CVE-2026-1703

Low

Advisory

Published 2 Feb 2026In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 2.0; base score, highest
EPSS: 0.004; 34th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,241; of 17,790 indexed, latest versions
Container images: 1,190; deployed by those charts
Fix available: 1 of 2; affected packages

pip Path Traversal vulnerability

Carried by container images the latest versions of 1,241 of 17,790 indexed charts deploy, on 1,190 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+63 more	26.0	1,183
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+25 more	no fix listed	141

OSV records: DEBIAN-CVE-2026-1703 GHSA-6vgw-5pg2-w6jp UBUNTU-CVE-2026-1703
Also known as: PYSEC-2026-1796

Charts affected

1,241 by stars

Chart

Latest

Affected images

Radar Score

fsmopenshift

0.1.8-ubi.6

1 of 6 See more

fsm openshift 0.1.8-ubi.6

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.50.0-88	24352dca6672	pip@9.0.3	26.0

Open the chart page →

16,563

hamiopenshift

2.10.0-r0-openshift.c4e22e88

1 of 2 See more

hami openshift 2.10.0-r0-openshift.c4e22e88

1 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/dynamia-ai/hami-enterprise :v2.10.0-r0-openshift.c4e22e88	745504757300	pip@9.0.3	26.0

Open the chart page →

4,756

orion-ldopenshift

1.0.3

2 of 2 See more

orion-ld openshift 1.0.3

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/fiware/orion-ld :1.0.1	ea838e5b4051	pip@9.0.3	26.0
quay.io/opencloudio/ibm-mongodb :4.0.24	d8c631a6dc43	pip@9.0.3	26.0

Open the chart page →

14,727

osm-edgeopenshift

1.2.1-ubi8

1 of 7 See more

osm-edge openshift 1.2.1-ubi8

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.70.0-46	35d87a381432	pip@9.0.3	26.0

Open the chart page →

19,471

open-webconceptopen-webconcept

0.1.0

1 of 3 See more

open-webconcept open-webconcept 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	pip@23.0.1	26.0

Open the chart page →

3,423

terminalsopen-webui

0.7.0

2 of 2 See more

terminals open-webui 0.7.0

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/open-webui/terminals :latest	5d2fd44366a4	pip@25.0.1	26.0
ghcr.io/open-webui/terminals-operator :latest	6287ce8be502	pip@25.0.1	26.0

Open the chart page →

2,046

openwhiskopenwhisk

1.0.0

2 of 10 See more

openwhisk openwhisk 1.0.0

2 of the 10 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
openwhisk/kafkaprovider :2.1.0	63dc3d2a0904	pip@19.3.1	26.0
openwhisk/ow-utils :1.0.0	c80dba0de3aa	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.4	26.0 no fix listed

Open the chart page →

36,252

osdfir-infrastructureosdfir-infrastructure

2.15.0

8 of 40 See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

8 of the 40 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/openrelik/openrelik-mediator :latest	42efc445b19e	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-metrics :latest	3d0f1ddeebf5	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-server :latest	ce1132261523	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-worker-analyzer-config :latest	1269d3d8d2c2	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-logs :latest	b175cc61959a	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-containers :latest	a6d5abe94706	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed
ghcr.io/openrelik/openrelik-worker-os-creds :latest	7fc7ec101f08	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-plaso :latest	75537ea8c851	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed

Open the chart page →

72,547

mysqlot-container-kit

0.1.0

1 of 1 See more

463

pgaot-container-kit

1.0.3

1 of 6 See more

pga ot-container-kit 1.0.3

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.26.1	b8d5067137fe	pip@24.0	26.0

Open the chart page →

5,143

vmot-container-kit

0.0.3

1 of 7 See more

vm ot-container-kit 0.0.3

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	pip@24.0	26.0

Open the chart page →

5,418

devpiowan-charts

0.1.0

1 of 1 See more

devpi owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
owanio1992/devpi :6.16.0	4ade8e1e4d7e	pip@25.1.1	26.0

