CVE-2026-1703

Low

Advisory

Published 2 Feb 2026In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 2.0; base score, highest
EPSS: 0.004; 34th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,241; of 17,790 indexed, latest versions
Container images: 1,190; deployed by those charts
Fix available: 1 of 2; affected packages

pip Path Traversal vulnerability

Carried by container images the latest versions of 1,241 of 17,790 indexed charts deploy, on 1,190 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+63 more	26.0	1,183
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+25 more	no fix listed	141

OSV records: DEBIAN-CVE-2026-1703 GHSA-6vgw-5pg2-w6jp UBUNTU-CVE-2026-1703
Also known as: PYSEC-2026-1796

Charts affected

1,241 by stars

Chart

Latest

Affected images

Radar Score

fsmopenshift

0.1.8-ubi.6

1 of 6 See more

fsm openshift 0.1.8-ubi.6

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.50.0-88	24352dca6672	pip@9.0.3	26.0

Open the chart page →

16,563

hamiopenshift

2.10.0-r0-openshift.c4e22e88

1 of 2 See more

hami openshift 2.10.0-r0-openshift.c4e22e88

1 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/dynamia-ai/hami-enterprise :v2.10.0-r0-openshift.c4e22e88	745504757300	pip@9.0.3	26.0

Open the chart page →

4,756

orion-ldopenshift

1.0.3

2 of 2 See more

orion-ld openshift 1.0.3

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/fiware/orion-ld :1.0.1	ea838e5b4051	pip@9.0.3	26.0
quay.io/opencloudio/ibm-mongodb :4.0.24	d8c631a6dc43	pip@9.0.3	26.0

Open the chart page →

14,727

osm-edgeopenshift

1.2.1-ubi8

1 of 7 See more

osm-edge openshift 1.2.1-ubi8

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.70.0-46	35d87a381432	pip@9.0.3	26.0

Open the chart page →

19,471

open-webconceptopen-webconcept

0.1.0

1 of 3 See more

open-webconcept open-webconcept 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	pip@23.0.1	26.0

Open the chart page →

3,423

terminalsopen-webui

0.7.0

2 of 2 See more

terminals open-webui 0.7.0

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/open-webui/terminals :latest	5d2fd44366a4	pip@25.0.1	26.0
ghcr.io/open-webui/terminals-operator :latest	6287ce8be502	pip@25.0.1	26.0

Open the chart page →

2,046

openwhiskopenwhisk

1.0.0

2 of 10 See more

openwhisk openwhisk 1.0.0

2 of the 10 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
openwhisk/kafkaprovider :2.1.0	63dc3d2a0904	pip@19.3.1	26.0
openwhisk/ow-utils :1.0.0	c80dba0de3aa	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.4	26.0 no fix listed

Open the chart page →

36,252

osdfir-infrastructureosdfir-infrastructure

2.15.0

8 of 40 See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

8 of the 40 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/openrelik/openrelik-mediator :latest	42efc445b19e	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-metrics :latest	3d0f1ddeebf5	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-server :latest	ce1132261523	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-worker-analyzer-config :latest	1269d3d8d2c2	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-logs :latest	b175cc61959a	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-containers :latest	a6d5abe94706	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed
ghcr.io/openrelik/openrelik-worker-os-creds :latest	7fc7ec101f08	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-plaso :latest	75537ea8c851	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed

Open the chart page →

72,547

mysqlot-container-kit

0.1.0

1 of 1 See more

463

pgaot-container-kit

1.0.3

1 of 6 See more

pga ot-container-kit 1.0.3

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.26.1	b8d5067137fe	pip@24.0	26.0

Open the chart page →

5,143

vmot-container-kit

0.0.3

1 of 7 See more

vm ot-container-kit 0.0.3

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	pip@24.0	26.0

Open the chart page →

5,418

devpiowan-charts

0.1.0

1 of 1 See more

devpi owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
owanio1992/devpi :6.16.0	4ade8e1e4d7e	pip@25.1.1	26.0

