CVE-2026-1703

Low

Advisory

Published 2 Feb 2026In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 2.0; base score, highest
EPSS: 0.004; 34th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,241; of 17,787 indexed, latest versions
Container images: 1,190; deployed by those charts
Fix available: 1 of 2; affected packages

pip Path Traversal vulnerability

Carried by container images the latest versions of 1,241 of 17,787 indexed charts deploy, on 1,190 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+63 more	26.0	1,183
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+25 more	no fix listed	141

OSV records: DEBIAN-CVE-2026-1703 GHSA-6vgw-5pg2-w6jp UBUNTU-CVE-2026-1703
Also known as: PYSEC-2026-1796

Charts affected

1,241 by stars

Chart

Latest

Affected images

Radar Score

fsmopenshift

0.1.8-ubi.6

1 of 6 See more

fsm openshift 0.1.8-ubi.6

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.50.0-88	24352dca6672	pip@9.0.3	26.0

Open the chart page →

16,554

hamiopenshift

2.10.0-r0-openshift.c4e22e88

1 of 2 See more

hami openshift 2.10.0-r0-openshift.c4e22e88

1 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/dynamia-ai/hami-enterprise :v2.10.0-r0-openshift.c4e22e88	745504757300	pip@9.0.3	26.0

Open the chart page →

4,749

orion-ldopenshift

1.0.3

2 of 2 See more

orion-ld openshift 1.0.3

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/fiware/orion-ld :1.0.1	ea838e5b4051	pip@9.0.3	26.0
quay.io/opencloudio/ibm-mongodb :4.0.24	d8c631a6dc43	pip@9.0.3	26.0

Open the chart page →

14,727

osm-edgeopenshift

1.2.1-ubi8

1 of 7 See more

osm-edge openshift 1.2.1-ubi8

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.70.0-46	35d87a381432	pip@9.0.3	26.0

Open the chart page →

19,449

open-webconceptopen-webconcept

0.1.0

1 of 3 See more

open-webconcept open-webconcept 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	pip@23.0.1	26.0

Open the chart page →

3,423

terminalsopen-webui

0.7.0

2 of 2 See more

terminals open-webui 0.7.0

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/open-webui/terminals :latest	5d2fd44366a4	pip@25.0.1	26.0
ghcr.io/open-webui/terminals-operator :latest	6287ce8be502	pip@25.0.1	26.0

Open the chart page →

1,998

openwhiskopenwhisk

1.0.0

2 of 10 See more

openwhisk openwhisk 1.0.0

2 of the 10 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
openwhisk/kafkaprovider :2.1.0	63dc3d2a0904	pip@19.3.1	26.0
openwhisk/ow-utils :1.0.0	c80dba0de3aa	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.4	26.0 no fix listed

Open the chart page →

36,230

osdfir-infrastructureosdfir-infrastructure

2.15.0

8 of 40 See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

8 of the 40 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/openrelik/openrelik-mediator :latest	42efc445b19e	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-metrics :latest	3d0f1ddeebf5	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-server :latest	ce1132261523	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-worker-analyzer-config :latest	1269d3d8d2c2	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-logs :latest	b175cc61959a	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-containers :latest	a6d5abe94706	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed
ghcr.io/openrelik/openrelik-worker-os-creds :latest	7fc7ec101f08	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-plaso :latest	75537ea8c851	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed

Open the chart page →

72,154

mysqlot-container-kit

0.1.0

1 of 1 See more

463

pgaot-container-kit

1.0.3

1 of 6 See more

pga ot-container-kit 1.0.3

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.26.1	b8d5067137fe	pip@24.0	26.0

Open the chart page →

5,136

vmot-container-kit

0.0.3

1 of 7 See more

vm ot-container-kit 0.0.3

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	pip@24.0	26.0

Open the chart page →

5,410

devpiowan-charts

0.1.0

1 of 1 See more

devpi owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
owanio1992/devpi :6.16.0	4ade8e1e4d7e	pip@25.1.1	26.0

