CVE-2026-1703

Low

Advisory

Published 2 Feb 2026In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 2.0; base score, highest
EPSS: 0.004; 34th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,241; of 17,790 indexed, latest versions
Container images: 1,190; deployed by those charts
Fix available: 1 of 2; affected packages

pip Path Traversal vulnerability

Carried by container images the latest versions of 1,241 of 17,790 indexed charts deploy, on 1,190 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+63 more	26.0	1,183
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+25 more	no fix listed	141

OSV records: DEBIAN-CVE-2026-1703 GHSA-6vgw-5pg2-w6jp UBUNTU-CVE-2026-1703
Also known as: PYSEC-2026-1796

Charts affected

1,241 by stars

Chart

Latest

Affected images

Radar Score

fsmopenshift

0.1.8-ubi.6

1 of 6 See more

fsm openshift 0.1.8-ubi.6

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.50.0-88	24352dca6672	pip@9.0.3	26.0

Open the chart page →

16,563

hamiopenshift

2.10.0-r0-openshift.c4e22e88

1 of 2 See more

hami openshift 2.10.0-r0-openshift.c4e22e88

1 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/dynamia-ai/hami-enterprise :v2.10.0-r0-openshift.c4e22e88	745504757300	pip@9.0.3	26.0

Open the chart page →

4,756

orion-ldopenshift

1.0.3

2 of 2 See more

orion-ld openshift 1.0.3

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/fiware/orion-ld :1.0.1	ea838e5b4051	pip@9.0.3	26.0
quay.io/opencloudio/ibm-mongodb :4.0.24	d8c631a6dc43	pip@9.0.3	26.0

Open the chart page →

14,727

osm-edgeopenshift

1.2.1-ubi8

1 of 7 See more

osm-edge openshift 1.2.1-ubi8

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.70.0-46	35d87a381432	pip@9.0.3	26.0

Open the chart page →

19,471

open-webconceptopen-webconcept

0.1.0

1 of 3 See more

open-webconcept open-webconcept 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	pip@23.0.1	26.0

Open the chart page →

3,423

terminalsopen-webui

0.7.0

2 of 2 See more

terminals open-webui 0.7.0

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/open-webui/terminals :latest	5d2fd44366a4	pip@25.0.1	26.0
ghcr.io/open-webui/terminals-operator :latest	6287ce8be502	pip@25.0.1	26.0

Open the chart page →

2,046

openwhiskopenwhisk

1.0.0

2 of 10 See more

openwhisk openwhisk 1.0.0

2 of the 10 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
openwhisk/kafkaprovider :2.1.0	63dc3d2a0904	pip@19.3.1	26.0
openwhisk/ow-utils :1.0.0	c80dba0de3aa	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.4	26.0 no fix listed

Open the chart page →

36,252

osdfir-infrastructureosdfir-infrastructure

2.15.0

8 of 40 See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

8 of the 40 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/openrelik/openrelik-mediator :latest	42efc445b19e	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-metrics :latest	3d0f1ddeebf5	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-server :latest	ce1132261523	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-worker-analyzer-config :latest	1269d3d8d2c2	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-logs :latest	b175cc61959a	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-containers :latest	a6d5abe94706	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed
ghcr.io/openrelik/openrelik-worker-os-creds :latest	7fc7ec101f08	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-plaso :latest	75537ea8c851	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed

Open the chart page →

72,547

mysqlot-container-kit

0.1.0

1 of 1 See more

463

pgaot-container-kit

1.0.3

1 of 6 See more

pga ot-container-kit 1.0.3

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.26.1	b8d5067137fe	pip@24.0	26.0

Open the chart page →

5,143

vmot-container-kit

0.0.3

1 of 7 See more

vm ot-container-kit 0.0.3

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	pip@24.0	26.0

Open the chart page →

5,418

devpiowan-charts

0.1.0

1 of 1 See more

devpi owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
owanio1992/devpi :6.16.0	4ade8e1e4d7e	pip@25.1.1	26.0