Open the chart page →

513

p4p4

0.1.0

1 of 7 See more

27,702

myappp4-helm

0.1.0

1 of 6 See more

19,728

pagespages

1.0.0

1 of 3 See more

20,242

pagespages10

1.0.0

1 of 3 See more

20,242

pagespages111

1.0.0

1 of 3 See more

20,242

pagespages2

1.0.0

1 of 3 See more

20,242

pagespages-alexchmielu

1.0.0

1 of 3 See more

20,242

pagespages-alps

1.0.0

1 of 3 See more

20,242

pagespages-alstom

1.0.0

1 of 3 See more

20,242

pagespages-ambala

1.0.0

1 of 3 See more

20,242

pagespages-andromeda

1.0.0

1 of 3 See more

20,242

pagespagesbadami

1.0.0

1 of 3 See more

20,242

pagespages-blackburn

1.0.0

1 of 3 See more

20,242

pagespages-botes

1.0.0

1 of 3 See more

20,242

pagespages-brian

1.0.0

1 of 3 See more

20,242

pagespages-buckll

1.0.0

1 of 3 See more

20,242

pagespages-camden

1.0.0

1 of 3 See more

20,242

pagespages-camden771

1.0.0

1 of 3 See more

20,242

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,242

pagespages-draco

1.0.0

1 of 3 See more

20,242

pagespages-ellora

1.0.0

1 of 3 See more

20,242

pagespages-finchley

1.0.0

1 of 3 See more

20,242

pagespages-fornax

1.0.0

1 of 3 See more

20,242

pagespages-harsh

1.0.0

1 of 3 See more

20,242

pagespagesk

1.0.0

1 of 3 See more

20,242

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,242

pagespages-mihai

1.0.0

1 of 3 See more

20,242

pagespages-nivesh

1.0.0

1 of 3 See more

20,242

pagespagessandeepgudu

1.0.0

1 of 3 See more

20,242

pagespages-shubhanker

1.0.0

1 of 3 See more

20,242

pagespages-ssharma0909

1.0.0

1 of 3 See more

20,242

pagespages-sucharitha

1.0.0

1 of 3 See more

20,242

pagespages-sudhir

1.0.0

1 of 3 See more

20,242

pagespages-sushi

1.0.0

1 of 3 See more

20,242

pagespages-vasanth5814

1.0.0

1 of 3 See more

20,242

pagespages-vjp

1.0.0

1 of 3 See more

20,242

ctfdpascaliske

2.0.0

1 of 1 See more

2,393

home-assistantpascaliske

0.1.1

1 of 1 See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2025.12.5	9a5a3eb4a213	pip@25.3	26.0

