CVE-2026-1703

Low

Advisory

Published 2 Feb 2026In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 2.0; base score, highest
EPSS: 0.004; 34th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,241; of 17,790 indexed, latest versions
Container images: 1,190; deployed by those charts
Fix available: 1 of 2; affected packages

pip Path Traversal vulnerability

Carried by container images the latest versions of 1,241 of 17,790 indexed charts deploy, on 1,190 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+63 more	26.0	1,183
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+25 more	no fix listed	141

OSV records: DEBIAN-CVE-2026-1703 GHSA-6vgw-5pg2-w6jp UBUNTU-CVE-2026-1703
Also known as: PYSEC-2026-1796

Charts affected

1,241 by stars

Chart

Latest

Affected images

Radar Score

fsmopenshift

0.1.8-ubi.6

1 of 6 See more

fsm openshift 0.1.8-ubi.6

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.50.0-88	24352dca6672	pip@9.0.3	26.0

Open the chart page →

16,563

hamiopenshift

2.10.0-r0-openshift.c4e22e88

1 of 2 See more

hami openshift 2.10.0-r0-openshift.c4e22e88

1 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/dynamia-ai/hami-enterprise :v2.10.0-r0-openshift.c4e22e88	745504757300	pip@9.0.3	26.0

Open the chart page →

4,756

orion-ldopenshift

1.0.3

2 of 2 See more

orion-ld openshift 1.0.3

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/fiware/orion-ld :1.0.1	ea838e5b4051	pip@9.0.3	26.0
quay.io/opencloudio/ibm-mongodb :4.0.24	d8c631a6dc43	pip@9.0.3	26.0

Open the chart page →

14,727

osm-edgeopenshift

1.2.1-ubi8

1 of 7 See more

osm-edge openshift 1.2.1-ubi8

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.70.0-46	35d87a381432	pip@9.0.3	26.0

Open the chart page →

19,471

open-webconceptopen-webconcept

0.1.0

1 of 3 See more

open-webconcept open-webconcept 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	pip@23.0.1	26.0

Open the chart page →

3,423

terminalsopen-webui

0.7.0

2 of 2 See more

terminals open-webui 0.7.0

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/open-webui/terminals :latest	5d2fd44366a4	pip@25.0.1	26.0
ghcr.io/open-webui/terminals-operator :latest	6287ce8be502	pip@25.0.1	26.0

Open the chart page →

2,046

openwhiskopenwhisk

1.0.0

2 of 10 See more

openwhisk openwhisk 1.0.0

2 of the 10 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
openwhisk/kafkaprovider :2.1.0	63dc3d2a0904	pip@19.3.1	26.0
openwhisk/ow-utils :1.0.0	c80dba0de3aa	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.4	26.0 no fix listed

Open the chart page →

36,252

osdfir-infrastructureosdfir-infrastructure

2.15.0

8 of 40 See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

8 of the 40 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/openrelik/openrelik-mediator :latest	42efc445b19e	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-metrics :latest	3d0f1ddeebf5	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-server :latest	ce1132261523	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-worker-analyzer-config :latest	1269d3d8d2c2	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-logs :latest	b175cc61959a	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-containers :latest	a6d5abe94706	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed
ghcr.io/openrelik/openrelik-worker-os-creds :latest	7fc7ec101f08	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-plaso :latest	75537ea8c851	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed

Open the chart page →

72,547

mysqlot-container-kit

0.1.0

1 of 1 See more

463

pgaot-container-kit

1.0.3

1 of 6 See more

pga ot-container-kit 1.0.3

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.26.1	b8d5067137fe	pip@24.0	26.0

Open the chart page →

5,143

vmot-container-kit

0.0.3

1 of 7 See more

vm ot-container-kit 0.0.3

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	pip@24.0	26.0

Open the chart page →

5,418

devpiowan-charts

0.1.0

1 of 1 See more

devpi owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
owanio1992/devpi :6.16.0	4ade8e1e4d7e	pip@25.1.1	26.0

