2-5ubuntu1.6	26.2 no fix listed	1
ghcr.io/paperless-ngx/paperless-ngx :2.13.1	0642357c5dbd	pip@24.2	26.2	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.13	4b05bcd28e69	pip@25.0.1	26.2	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.3	57ad9565bff3	pip@25.0.1	26.2	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.5	665f2f5cc548	pip@25.0.1	26.2	1
ghcr.io/paperless-ngx/paperless-ngx :1.8.0	9bbc9a90641e	pip@20.3.4	26.2	1