Open the chart page →

513

p4p4

0.1.0

1 of 7 See more

27,702

myappp4-helm

0.1.0

1 of 6 See more

19,728

pagespages

1.0.0

1 of 3 See more

20,242

pagespages10

1.0.0

1 of 3 See more

20,242

pagespages111

1.0.0

1 of 3 See more

20,242

pagespages2

1.0.0

1 of 3 See more

20,242

pagespages-alexchmielu

1.0.0

1 of 3 See more

20,242

pagespages-alps

1.0.0

1 of 3 See more

20,242

pagespages-alstom

1.0.0

1 of 3 See more

20,242

pagespages-ambala

1.0.0

1 of 3 See more

20,242

pagespages-andromeda

1.0.0

1 of 3 See more

20,242

pagespagesbadami

1.0.0

1 of 3 See more

20,242

pagespages-blackburn

1.0.0

1 of 3 See more

20,242

pagespages-botes

1.0.0

1 of 3 See more

20,242

pagespages-brian

1.0.0

1 of 3 See more

20,242

pagespages-buckll

1.0.0

1 of 3 See more

20,242

pagespages-camden

1.0.0

1 of 3 See more

20,242

pagespages-camden771

1.0.0

1 of 3 See more

20,242

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,242

pagespages-draco

1.0.0

1 of 3 See more

20,242

pagespages-ellora

1.0.0

1 of 3 See more

20,242

pagespages-finchley

1.0.0

1 of 3 See more

20,242

pagespages-fornax

1.0.0

1 of 3 See more

20,242

pagespages-harsh

1.0.0

1 of 3 See more

20,242

pagespagesk

1.0.0

1 of 3 See more

20,242

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,242

pagespages-mihai

1.0.0

1 of 3 See more

20,242

pagespages-nivesh

1.0.0

1 of 3 See more

20,242

pagespagessandeepgudu

1.0.0

1 of 3 See more

20,242

pagespages-shubhanker

1.0.0

1 of 3 See more

20,242

pagespages-ssharma0909

1.0.0

1 of 3 See more

20,242

pagespages-sucharitha

1.0.0

1 of 3 See more

20,242

pagespages-sudhir

1.0.0

1 of 3 See more

20,242

pagespages-sushi

1.0.0

1 of 3 See more

20,242

pagespages-vasanth5814

1.0.0

1 of 3 See more

20,242

pagespages-vjp

1.0.0

1 of 3 See more

20,242

ctfdpascaliske

2.0.0

1 of 1 See more

2,393

home-assistantpascaliske

0.1.1

1 of 1 See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2025.12.5	9a5a3eb4a213	pip@25.3	26.0