Open the chart page →

513

p4p4

0.1.0

1 of 7 See more

27,702

myappp4-helm

0.1.0

1 of 6 See more

19,728

pagespages

1.0.0

1 of 3 See more

20,242

pagespages10

1.0.0

1 of 3 See more

20,242

pagespages111

1.0.0

1 of 3 See more

20,242

pagespages2

1.0.0

1 of 3 See more

20,242

pagespages-alexchmielu

1.0.0

1 of 3 See more

20,242

pagespages-alps

1.0.0

1 of 3 See more

20,242

pagespages-alstom

1.0.0

1 of 3 See more

20,242

pagespages-ambala

1.0.0

1 of 3 See more

20,242

pagespages-andromeda

1.0.0

1 of 3 See more

20,242

pagespagesbadami

1.0.0

1 of 3 See more

20,242

pagespages-blackburn

1.0.0

1 of 3 See more

20,242

pagespages-botes

1.0.0

1 of 3 See more

20,242

pagespages-brian

1.0.0

1 of 3 See more

20,242

pagespages-buckll

1.0.0

1 of 3 See more

20,242

pagespages-camden

1.0.0

1 of 3 See more

20,242

pagespages-camden771

1.0.0

1 of 3 See more

20,242

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,242

pagespages-draco

1.0.0

1 of 3 See more

20,242

pagespages-ellora

1.0.0

1 of 3 See more

20,242

pagespages-finchley

1.0.0

1 of 3 See more

20,242

pagespages-fornax

1.0.0

1 of 3 See more

20,242

pagespages-harsh

1.0.0

1 of 3 See more

20,242

pagespagesk

1.0.0

1 of 3 See more

20,242

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,242

pagespages-mihai

1.0.0

1 of 3 See more

20,242

pagespages-nivesh

1.0.0

1 of 3 See more

20,242

pagespagessandeepgudu

1.0.0

1 of 3 See more

20,242

pagespages-shubhanker

1.0.0

1 of 3 See more

20,242

pagespages-ssharma0909

1.0.0

1 of 3 See more

20,242

pagespages-sucharitha

1.0.0

1 of 3 See more

20,242

pagespages-sudhir

1.0.0

1 of 3 See more

20,242

pagespages-sushi

1.0.0

1 of 3 See more

20,242

pagespages-vasanth5814

1.0.0

1 of 3 See more

20,242

pagespages-vjp

1.0.0

1 of 3 See more

20,242

ctfdpascaliske

2.0.0

1 of 1 See more

2,393

home-assistantpascaliske

0.1.1

1 of 1 See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2025.12.5	9a5a3eb4a213	pip@25.3	26.0

