CVE-2026-1703

Low

Advisory

Published 2 Feb 2026In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 2.0; base score, highest
EPSS: 0.004; 34th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,241; of 17,787 indexed, latest versions
Container images: 1,190; deployed by those charts
Fix available: 1 of 2; affected packages

pip Path Traversal vulnerability

Carried by container images the latest versions of 1,241 of 17,787 indexed charts deploy, on 1,190 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+63 more	26.0	1,183
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+25 more	no fix listed	141

OSV records: DEBIAN-CVE-2026-1703 GHSA-6vgw-5pg2-w6jp UBUNTU-CVE-2026-1703
Also known as: PYSEC-2026-1796

Charts affected

1,241 by stars

Chart

Latest

Affected images

Radar Score

fsmopenshift

0.1.8-ubi.6

1 of 6 See more

fsm openshift 0.1.8-ubi.6

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.50.0-88	24352dca6672	pip@9.0.3	26.0

Open the chart page →

16,554

hamiopenshift

2.10.0-r0-openshift.c4e22e88

1 of 2 See more

hami openshift 2.10.0-r0-openshift.c4e22e88

1 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/dynamia-ai/hami-enterprise :v2.10.0-r0-openshift.c4e22e88	745504757300	pip@9.0.3	26.0

Open the chart page →

4,749

orion-ldopenshift

1.0.3

2 of 2 See more

orion-ld openshift 1.0.3

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/fiware/orion-ld :1.0.1	ea838e5b4051	pip@9.0.3	26.0
quay.io/opencloudio/ibm-mongodb :4.0.24	d8c631a6dc43	pip@9.0.3	26.0

Open the chart page →

14,727

osm-edgeopenshift

1.2.1-ubi8

1 of 7 See more

osm-edge openshift 1.2.1-ubi8

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.70.0-46	35d87a381432	pip@9.0.3	26.0

Open the chart page →

19,449

open-webconceptopen-webconcept

0.1.0

1 of 3 See more

open-webconcept open-webconcept 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	pip@23.0.1	26.0

Open the chart page →

3,423

terminalsopen-webui

0.7.0

2 of 2 See more

terminals open-webui 0.7.0

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/open-webui/terminals :latest	5d2fd44366a4	pip@25.0.1	26.0
ghcr.io/open-webui/terminals-operator :latest	6287ce8be502	pip@25.0.1	26.0

Open the chart page →

1,998

openwhiskopenwhisk

1.0.0

2 of 10 See more

openwhisk openwhisk 1.0.0

2 of the 10 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
openwhisk/kafkaprovider :2.1.0	63dc3d2a0904	pip@19.3.1	26.0
openwhisk/ow-utils :1.0.0	c80dba0de3aa	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.4	26.0 no fix listed

Open the chart page →

36,230

osdfir-infrastructureosdfir-infrastructure

2.15.0

8 of 40 See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

8 of the 40 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/openrelik/openrelik-mediator :latest	42efc445b19e	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-metrics :latest	3d0f1ddeebf5	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-server :latest	ce1132261523	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-worker-analyzer-config :latest	1269d3d8d2c2	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-logs :latest	b175cc61959a	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-containers :latest	a6d5abe94706	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed
ghcr.io/openrelik/openrelik-worker-os-creds :latest	7fc7ec101f08	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-plaso :latest	75537ea8c851	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed

Open the chart page →

72,154

mysqlot-container-kit

0.1.0

1 of 1 See more

463

pgaot-container-kit

1.0.3

1 of 6 See more

pga ot-container-kit 1.0.3

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.26.1	b8d5067137fe	pip@24.0	26.0

Open the chart page →

5,136

vmot-container-kit

0.0.3

1 of 7 See more

vm ot-container-kit 0.0.3

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	pip@24.0	26.0

Open the chart page →

5,410

devpiowan-charts

0.1.0

1 of 1 See more

devpi owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
owanio1992/devpi :6.16.0	4ade8e1e4d7e	pip@25.1.1	26.0

