CVE-2026-1703

Low

Advisory

Published 2 Feb 2026In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 2.0; base score, highest
EPSS: 0.004; 34th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,241; of 17,787 indexed, latest versions
Container images: 1,190; deployed by those charts
Fix available: 1 of 2; affected packages

pip Path Traversal vulnerability

Carried by container images the latest versions of 1,241 of 17,787 indexed charts deploy, on 1,190 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+63 more	26.0	1,183
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+25 more	no fix listed	141

OSV records: DEBIAN-CVE-2026-1703 GHSA-6vgw-5pg2-w6jp UBUNTU-CVE-2026-1703
Also known as: PYSEC-2026-1796

Charts affected

1,241 by stars

Chart

Latest

Affected images

Radar Score

fsmopenshift

0.1.8-ubi.6

1 of 6 See more

fsm openshift 0.1.8-ubi.6

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.50.0-88	24352dca6672	pip@9.0.3	26.0

Open the chart page →

16,554

hamiopenshift

2.10.0-r0-openshift.c4e22e88

1 of 2 See more

hami openshift 2.10.0-r0-openshift.c4e22e88

1 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/dynamia-ai/hami-enterprise :v2.10.0-r0-openshift.c4e22e88	745504757300	pip@9.0.3	26.0

Open the chart page →

4,749

orion-ldopenshift

1.0.3

2 of 2 See more

orion-ld openshift 1.0.3

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/fiware/orion-ld :1.0.1	ea838e5b4051	pip@9.0.3	26.0
quay.io/opencloudio/ibm-mongodb :4.0.24	d8c631a6dc43	pip@9.0.3	26.0

Open the chart page →

14,727

osm-edgeopenshift

1.2.1-ubi8

1 of 7 See more

osm-edge openshift 1.2.1-ubi8

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.70.0-46	35d87a381432	pip@9.0.3	26.0

Open the chart page →

19,449

open-webconceptopen-webconcept

0.1.0

1 of 3 See more

open-webconcept open-webconcept 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	pip@23.0.1	26.0

Open the chart page →

3,423

terminalsopen-webui

0.7.0

2 of 2 See more

terminals open-webui 0.7.0

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/open-webui/terminals :latest	5d2fd44366a4	pip@25.0.1	26.0
ghcr.io/open-webui/terminals-operator :latest	6287ce8be502	pip@25.0.1	26.0

Open the chart page →

1,998

openwhiskopenwhisk

1.0.0

2 of 10 See more

openwhisk openwhisk 1.0.0

2 of the 10 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
openwhisk/kafkaprovider :2.1.0	63dc3d2a0904	pip@19.3.1	26.0
openwhisk/ow-utils :1.0.0	c80dba0de3aa	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.4	26.0 no fix listed

Open the chart page →

36,230

osdfir-infrastructureosdfir-infrastructure

2.15.0

8 of 40 See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

8 of the 40 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/openrelik/openrelik-mediator :latest	42efc445b19e	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-metrics :latest	3d0f1ddeebf5	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-server :latest	ce1132261523	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-worker-analyzer-config :latest	1269d3d8d2c2	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-logs :latest	b175cc61959a	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-containers :latest	a6d5abe94706	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed
ghcr.io/openrelik/openrelik-worker-os-creds :latest	7fc7ec101f08	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-plaso :latest	75537ea8c851	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed

Open the chart page →

72,154

mysqlot-container-kit

0.1.0

1 of 1 See more

463

pgaot-container-kit

1.0.3

1 of 6 See more

pga ot-container-kit 1.0.3

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.26.1	b8d5067137fe	pip@24.0	26.0

Open the chart page →

5,136

vmot-container-kit

0.0.3

1 of 7 See more

vm ot-container-kit 0.0.3

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	pip@24.0	26.0

Open the chart page →

5,410

devpiowan-charts

0.1.0

1 of 1 See more

devpi owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
owanio1992/devpi :6.16.0	4ade8e1e4d7e	pip@25.1.1	26.0