Open the chart page →

4,805

Container images carrying it

1,190 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
mediagis/nominatim :5.3.2	7923a8e67197	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed	1
mediagis/nominatim :3.7	c15e941485ef	pip@20.0.2 python-pip@20.0.2-5ubuntu1.6	26.0 no fix listed	1
mediagis/nominatim :4.2	d0eae7b51374	pip@22.0.2 python-pip@22.0.2+dfsg-1ubuntu0.4	26.0 no fix listed	1
mher/flower :2.0	51c3c3db5be3	pip@23.1.2	26.0	1
middlewareeng/middleware :0.3.1	747d880812f1	pip@23.0.1	26.0	1
milesmcc/shynet :v0.13.1	ba54f7797a6b	pip@22.0.4	26.0	1
milesmcc/shynet :v0.12.0	e821e31140f7	pip@21.2.4	26.0	1
miltex/python-api :1.0.0	dab12a7748d5	pip@20.0.2	26.0	1
mindsdb/mindsdb :latest	163011c09299	pip@23.0.1	26.0	1
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	pip@9.0.3	26.0	1
mintproject/data-catalog :9be70359feabe03ed55bfdbf92c20a7e43ab928b	67d2f2103085	pip@22.0.4	26.0	1
mintproject/model-catalog-fastapi :7dd88dc5bf1fe6a6d4703ea0a077afee45cb2561	02260d20a21f	pip@25.1.1	26.0	1
mirrorgitlabcontainers/gitlab-sidekiq-ce :v13.2.2	94d1431683fa	pip@20.1.1	26.0	1
mirrorgitlabcontainers/gitlab-task-runner-ce :v13.2.2	9efd73993c34	pip@20.1.1	26.0	1
mirrorgitlabcontainers/gitlab-webservice-ce :v13.2.2	30393f990f5c	pip@20.1.1	26.0	1
mnaggar3396/python-app :latest	371d8ed84b15	pip@22.0.4	26.0	1
mohameddev006/web-app :v5	0fbc7360ecf4	pip@22.0.4	26.0	1
mondata/mlflow :v2.3.0.s3.gc	6f94c6caf8bf	pip@23.0.1	26.0	1
moonrailgun/tianji :1.11.2	b528c8f8fcc4	pip@24.0	26.0	1
moreillon/face-recognition-fastapi :x86	bacb2ddd8394	pip@22.2	26.0	1
mozilla/syncserver :latest	016162bf39d8	pip@20.3.4	26.0	1
mozilla/syncstorage-rs :0.15.8	93752877dced	pip@20.3.4	26.0	1
mshanley80/httpbin2022 :latest	5b189a70c0fb	pip@22.3.1 python-pip@20.0.2-5ubuntu1.6	26.0 no fix listed	1
muhammedgamal/fp23 :latest	74b4cd69b6fa	pip@23.0.1	26.0	1
murtazashah46/helmfile :latest	4d11726cf803	pip@23.0.1	26.0	1
mvitale1989/docker-taiga :20191031-4.2.14	1504ccda06df	pip@19.3.1	26.0	1
mysql/mysql-cluster :8.0.20	e4ea36622cdd	pip@19.0.3	26.0	1
nabinchhetri/flask-app :v2.0	be189fbf3411	pip@23.0.1	26.0	1
nathanielvarona/pritunl-slack-app :0.1.10	b746a34e5597	pip@22.2.2	26.0	1
ncsa/checks :main	0b738bbc8d70	pip@24.0	26.0	1
neilpeterson/aks-helloworld :v1	fb47732ef36b	pip@9.0.1	26.0	1
neilpeterson/chart-tweet :latest	64fd8dab075f	pip@9.0.1	26.0	1
neilpeterson/get-tweet :v2	8b645ac1a23e	pip@10.0.1	26.0	1
neilpeterson/osba-container-instances-demo :latest	6527b05d5d03	pip@9.0.1	26.0	1
neilpeterson/osba-cosmos-mongodb-demo :latest	f4940e84ed05	pip@9.0.1	26.0	1
neilpeterson/osba-mysql-demo :latest	5859d68a6c9f	pip@9.0.2	26.0	1
neilpeterson/osba-storage-demo :latest	29d229ab446e	pip@9.0.1	26.0	1
neilpeterson/osba-text-analytics-demo :latest	969af3cb8466	pip@10.0.1	26.0	1
neilpeterson/process-tweet :latest	39ce9f92e899	pip@10.0.1	26.0	1
netbirdio/dashboard :v2.22.2	15a3aab9a345	pip@20.3.4	26.0	1
netbirdio/dashboard :v2.90.10	1b59e1c905c9	pip@20.3.4	26.0	1
netbirdio/dashboard :v2.90.2	332cc31f5f35	pip@20.3.4	26.0	1
netbirdio/dashboard :v2.13.1	88b5fb704a8c	pip@20.3.4	26.0	1
netboxcommunity/netbox :v3.2.8	3d652dca5351	pip@22.2.2	26.0	1
netboxcommunity/netbox :v3.7.8-2.8.0	9bf83b350a89	pip@24.0	26.0	1
neuvector/manager :5.6.1	9e729010b7eb	pip@24.2	26.0	1
ngoduykhanh/powerdns-admin :0.2.3	099371dd9ba6	pip@20.2.3	26.0	1
ngoduykhanh/powerdns-admin :latest	9898a7cf37d2	pip@22.3.1	26.0	1
nlmacamp/check_mk :latest	5dbb8589f824	pip@10.0.1	26.0	1
nousresearch/hermes-agent :v2026.8.27	e0df6adebddf	python-pip@25.1.1+dfsg-1	no fix listed	1