CVE-2026-1703

Low

Advisory

Published 2 Feb 2026In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 2.0; base score, highest
EPSS: 0.004; 34th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,241; of 17,790 indexed, latest versions
Container images: 1,190; deployed by those charts
Fix available: 1 of 2; affected packages

pip Path Traversal vulnerability

Carried by container images the latest versions of 1,241 of 17,790 indexed charts deploy, on 1,190 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+63 more	26.0	1,183
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+25 more	no fix listed	141

OSV records: DEBIAN-CVE-2026-1703 GHSA-6vgw-5pg2-w6jp UBUNTU-CVE-2026-1703
Also known as: PYSEC-2026-1796

Charts affected

1,241 by stars

Chart

Latest

Affected images

Radar Score

fsmopenshift

0.1.8-ubi.6

1 of 6 See more

fsm openshift 0.1.8-ubi.6

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.50.0-88	24352dca6672	pip@9.0.3	26.0

Open the chart page →

16,563

hamiopenshift

2.10.0-r0-openshift.c4e22e88

1 of 2 See more

hami openshift 2.10.0-r0-openshift.c4e22e88

1 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/dynamia-ai/hami-enterprise :v2.10.0-r0-openshift.c4e22e88	745504757300	pip@9.0.3	26.0

Open the chart page →

4,756

orion-ldopenshift

1.0.3

2 of 2 See more

orion-ld openshift 1.0.3

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/fiware/orion-ld :1.0.1	ea838e5b4051	pip@9.0.3	26.0
quay.io/opencloudio/ibm-mongodb :4.0.24	d8c631a6dc43	pip@9.0.3	26.0

Open the chart page →

14,727

osm-edgeopenshift

1.2.1-ubi8

1 of 7 See more

osm-edge openshift 1.2.1-ubi8

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.70.0-46	35d87a381432	pip@9.0.3	26.0

Open the chart page →

19,471

open-webconceptopen-webconcept

0.1.0

1 of 3 See more

open-webconcept open-webconcept 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	pip@23.0.1	26.0

Open the chart page →

3,423

terminalsopen-webui

0.7.0

2 of 2 See more

terminals open-webui 0.7.0

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/open-webui/terminals :latest	5d2fd44366a4	pip@25.0.1	26.0
ghcr.io/open-webui/terminals-operator :latest	6287ce8be502	pip@25.0.1	26.0

Open the chart page →

2,046

openwhiskopenwhisk

1.0.0

2 of 10 See more

openwhisk openwhisk 1.0.0

2 of the 10 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
openwhisk/kafkaprovider :2.1.0	63dc3d2a0904	pip@19.3.1	26.0
openwhisk/ow-utils :1.0.0	c80dba0de3aa	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.4	26.0 no fix listed

Open the chart page →

36,252

osdfir-infrastructureosdfir-infrastructure

2.15.0

8 of 40 See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

8 of the 40 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/openrelik/openrelik-mediator :latest	42efc445b19e	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-metrics :latest	3d0f1ddeebf5	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-server :latest	ce1132261523	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-worker-analyzer-config :latest	1269d3d8d2c2	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-logs :latest	b175cc61959a	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-containers :latest	a6d5abe94706	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed
ghcr.io/openrelik/openrelik-worker-os-creds :latest	7fc7ec101f08	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-plaso :latest	75537ea8c851	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed

Open the chart page →

72,547

mysqlot-container-kit

0.1.0

1 of 1 See more

463

pgaot-container-kit

1.0.3

1 of 6 See more

pga ot-container-kit 1.0.3

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.26.1	b8d5067137fe	pip@24.0	26.0

Open the chart page →

5,143

vmot-container-kit

0.0.3

1 of 7 See more

vm ot-container-kit 0.0.3

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	pip@24.0	26.0

Open the chart page →

5,418

devpiowan-charts

0.1.0

1 of 1 See more

devpi owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
owanio1992/devpi :6.16.0	4ade8e1e4d7e	pip@25.1.1	26.0