Open the chart page →

510

p4p4

0.1.0

1 of 7 See more

27,667

myappp4-helm

0.1.0

1 of 6 See more

19,725

pagespages

1.0.0

1 of 3 See more

20,233

pagespages10

1.0.0

1 of 3 See more

20,233

pagespages111

1.0.0

1 of 3 See more

20,233

pagespages2

1.0.0

1 of 3 See more

20,233

pagespages-alexchmielu

1.0.0

1 of 3 See more

20,233

pagespages-alps

1.0.0

1 of 3 See more

20,233

pagespages-alstom

1.0.0

1 of 3 See more

20,233

pagespages-ambala

1.0.0

1 of 3 See more

20,233

pagespages-andromeda

1.0.0

1 of 3 See more

20,233

pagespagesbadami

1.0.0

1 of 3 See more

20,233

pagespages-blackburn

1.0.0

1 of 3 See more

20,233

pagespages-botes

1.0.0

1 of 3 See more

20,233

pagespages-brian

1.0.0

1 of 3 See more

20,233

pagespages-buckll

1.0.0

1 of 3 See more

20,233

pagespages-camden

1.0.0

1 of 3 See more

20,233

pagespages-camden771

1.0.0

1 of 3 See more

20,233

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,233

pagespages-draco

1.0.0

1 of 3 See more

20,233

pagespages-ellora

1.0.0

1 of 3 See more

20,233

pagespages-finchley

1.0.0

1 of 3 See more

20,233

pagespages-fornax

1.0.0

1 of 3 See more

20,233

pagespages-harsh

1.0.0

1 of 3 See more

20,233

pagespagesk

1.0.0

1 of 3 See more

20,233

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,233

pagespages-mihai

1.0.0

1 of 3 See more

20,233

pagespages-nivesh

1.0.0

1 of 3 See more

20,233

pagespagessandeepgudu

1.0.0

1 of 3 See more

20,233

pagespages-shubhanker

1.0.0

1 of 3 See more

20,233

pagespages-ssharma0909

1.0.0

1 of 3 See more

20,233

pagespages-sucharitha

1.0.0

1 of 3 See more

20,233

pagespages-sudhir

1.0.0

1 of 3 See more

20,233

pagespages-sushi

1.0.0

1 of 3 See more

20,233

pagespages-vasanth5814

1.0.0

1 of 3 See more

20,233

pagespages-vjp

1.0.0

1 of 3 See more

20,233

ctfdpascaliske

2.0.0

1 of 1 See more

2,383

home-assistantpascaliske

0.1.1

1 of 1 See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2025.12.5	9a5a3eb4a213	pip@25.3	26.0