Open the chart page →

4,805

Container images carrying it

1,190 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/immich-app/immich-machine-learning :v3.1.0	5a0839dc5303	pip@24.0	26.0	1
ghcr.io/itobey/playlist-mirror :1.0.0	601082677a46	pip@25.0.1	26.0	1
ghcr.io/jaydee94/kubeseal-webgui/api :4.5.3	3cceb9462ae1	pip@25.0.1	26.0	1
ghcr.io/juicerescue/juicepassproxy :0.5.1	984dc4f19162	pip@25.0.1	26.0	1
ghcr.io/kubeflow/spark-operator/controller :2.2.1	865ff4da5686	pip@20.0.2 python-pip@20.0.2-5ubuntu1.11	26.0 no fix listed	1
ghcr.io/kubeshop/k8s-sidecar :ignore-initial-events	7f583a36a764	pip@22.2.2	26.0	1
ghcr.io/kubevoip/kubevoip :v0.6.8	41c603a93642	pip@25.0.1	26.0	1
ghcr.io/kubiyabot/agent-manager :v0.4.13	757bdd779345	pip@24.0	26.0	1
ghcr.io/kubiyabot/sdk-py :v1.20.0	f108f49570cc	pip@23.1.2	26.0	1
ghcr.io/leoquote/tinyproxy_exporter :master	6b4103d88dbb	pip@21.2.4	26.0	1
ghcr.io/leprechaun/owntracks-exporter :0.1.11-de545066	099e1abd6d08	pip@23.2.1	26.0	1
ghcr.io/lerentis/bitwarden-crd-operator :0.17.0	0a608c6ead85	pip@25.1.1	26.0	1
ghcr.io/libretime/libretime-analyzer :latest	3d5e236216ad	pip@23.0.1	26.0	1
ghcr.io/libretime/libretime-api :latest	eae026cc8909	pip@23.0.1	26.0	1
ghcr.io/libretime/libretime-playout :latest	71a8706531aa	pip@23.0.1	26.0	1
ghcr.io/libretime/libretime-worker :latest	d39ff5272b2e	pip@23.0.1	26.0	1
ghcr.io/linuxserver/calibre-web :0.6.26	7c0464228f2f	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed	1
ghcr.io/linuxserver/healthchecks :version-v3.9	b5c6bfb00b03	pip@25.1.1	26.0	1
ghcr.io/linuxserver/mylar3 :version-v0.5.3	b96f0e97ab3f	pip@21.1.3	26.0	1
ghcr.io/liturgical-app/calendar-api :0.0.9	688a685e2bde	pip@25.0.1	26.0	1
ghcr.io/liturgical-app/liturgical-api :1.0.12	637bdcebdd8d	pip@25.0.1	26.0	1
ghcr.io/liturgical-app/liturgical-app :1.2.0	41f25aded572	pip@25.0.1	26.0	1
ghcr.io/livepeer/cloudflared-ingress-operator :latest	c179cdcaa050	pip@25.3	26.0	1
ghcr.io/lsst-sqre/strimzi-registry-operator :0.6.0	7e25f7048aff	pip@22.0.4	26.0	1
ghcr.io/m0nsterrr/hyperglass :v2.0.4	f7b5d20c5e42	pip@24.0	26.0	1
ghcr.io/macropower/kubernetes-python :1.0	3b805a6a4bec	pip@25.0.1	26.0	1
ghcr.io/mailu/clamav :1.9.50	01d30483e4a8	pip@23.0.1	26.0	1
ghcr.io/mealie-recipes/mealie :v3.24.0	0b08ac3a9f0a	pip@25.0.1	26.0	1
ghcr.io/mealie-recipes/mealie :v3.2.1	322369a5b748	pip@25.0.1	26.0	1
ghcr.io/mealie-recipes/mealie :v3.25.1	6066c29eca95	pip@25.0.1	26.0	1
ghcr.io/mealie-recipes/mealie :v1.4.0	b56da41cf178	pip@23.1	26.0	1
ghcr.io/mealie-recipes/mealie :v3.7.0	bb2939094eed	pip@25.0.1	26.0	1
ghcr.io/microboxlabs/miot-harness :0.1.0	d548e9ae4b84	pip@25.0.1	26.0	1
ghcr.io/miguelndecarvalho/speedtest-exporter :v3.2.2	9e36964bce26	pip@21.1.2	26.0	1
ghcr.io/mirio/verbacap :v1.5.0	84928e2fc4f2	pip@23.3.1	26.0	1
ghcr.io/mlops-for-all/mlflow-tracking-server :3.8-1.30.1-v1.0.0	d30e631684c3	pip@23.1.2	26.0	1
ghcr.io/mshade/kronic :v0.1.4	66e3043851cd	pip@24.0	26.0	1
ghcr.io/music-assistant/server :2.7.5	3522e8a7a8f0	pip@25.3	26.0	1
ghcr.io/music-assistant/server :2.8.7	eef3ee7810d0	pip@25.3	26.0	1
ghcr.io/mweinelt/kea-exporter :v0.7.1	d7b77020e924	pip@25.0.1	26.0	1
ghcr.io/nefelim4ag/pingdom-operator :0.0.15	f8c7afdcf439	pip@24.0	26.0	1
ghcr.io/nicolargo/klances :0.1.3	74d6d33376eb	pip@25.0.1	26.0	1
ghcr.io/noahburrell0/sealed-secrets-ui :v0.1.4	7e7368fb472d	pip@24.3.1	26.0	1
ghcr.io/obeone/ollama-exporter :latest	f43af285c6e0	pip@24.0	26.0	1
ghcr.io/openappsec/openappsec-waf-webhook :1.1.34	5b979b962043	pip@23.0.1	26.0	1
ghcr.io/opencost/opencost-parquet-exporter :v0.2.1	ce85ef0ce665	pip@24.0	26.0	1
ghcr.io/openrelik/openrelik-mediator :latest	42efc445b19e	pip@25.0.1	26.0	1
ghcr.io/openrelik/openrelik-metrics :latest	3d0f1ddeebf5	pip@25.0.1	26.0	1
ghcr.io/openrelik/openrelik-server :latest	ce1132261523	pip@25.0.1	26.0	1
ghcr.io/openrelik/openrelik-worker-analyzer-config :latest	1269d3d8d2c2	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed	1