Open the chart page →

4,805

Container images carrying it

1,190 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
xeladock/mysql_dns :latest	4baf531453f1	pip@22.0.2 python-pip@22.0.2+dfsg-1	26.0 no fix listed	1
ybucci/traefik-external-dns-controller :2.2.0	8d27ad8b5f73	pip@24.0	26.0	1
ybucci/traefik-external-dns-operator :1.0.0	f1fcc7c8d9fd	pip@24.3.1	26.0	1
ygqygq2/mysql-exec-sql :latest	54f30def1558	pip@20.2.4	26.0	1
youssef11gaber10/deployment-weather-flask :latest	96bce8b8b5a7	pip@23.0.1	26.0	1
youssef11gaber10/flask-service :latest	9c727fcfde76	pip@24.0	26.0	1
yugabytedb/yugabyte :2026.1.1.1-b2	3926eedf0ff4	pip@9.0.3	26.0	1
yugabytedb/yugabyte :2026.1.1.0-b91	de2e00278645	pip@9.0.3	26.0	1
yuzutech/kroki-blockdiag :0.16.0	7c1917c66d96	pip@21.2.4	26.0	1
zepai/knowledge-graph-mcp :v0.2.1	6ab0ee79926b	pip@25.0.1	26.0	1
zohardocker12/weather_app_flask :latest	b86d60dbb68d	pip@21.1.3	26.0	1
zurdi15/romm :2.3.1	2db88fe44c89	pip@23.3.2	26.0	1
gcr.io/getindata-images-public/mlflow :latest	25d6975951f1	pip@24.0	26.0	1
gcr.io/google-samples/microservices-demo/loadgenerator :v0.2.3	360130ab5850	pip@21.0.1	26.0	1
gcr.io/google-samples/microservices-demo/recommendationservice :v0.2.3	5f60c4988859	pip@21.0.1	26.0	1
gcr.io/kubecost1/kubecost-modeling :v0.1.24	a2259b098b13	pip@25.0.1	26.0	1
gcr.io/kubecost1/kubecost-modeling :v0.1.22	a461dc5cb96a	pip@24.3.1	26.0	1
gcr.io/ml-pipeline/metadata-writer :2.3.0	9bcfd2abc361	pip@23.0.1	26.0	1
gcr.io/ml-pipeline/metadata-writer :2.0.0-alpha.5	ec3ae9f6df47	pip@22.0.4	26.0	1
gcr.io/rotationalio-habanero/imgtag :89ec287	a534a3170d03	pip@25.0.1	26.0	1
ghcr.io/akpw/mktxp :1.2.17	bd6f22f7db0a	pip@25.3	26.0	1
ghcr.io/almarklein/timetagger :v26.1.3-nonroot	18a81afcb249	pip@25.3	26.0	1
ghcr.io/angelscloud/prometheus-optimizer :latest	744bc929a579	pip@23.0.1	26.0	1
ghcr.io/appuio/maxscale-docker :6.4.6	13a01be102b0	pip@9.0.3	26.0	1
ghcr.io/avistotelecom/docker-wazuh-agent :4.12.0	8766ba08bf1a	pip@23.0.1 python-pip@23.0.1+dfsg-1	26.0 no fix listed	1
ghcr.io/aws-exporters/prometheus-ecr-exporter :0.1.4	42b0c87470d6	pip@20.3.4	26.0	1
ghcr.io/aws-exporters/prometheus-inspector-exporter :0.0.2	9c7c11293b3c	pip@20.3.4	26.0	1
ghcr.io/axoflow/axosyslog :4.5.0	aa7831e207cd	pip@23.3.1	26.0	1
ghcr.io/bensoer/external-secrets-reloader :v0.1.3	8e31b5a81853	pip@24.0	26.0	1
ghcr.io/bensoer/sibyl :v0.2.0	6dca4455fde3	pip@24.0	26.0	1
ghcr.io/berriai/litellm-database :litellm_stable_release_branch-v1.75.5-stable	ab63d26a8a2c	pip@25.2	26.0	1
ghcr.io/b-it-projects-gmbh/nvme_exporter :latest	e70307b193c6	pip@23.0.1	26.0	1
ghcr.io/blakeblackshear/frigate :0.14.1	22e3d0b486df	pip@24.2	26.0	1
ghcr.io/blakeblackshear/frigate :0.13.0	7a5244e4c8dc	pip@20.3.4	26.0	1
ghcr.io/blakeblackshear/frigate :0.12.0	c862771e38e8	pip@20.3.4	26.0	1
ghcr.io/borgmatic-collective/borgmatic :1.9.9	835b72878606	pip@25.0	26.0	1
ghcr.io/browserless/chrome :v2.56.7	d600eac6283f	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed	1
ghcr.io/browserless/chromium :v2.55.4	2ed0183564d7	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed	1
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed	1
ghcr.io/caas-team/py-kube-downscaler :26.4.0	af05a098b0d2	pip@25.0.1	26.0	1
ghcr.io/camptocamp/tetragon-policy-builder :master	0e99f12bb040	pip@24.3.1	26.0	1
ghcr.io/cfi2017/opencve-scheduler :3.0.0	8d943799621b	pip@24.3.1	26.0	1
ghcr.io/cfi2017/opencve-web :3.0.0	6961eab190a2	pip@25.0.1	26.0	1
ghcr.io/cjmalloy/jasper :v1.3.282	726a947bb65b	pip@23.0.1 python-pip@23.0.1+dfsg-1	26.0 no fix listed	1
ghcr.io/cleanuparr/cleanuparr :2.10.6	8136c3beda7a	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed	1
ghcr.io/cloudnative-pg/postgresql :18	899d3ed526b6	pip@20.3.4	26.0	1
ghcr.io/cloudnative-pg/postgresql :14.5	b3b30d04b362	pip@20.3.4	26.0	1
ghcr.io/colenio/slo-reporting :0.3.31	6b64d194a27d	pip@24.3.1	26.0	1
ghcr.io/cosmo-tech/cosmotech-copilot-api :latest	a2be95de450c	pip@23.0.1	26.0	1
ghcr.io/cosmo-workspace/dev-code-server :v0.0.3	16fda01ae58a	pip@24.2	26.0	1