Open the chart page →

4,788

Container images carrying it

1,190 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
clowder/clowder2-backend :2.0.0-beta.4	11f3d844e4c0	pip@23.0.1	26.0	1
clowder/clowder2-heartbeat :2.0.0-beta.4	14155326c7b9	pip@23.0.1	26.0	1
clowder/clowder2-messages :2.0.0-beta.4	bf146f1ca24f	pip@23.0.1	26.0	1
clsen2024/daejeon_2-3 :latest	1156cd87c8fb	pip@23.0.1	26.0	1
clsen2024/gwangju_2-3 :service-b-1	0ba9eff852c5	pip@23.0.1	26.0	1
clsen2024/gwangju_2-3 :service-a-1	51b1d45961cd	pip@23.0.1	26.0	1
clsen2024/gwangju_2-3 :service-c-1	efb1586c8299	pip@23.0.1	26.0	1
cockroachdb/cockroach-operator :v2.1.0	983312754620	pip@9.0.3	26.0	1
codaprotocol/buildkite-exporter :0.2.1	37c68e67a401	pip@21.0	26.0	1
codaprotocol/coda-user-agent :0.1.5	4ba4dd3a041f	pip@20.0.2	26.0	1
codecov/self-hosted-api :24.4.1	0475cb1c3136	pip@22.0.4	26.0	1
codecov/self-hosted-worker :24.4.1	837f546b479b	pip@23.0.1	26.0	1
codekoala/pypi :1.2.1	4a999b2cfff2	pip@9.0.1	26.0	1
coderenvs/coder-service :1.44.6	1deffc4670e6	pip@9.0.3	26.0	1
coderenvs/timescale :1.44.6	76fd37fe6830	pip@9.0.3	26.0	1
conduction/balance-registration-varnish :dev	07c44005da9d	pip@9.0.1	26.0	1
conduction/cgrc-varnish :dev	e154d5781c8a	pip@9.0.1	26.0	1
conduction/checkin-component-varnish :dev	ef3a3fb0ad47	pip@9.0.1	26.0	1
conduction/conduction-ui-varnish :dev	5f5add2c12e0	pip@9.0.1	26.0	1
conduction/contactmoment-component-varnish :dev	e3546b97faea	pip@9.0.1	26.0	1
conduction/docparser-varnish :dev	45f20c4cd2fa	pip@9.0.1	26.0	1
conduction/kvk-varnish :dev	8722700f1768	pip@9.0.1	26.0	1
conduction/pan-varnish :dev	c3e5737ae68f	pip@9.0.1	26.0	1
confluentinc/cp-enterprise-control-center :6.1.0	f2975d507a2a	pip@9.0.3	26.0	1
confluentinc/cp-enterprise-kafka :6.1.0	8f1544df1f48	pip@9.0.3	26.0	1
confluentinc/cp-kafka :5.4.0	1bbda887bc53	pip@8.1.2	26.0	1
confluentinc/cp-kafka :7.1.2.amd64	3bf359d5e340	pip@21.3.1	26.0	1
confluentinc/cp-kafka :7.6.6	83dbca3efd2a	pip@20.2.4	26.0	1
confluentinc/cp-kafka :7.8.0-3-ubi8	adc392d28a1e	pip@9.0.3	26.0	1
confluentinc/cp-kafka :7.4.4	c0224a1adf7a	pip@9.0.3	26.0	1
confluentinc/cp-kafka :5.0.1	c87b1c07fb53	pip@8.1.2	26.0	1
confluentinc/cp-kafka :7.5.1	dc9b972db002	pip@20.2.4	26.0	1
confluentinc/cp-kafka-connect :6.1.0	4bc70a83ca6f	pip@9.0.3	26.0	1
confluentinc/cp-kafka-rest :6.1.0	b0b7aa26254a	pip@9.0.3	26.0	1
confluentinc/cp-ksqldb-server :7.6.0	8ec46c27982f	pip@20.2.4	26.0	1
confluentinc/cp-ksqldb-server :6.1.0	ee403d5b9090	pip@9.0.3	26.0	1
confluentinc/cp-schema-registry :6.1.0	b651d4b6185a	pip@9.0.3	26.0	1
confluentinc/cp-zookeeper :7.5.1	0bec03c1f3ce	pip@20.2.4	26.0	1
confluentinc/cp-zookeeper :7.8.0-3-ubi8	5ca5f3269814	pip@20.2.4	26.0	1
confluentinc/cp-zookeeper :6.1.0	78c190f4472c	pip@9.0.3	26.0	1
countly/api :25.05.4	f4cc7447c4f5	pip@21.1.1	26.0	1
countly/frontend :25.05.4	2acbc11499b6	pip@21.1.1	26.0	1
cr0hn/ja-shortener :v0.1.4	14482d0bc4a1	pip@24.0	26.0	1
craigwillis/c2metadata-bd :latest	ae317d7e4724	pip@20.1.1	26.0	1
crazymax/rtorrent-rutorrent :3.10-0.9.8-0.13.8	fb307f5b87bf	pip@22.3.1	26.0	1
cspconsole/report-collector :1.0.158	39750248193b	pip@24.0	26.0	1
dagster/dagster-celery-k8s :1.13.22	e29a64392e12	pip@23.0.1	26.0	1
dagster/dagster-cloud-agent :1.13.22	9674f3b94a3b	pip@25.0.1	26.0	1
dalibo/explain.dalibo.com :2.20.1	2a0b749c2f7f	pip@25.3	26.0	1
danialnabiyan1382/lsdisk :v2.0.8	f96a7ebf1f42	pip@25.2	26.0	1