Open the chart page →

510

p4p4

0.1.0

1 of 7 See more

27,667

myappp4-helm

0.1.0

1 of 6 See more

19,725

pagespages

1.0.0

1 of 3 See more

20,233

pagespages10

1.0.0

1 of 3 See more

20,233

pagespages111

1.0.0

1 of 3 See more

20,233

pagespages2

1.0.0

1 of 3 See more

20,233

pagespages-alexchmielu

1.0.0

1 of 3 See more

20,233

pagespages-alps

1.0.0

1 of 3 See more

20,233

pagespages-alstom

1.0.0

1 of 3 See more

20,233

pagespages-ambala

1.0.0

1 of 3 See more

20,233

pagespages-andromeda

1.0.0

1 of 3 See more

20,233

pagespagesbadami

1.0.0

1 of 3 See more

20,233

pagespages-blackburn

1.0.0

1 of 3 See more

20,233

pagespages-botes

1.0.0

1 of 3 See more

20,233

pagespages-brian

1.0.0

1 of 3 See more

20,233

pagespages-buckll

1.0.0

1 of 3 See more

20,233

pagespages-camden

1.0.0

1 of 3 See more

20,233

pagespages-camden771

1.0.0

1 of 3 See more

20,233

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,233

pagespages-draco

1.0.0

1 of 3 See more

20,233

pagespages-ellora

1.0.0

1 of 3 See more

20,233

pagespages-finchley

1.0.0

1 of 3 See more

20,233

pagespages-fornax

1.0.0

1 of 3 See more

20,233

pagespages-harsh

1.0.0

1 of 3 See more

20,233

pagespagesk

1.0.0

1 of 3 See more

20,233

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,233

pagespages-mihai

1.0.0

1 of 3 See more

20,233

pagespages-nivesh

1.0.0

1 of 3 See more

20,233

pagespagessandeepgudu

1.0.0

1 of 3 See more

20,233

pagespages-shubhanker

1.0.0

1 of 3 See more

20,233

pagespages-ssharma0909

1.0.0

1 of 3 See more

20,233

pagespages-sucharitha

1.0.0

1 of 3 See more

20,233

pagespages-sudhir

1.0.0

1 of 3 See more

20,233

pagespages-sushi

1.0.0

1 of 3 See more

20,233

pagespages-vasanth5814

1.0.0

1 of 3 See more

20,233

pagespages-vjp

1.0.0

1 of 3 See more

20,233

ctfdpascaliske

2.0.0

1 of 1 See more

2,383

home-assistantpascaliske

0.1.1

1 of 1 See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2025.12.5	9a5a3eb4a213	pip@25.3	26.0