Open the chart page →

513

p4p4

0.1.0

1 of 7 See more

27,702

myappp4-helm

0.1.0

1 of 6 See more

19,728

pagespages

1.0.0

1 of 3 See more

20,242

pagespages10

1.0.0

1 of 3 See more

20,242

pagespages111

1.0.0

1 of 3 See more

20,242

pagespages2

1.0.0

1 of 3 See more

20,242

pagespages-alexchmielu

1.0.0

1 of 3 See more

20,242

pagespages-alps

1.0.0

1 of 3 See more

20,242

pagespages-alstom

1.0.0

1 of 3 See more

20,242

pagespages-ambala

1.0.0

1 of 3 See more

20,242

pagespages-andromeda

1.0.0

1 of 3 See more

20,242

pagespagesbadami

1.0.0

1 of 3 See more

20,242

pagespages-blackburn

1.0.0

1 of 3 See more

20,242

pagespages-botes

1.0.0

1 of 3 See more

20,242

pagespages-brian

1.0.0

1 of 3 See more

20,242

pagespages-buckll

1.0.0

1 of 3 See more

20,242

pagespages-camden

1.0.0

1 of 3 See more

20,242

pagespages-camden771

1.0.0

1 of 3 See more

20,242

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,242

pagespages-draco

1.0.0

1 of 3 See more

20,242

pagespages-ellora

1.0.0

1 of 3 See more

20,242

pagespages-finchley

1.0.0

1 of 3 See more

20,242

pagespages-fornax

1.0.0

1 of 3 See more

20,242

pagespages-harsh

1.0.0

1 of 3 See more

20,242

pagespagesk

1.0.0

1 of 3 See more

20,242

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,242

pagespages-mihai

1.0.0

1 of 3 See more

20,242

pagespages-nivesh

1.0.0

1 of 3 See more

20,242

pagespagessandeepgudu

1.0.0

1 of 3 See more

20,242

pagespages-shubhanker

1.0.0

1 of 3 See more

20,242

pagespages-ssharma0909

1.0.0

1 of 3 See more

20,242

pagespages-sucharitha

1.0.0

1 of 3 See more

20,242

pagespages-sudhir

1.0.0

1 of 3 See more

20,242

pagespages-sushi

1.0.0

1 of 3 See more

20,242

pagespages-vasanth5814

1.0.0

1 of 3 See more

20,242

pagespages-vjp

1.0.0

1 of 3 See more

20,242

ctfdpascaliske

2.0.0

1 of 1 See more

2,393

home-assistantpascaliske

0.1.1

1 of 1 See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2025.12.5	9a5a3eb4a213	pip@25.3	26.0