Open the chart page →

513

p4p4

0.1.0

1 of 7 See more

27,702

myappp4-helm

0.1.0

1 of 6 See more

19,728

pagespages

1.0.0

1 of 3 See more

20,242

pagespages10

1.0.0

1 of 3 See more

20,242

pagespages111

1.0.0

1 of 3 See more

20,242

pagespages2

1.0.0

1 of 3 See more

20,242

pagespages-alexchmielu

1.0.0

1 of 3 See more

20,242

pagespages-alps

1.0.0

1 of 3 See more

20,242

pagespages-alstom

1.0.0

1 of 3 See more

20,242

pagespages-ambala

1.0.0

1 of 3 See more

20,242

pagespages-andromeda

1.0.0

1 of 3 See more

20,242

pagespagesbadami

1.0.0

1 of 3 See more

20,242

pagespages-blackburn

1.0.0

1 of 3 See more

20,242

pagespages-botes

1.0.0

1 of 3 See more

20,242

pagespages-brian

1.0.0

1 of 3 See more

20,242

pagespages-buckll

1.0.0

1 of 3 See more

20,242

pagespages-camden

1.0.0

1 of 3 See more

20,242

pagespages-camden771

1.0.0

1 of 3 See more

20,242

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,242

pagespages-draco

1.0.0

1 of 3 See more

20,242

pagespages-ellora

1.0.0

1 of 3 See more

20,242

pagespages-finchley

1.0.0

1 of 3 See more

20,242

pagespages-fornax

1.0.0

1 of 3 See more

20,242

pagespages-harsh

1.0.0

1 of 3 See more

20,242

pagespagesk

1.0.0

1 of 3 See more

20,242

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,242

pagespages-mihai

1.0.0

1 of 3 See more

20,242

pagespages-nivesh

1.0.0

1 of 3 See more

20,242

pagespagessandeepgudu

1.0.0

1 of 3 See more

20,242

pagespages-shubhanker

1.0.0

1 of 3 See more

20,242

pagespages-ssharma0909

1.0.0

1 of 3 See more

20,242

pagespages-sucharitha

1.0.0

1 of 3 See more

20,242

pagespages-sudhir

1.0.0

1 of 3 See more

20,242

pagespages-sushi

1.0.0

1 of 3 See more

20,242

pagespages-vasanth5814

1.0.0

1 of 3 See more

20,242

pagespages-vjp

1.0.0

1 of 3 See more

20,242

ctfdpascaliske

2.0.0

1 of 1 See more

2,393

home-assistantpascaliske

0.1.1

1 of 1 See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2025.12.5	9a5a3eb4a213	pip@25.3	26.0