Open the chart page →

4,788

Container images carrying it

1,190 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
kiwigrid/k8s-sidecar :1.30.9	8c06e1ba643a	pip@25.2	26.0	2
kodekloud/examplevotingapp_vote :v1	3a856afb02a3	pip@22.0.4	26.0	2
langgenius/dify-sandbox :0.2.0	09b7e8705673	pip@23.0.1	26.0	2
larribas/mlflow :1.9.1	05ccb0b46bfb	pip@20.1	26.0	2
library/mysql :8.2.0	212fe73edca5	pip@20.2.4	26.0	2
library/mysql :9.7.2	b2cf29815e62	pip@25.3	26.0	2
library/python :3.7.0-alpine3.8	e12594db7297	pip@18.1	26.0	2
library/python :3.7	eedf63967cdb	pip@23.0.1	26.0	2
library/python :3.7-alpine	f3d31c8677d0	pip@23.0.1	26.0	2
lncm/specter-desktop :v1.10.5	36eaa06f99f4	pip@21.2.4	26.0	2
locustio/locust :2.32.2	a0d4b88e42c1	pip@24.0	26.0	2
matrixdotorg/pantalaimon :v0.10.4	ba6a587fa508	pip@21.2.4	26.0	2
memgraph/memgraph :3.13.1	bd3fe13228f4	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed	2
minio/operator :v4.3.7	54393e03f3b2	pip@9.0.3	26.0	2
nachomillangarcia/prometheus_aws_cost_exporter :latest	e4ce056f2d6d	pip@18.0	26.0	2
ncsa/checks :1.0.0	abf6300b57b7	pip@20.2.1	26.0	2
neilpeterson/azure-vote-front :v3	84062718347c	pip@9.0.1	26.0	2
ngoduykhanh/powerdns-admin :v0.2.4	ba36ab196d3d	pip@21.3.1	26.0	2
omecproject/kubernetes-synchronizer :comac-1.0.0	7c17a7b1d1ef	pip@18.1	26.0	2
omecproject/mcord-synchronizer :comac-1.0.0	cfdb566dd949	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	26.0 no fix listed	2
opea/embedding-tei :1.0	5c9639de61c1	pip@24.0	26.0	2
opea/reranking-tei :1.0	e48613afb191	pip@24.2	26.0	2
opea/retriever-redis :1.0	eb746b263705	pip@24.0	26.0	2
pypiserver/pypiserver :v1.3.2	303ac89b2aa2	pip@19.3.1	26.0	2
qichenxu4pd/pythonexample :1.0	f3a8502bc21b	pip@24.0	26.0	2
sealife/fritzbox-exporter :1.0	f5cc2f0f4c9b	pip@20.3.3	26.0	2
smartedge/generic-multi-access-network-virtualization :1.0	4cd63c22ce36	pip@20.0.2 python-pip@20.0.2-5ubuntu1.6	26.0 no fix listed	2
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	pip@20.0.2 python-pip@20.0.2-5ubuntu1.10	26.0 no fix listed	2
taigaio/taiga-back :latest	4beed8f62c9f	pip@24.0	26.0	2
taigaio/taiga-protected :latest	fd4568a97a59	pip@24.0	26.0	2
tzahi12345/youtubedl-material :4.3.2 :latest	2f943d584711	pip@22.0.2 python-pip@22.0.2+dfsg-1ubuntu0.2	26.0 no fix listed	2
weblate/weblate :4.2.2-1	69c160d37a3c	pip@20.2.2	26.0	2
gcr.io/k8s-staging-sig-storage/nfs-provisioner :v3.0.0	2de1d15fc1f2	pip@19.0.3	26.0	2
ghcr.io/browserless/chromium :v2.56.7	b1ba7b054af2	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed	2
ghcr.io/dgtlmoon/changedetection.io :0.60.3 :latest	ecacd9fd0c66	pip@24.0	26.0	2
ghcr.io/flaresolverr/flaresolverr :v3.4.6	7962759d99d7	pip@25.2	26.0	2
ghcr.io/flaresolverr/flaresolverr :v3.5.2	c80ae007ce2c	pip@24.0	26.0	2
ghcr.io/flyteorg/flyte-connectors :py3.12-v2.3.6	896fc7b18b1b	pip@25.0.1	26.0	2
ghcr.io/kiwigrid/k8s-sidecar :1.29.1	42002d66ddb3	pip@24.3.1	26.0	2
ghcr.io/miguelndecarvalho/speedtest-exporter :v3.5.4	f1064d49124c	pip@22.3	26.0	2
ghcr.io/rss3-network/agentdata :0.1.0	fd8d3e6e4cdf	pip@24.0	26.0	2
ghcr.io/smarter-project/home-ha-mock :main	95ee018cf558	pip@25.0.1	26.0	2
public.ecr.aws/cloudnatix/llmariner/model-manager-loader :1.27.0	26ac7263a823	pip@25.0.1	26.0	2
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	pip@9.0.3	26.0	2
quay.io/keycloak/keycloak :20.0	054ef67eb7da	pip@9.0.3	26.0	2
quay.io/keycloak/keycloak :17.0.1-legacy	68f9f38c8f30	pip@9.0.3	26.0	2
quay.io/kiwigrid/k8s-sidecar :1.19.2	6a8671702d6f	pip@22.1.2	26.0	2
quay.io/kiwigrid/k8s-sidecar :2.1.2	716b0b33ff2d	pip@25.3	26.0	2
quay.io/kiwigrid/k8s-sidecar :1.26.1	b8d5067137fe	pip@24.0	26.0	2
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	pip@24.0	26.0	2