Open the chart page →

4,805

Container images carrying it

1,190 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/wizarrrr/wizarr :4.2.0-beta.3	d19d886d5090	pip@23.2.1	26.0	1
ghcr.io/yahoon/helm-demo :1.0.0	2930290a758c	pip@24.0	26.0	1
ghcr.io/zazukoians/qlever-server :v0.10.1	1de7869ab46e	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed	1
ghcr.io/zazukoians/qlever-ui :v0.10.1	51a7ec1c2de4	pip@24.0	26.0	1
ghcr.io/zoriya/kyoo_autosync :4.7.1	fbba58ddb1a6	pip@24.3.1	26.0	1
ghcr.io/zoriya/kyoo_scanner :4.7.1	7dc0ee57b628	pip@24.3.1	26.0	1
public.ecr.aws/datadog/agent :7.73.0	f4925b15ce94	pip@25.3	26.0	1
public.ecr.aws/k6v9y5g3/cluster-agent :master.575	36d051110158	pip@24.3.1	26.0	1
public.ecr.aws/k6v9y5g3/cluster-agent :cost_k8s_process.576	9e14a72b066d	pip@24.3.1	26.0	1
public.ecr.aws/outerbounds/metaflow_metadata_service :v2.4.13	f7567ce3419d	pip@24.3.1	26.0	1
public.ecr.aws/perfectscale-io/kube-state-metrics :4.1.14-redhat	849e235e2d3e	pip@9.0.3	26.0	1
public.ecr.aws/r3m4q3r9/pleco :0.24.0	651739583336	pip@25.3	26.0	1
quay.io/ai-lab/llamacpp_python :latest	70d138997acd	pip@22.3.1	26.0	1
quay.io/ansible/awx-operator :2.19.1	7302e0c8e5a7	pip@23.3.2	26.0	1
quay.io/cephcsi/cephcsi :v3.5.1	28a674af1df2	pip@9.0.3	26.0	1
quay.io/cloudnativetoolkit/cli-tools :v1.1-v1.8.2	d6fd2a9e3273	pip@22.1.2	26.0	1
quay.io/cloudnativetoolkit/cloud-pak-deployer :latest	13aaae779248	pip@23.2.1	26.0	1
quay.io/clustersecret/clustersecret :0.0.14	a9f835d1b241	pip@23.0.1	26.0	1
quay.io/datamattsson/truenas-csp :v3.2.0	9e58f2127d85	pip@25.0.1	26.0	1
quay.io/eformat/jenkins-agent-graalvm :latest	a3b9a07648b6	pip@9.0.3	26.0	1
quay.io/evl.ms/argocd-exporter :0.0.1	36ea8f34aa6b	pip@21.2.4	26.0	1
quay.io/fiware/orion-ld :1.0.1	ea838e5b4051	pip@9.0.3	26.0	1
quay.io/flomesh/flomesh-console-ubi8 :0.70.0-30	ce6938ff6709	pip@9.0.3	26.0	1
quay.io/flomesh/pipy-repo-ubi8 :0.70.0-46	9912fdf6c183	pip@9.0.3	26.0	1
quay.io/flomesh/pipy-ubi8 :0.50.0-88	24352dca6672	pip@9.0.3	26.0	1
quay.io/flomesh/pipy-ubi8 :0.70.0-46	35d87a381432	pip@9.0.3	26.0	1
quay.io/galaxyproject/galaxy-min :26.1.1	2c324c9789f5	pip@25.0.1	26.0	1
quay.io/hewlettpackardenterprise/squest :2.8.4	65694109877e	pip@25.0.1	26.0	1
quay.io/hpestorage/filex-csi-driver :2.6.4	b7f960bbf472	pip@25.3	26.0	1
quay.io/ibmgaragecloud/cli-tools :v0.15	9663f06adcb1	pip@22.0.4	26.0	1
quay.io/jupyterhub/k8s-hub :4.4.2	108fbb01c3fe	pip@25.0.1	26.0	1
quay.io/jupyterhub/k8s-hub :4.3.5	113e372cf71b	pip@25.0.1	26.0	1
quay.io/jupyterhub/k8s-hub :3.2.1	2528c6e57587	pip@23.2.1	26.0	1
quay.io/jupyterhub/k8s-hub :4.3.4	92f883d09270	pip@25.0.1	26.0	1
quay.io/jupyterhub/k8s-singleuser-sample :4.4.2	65e1b09fc8c9	pip@25.0.1	26.0	1
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	pip@9.0.3	26.0	1
quay.io/keycloak/keycloak :20.0.1	8830f76112b6	pip@9.0.3	26.0	1
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	pip@9.0.3	26.0	1
quay.io/keycloak/keycloak-operator :20.0.2	b1710745fa64	pip@9.0.3	26.0	1
quay.io/kiali/kiali-operator :v2.32.0	96c5264d54ab	pip@23.3.2	26.0	1
quay.io/kiwigrid/k8s-sidecar :1.10.7	18feb3906286	pip@21.0.1	26.0	1
quay.io/kiwigrid/k8s-sidecar :1.15.6	1f025ae37b7b	pip@21.2.4	26.0	1
quay.io/kiwigrid/k8s-sidecar :1.30.3	49dcce269568	pip@25.0.1	26.0	1
quay.io/kiwigrid/k8s-sidecar :1.21.0	710e23b489c5	pip@22.3.1	26.0	1
quay.io/kiwigrid/k8s-sidecar :1.30.10	835d79d8fbae	pip@25.2	26.0	1
quay.io/kiwigrid/k8s-sidecar :1.15.1	a25886092fa4	pip@21.2.4	26.0	1
quay.io/kiwigrid/k8s-sidecar :2.6.0	a6c101156d42	pip@25.3	26.0	1
quay.io/kiwigrid/k8s-sidecar :1.25.2	cb4c638ffb1f	pip@23.2.1	26.0	1
quay.io/maximilianopizarro/neuroface-backend :v1.4.1	3194d46df0f9	pip@22.3.1	26.0	1
quay.io/maximilianopizarro/neuroface-backend :latest	cba71dc08c8a	pip@22.3.1	26.0	1