Open the chart page →

4,805

Container images carrying it

1,190 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
taigaio/taiga-back :6.4.2	9f97323cc150	pip@21.2.4	26.0	1
taigaio/taiga-protected :6.4.0	36318831b3e7	pip@21.2.4	26.0	1
tautulli/tautulli :v2.7.7	c4da15f058ea	pip@21.2.4	26.0	1
teknas09/bird-pod :latest	12a1fa85c4aa	pip@24.0	26.0	1
temporalio/admin-tools :1.22.4	258958fe2ff2	pip@23.1.2	26.0	1
temporalio/admin-tools :1.15.1	35034611d981	pip@20.3.4	26.0	1
temporalio/admin-tools :1.26.2	37e2e33dbd7b	pip@24.0	26.0	1
temporalio/admin-tools :1.22.0	836af062af30	pip@23.1.2	26.0	1
temporalio/admin-tools :1.25.0-tctl-1.18.1-cli-1.0.0	cda4901bab53	pip@23.3.1	26.0	1
tenableofficial/nessus :latest	c88e43fe1a8c	pip@9.0.3	26.0	1
tensorflow/tensorflow :1.6.0-devel	1e3172090703	pip@9.0.1	26.0	1
thecloudspark/app-vote :1.0	c7da7417a86a	pip@21.1.1	26.0	1
thelande/kasa_exporter :v0.2.3	a1fdb8baa152	pip@24.0	26.0	1
thijsvanloef/palworld-server-docker :v2.7.1	401d3eb5c053	pip@25.1.1 python-pip@25.1.1+dfsg-1	26.0 no fix listed	1
thijsvanloef/palworld-server-docker :v2.5.0	b4ac9ee22483	pip@25.1.1 python-pip@25.1.1+dfsg-1	26.0 no fix listed	1
thingsboard/toolbox :1.13.0	1bd61a0da6d3	pip@23.1.2	26.0	1
thongngo3301/stakefish :latest	a341af5976e3	pip@23.2.1	26.0	1
timescale/timescaledb-ha :pg16	d7db8f1085a3	pip@22.0.2 python-pip@22.0.2+dfsg-1ubuntu0.7	26.0 no fix listed	1
timescale/timescaledb-ha :pg17.2-ts2.18.2	e8d0a9cc3db5	pip@22.0.2 python-pip@22.0.2+dfsg-1ubuntu0.5	26.0 no fix listed	1
timothyclarke/wptagent :2018-01-23	22c41e5ca7e2	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	26.0 no fix listed	1
tobiasbp/db-backup :0.0.3	14bee6e33a26	pip@20.1.1	26.0	1
tock/gen-ai-orchestrator-server :25.10.7	abf7880e0449	pip@24.0	26.0	1
tomsajan/netio-exporter :0.0.5	fb61907707b8	pip@24.0	26.0	1
tomsquest/docker-radicale :3.1.1.0	4759cc353a1d	pip@21.3.1	26.0	1
tomsquest/docker-radicale :3.6.1.0	a594c624c5a6	pip@25.0.1	26.0	1
treskon/portrait-web-setup :DEV-latest	a475d80e4ecf	pip@24.3.1	26.0	1
trungkien210493/icinga2-report :v1.7.1	2cc8c3763c4c	pip@20.1.1	26.0	1
tussanakorndev/kube-pod-alerts :1.0.5	216fdadadf9a	pip@25.0.1	26.0	1
ubcctlt/barman :v2.19	cbbbbc8ae16b	pip@22.0.4	26.0	1
vabene1111/recipes :2.3.5	0f8d061895e9	pip@25.3	26.0	1
vabene1111/recipes :1.0.5.2	ec4e9e2905b0	pip@21.3.1	26.0	1
vcnngr/telegram-login :latest	1a849a997b6d	pip@24.0	26.0	1
vcnngr/telegram-rebot :latest	30f1f05e57a6	pip@24.0	26.0	1
veecode/devportal	a72cf5cb47b8	pip@22.3.1	26.0	1
viadee/docker-hub-rate-limit-exporter :version-1.5	2e27e3b3ee56	pip@21.0	26.0	1
voltha/voltha-cli :1.6.0	c4e41e92f046	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	26.0 no fix listed	1
voltha/voltha-netconf :1.6.0	37f80524c207	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	26.0 no fix listed	1
voltha/voltha-ofagent :1.6.0	9ee8c1f4428c	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	26.0 no fix listed	1
voltha/voltha-tester :1.7.0	655c3048a602	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	26.0 no fix listed	1
voltha/voltha-voltha :1.6.0	ff596b62de59	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	26.0 no fix listed	1
wallarm/aih-scanner :2.7.11	f1cb26db1f5b	pip@25.1.1 python-pip@25.1.1+dfsg-1	26.0 no fix listed	1
wallarm/sysbindings :v0.9.9	c527865df85d	pip@22.2.1	26.0	1
wazuh/wazuh-manager :4.11.1	1da5c38c6a78	pip@23.3.2	26.0	1
wazuh/wazuh-manager :4.4.1	21994f40e0da	pip@23.0.1	26.0	1
wazuh/wazuh-manager :4.14.4	5a065930682d	pip@23.3.2	26.0	1
wazuh/wazuh-manager :4.14.3	f09282d281f6	pip@23.3.2	26.0	1
weblate/weblate :3.11.3-1	82848df56ecd	pip@18.1	26.0	1
wiktorn/overpass-api :latest	9bb5f4a9b54c	pip@23.0.1 python-pip@23.0.1+dfsg-1	26.0 no fix listed	1
wiremind/pghoard :12-2019-11-26	4dea42c8166c	pip@19.3.1	26.0	1
witcherek7/pav :0.0.3	42a744f29ac0	pip@22.3.1	26.0	1