Open the chart page →

510

p4p4

0.1.0

1 of 7 See more

27,667

myappp4-helm

0.1.0

1 of 6 See more

19,725

pagespages

1.0.0

1 of 3 See more

20,233

pagespages10

1.0.0

1 of 3 See more

20,233

pagespages111

1.0.0

1 of 3 See more

20,233

pagespages2

1.0.0

1 of 3 See more

20,233

pagespages-alexchmielu

1.0.0

1 of 3 See more

20,233

pagespages-alps

1.0.0

1 of 3 See more

20,233

pagespages-alstom

1.0.0

1 of 3 See more

20,233

pagespages-ambala

1.0.0

1 of 3 See more

20,233

pagespages-andromeda

1.0.0

1 of 3 See more

20,233

pagespagesbadami

1.0.0

1 of 3 See more

20,233

pagespages-blackburn

1.0.0

1 of 3 See more

20,233

pagespages-botes

1.0.0

1 of 3 See more

20,233

pagespages-brian

1.0.0

1 of 3 See more

20,233

pagespages-buckll

1.0.0

1 of 3 See more

20,233

pagespages-camden

1.0.0

1 of 3 See more

20,233

pagespages-camden771

1.0.0

1 of 3 See more

20,233

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,233

pagespages-draco

1.0.0

1 of 3 See more

20,233

pagespages-ellora

1.0.0

1 of 3 See more

20,233

pagespages-finchley

1.0.0

1 of 3 See more

20,233

pagespages-fornax

1.0.0

1 of 3 See more

20,233

pagespages-harsh

1.0.0

1 of 3 See more

20,233

pagespagesk

1.0.0

1 of 3 See more

20,233

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,233

pagespages-mihai

1.0.0

1 of 3 See more

20,233

pagespages-nivesh

1.0.0

1 of 3 See more

20,233

pagespagessandeepgudu

1.0.0

1 of 3 See more

20,233

pagespages-shubhanker

1.0.0

1 of 3 See more

20,233

pagespages-ssharma0909

1.0.0

1 of 3 See more

20,233

pagespages-sucharitha

1.0.0

1 of 3 See more

20,233

pagespages-sudhir

1.0.0

1 of 3 See more

20,233

pagespages-sushi

1.0.0

1 of 3 See more

20,233

pagespages-vasanth5814

1.0.0

1 of 3 See more

20,233

pagespages-vjp

1.0.0

1 of 3 See more

20,233

ctfdpascaliske

2.0.0

1 of 1 See more

2,383

home-assistantpascaliske

0.1.1

1 of 1 See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2025.12.5	9a5a3eb4a213	pip@25.3	26.0

Open the chart page →

4,788

Container images carrying it

1,190 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0	89
library/mysql :5.7	4bc6bc963e6d	pip@23.0.1	26.0	22
library/mysql :8 :8.4 :8.4.11	b3b90af2a655	pip@25.3	26.0	16
quay.io/kiwigrid/k8s-sidecar :2.5.0	a6b3f707f883	pip@25.3	26.0	13
oomk8s/readiness-check :2.0.2	875814cc853d	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	26.0 no fix listed	11
library/mysql :9.7.2	257388edf9c8	pip@25.3	26.0	6
oomk8s/readiness-check :2.0.0	7daa08b81954	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	26.0 no fix listed	6
flaresolverr/flaresolverr :latest :v3.5.0	139dfee1c6f8	pip@24.0	26.0	5
library/mysql :latest	4b40b165f348	pip@25.3	26.0	4
ncsa/checks :1.0.1	cc46a03e16ed	pip@22.0.4	26.0	4
opea/llm-tgi :1.0	0c25aab3f106	pip@24.0	26.0	4
shashkist/flask-contacts-app :latest	581de1fd6084	pip@24.2	26.0	4
apache/superset :6.1.0 :latest	16b50bbef664	pip@23.0.1	26.0	3
argoproj/argocd :v1.8.1	830e86cacefd	pip@18.1	26.0	3
cloudve/cloudlaunch-server :latest	4a3d7fae90bb	pip@20.0.2 python-pip@20.0.2-5ubuntu1.6	26.0 no fix listed	3
dnationcloud/kubernetes-jsonnet-translator :2.0.1	78fed4f3c130	pip@23.0.1	26.0	3
dpage/pgadmin4 :6.12	781369df9994	pip@20.3.4	26.0	3
kiwigrid/k8s-sidecar :0.1.193	170069ff0976	pip@20.2.2	26.0	3
kiwigrid/k8s-sidecar :1.28.0	4166a019eeaf	pip@24.2	26.0	3
kiwigrid/k8s-sidecar :0.1.151	7b98eecdf6d1	pip@20.1	26.0	3
kiwigrid/k8s-sidecar :1.30.2	cdb361e67b1b	pip@24.3.1	26.0	3
library/mysql :latest	66aec17cd21a	pip@25.3	26.0	3
library/python :3.12-slim	78387bc3881b	pip@25.0.1	26.0	3
paulkellerman/resultserver-app :1.0	381eeccb0618	pip@22.3	26.0	3
paulkellerman/webserver-app :latest	5a37b74f61b9	pip@22.3	26.0	3
quay.io/devtron/ai-agent :0.0.1	6545dac92173	pip@24.0	26.0	3
quay.io/kiwigrid/k8s-sidecar :1.14.2	35654389f8a9	pip@21.2.4	26.0	3
quay.io/kubernetes_incubator/nfs-provisioner :v2.3.0	f402e6039b3c	pip@19.0.3	26.0	3
quay.io/openshift/origin-oauth-proxy :4.14	a7dff785d821	pip@9.0.3	26.0	3
amancevice/superset :0.35.2	12a0a9e66550	pip@19.3.1	26.0	2
aquasec/kube-hunter :0.6.8	e64fe49f059f	pip@22.0.4	26.0	2
architectminds/aws-kubectl :1.1	9735e59a1085	pip@19.2.1	26.0	2
blakeblackshear/frigate :0.11.1	8330b0a265b8	pip@20.3.4	26.0	2
confluentinc/cp-kafka :6.2.11-1-ubi8	ac776fad95a5	pip@9.0.3	26.0	2
confluentinc/cp-zookeeper :latest	7610a50b13e7	pip@9.0.3	26.0	2
confluentinc/cp-zookeeper :6.2.11-1-ubi8	cae577096489	pip@20.2.4	26.0	2
cs3org/wopiserver :v9.4.2	02a9e78757b4	pip@23.0.1	26.0	2
dagster/user-code-example :1.13.22	5947f9ae481c	pip@23.0.1	26.0	2
datawire/aes :1.14.4	8588eafe6862	pip@20.2.4	26.0	2
devopsjourney1/mywebapp :latest	bd1ec6838570	pip@22.0.4	26.0	2
gradiant/spark :2.4.4-python-alpine	97657d56e927	pip@19.3.1	26.0	2
hjacobs/kube-downscaler :23.2.0-6-gc9b88e8	4b2147f47425	pip@23.0.1	26.0	2
hjacobs/kube-ops-view :20.4.0	58221b57d4d2	pip@20.0.2	26.0	2
homebridge/homebridge :latest	77c685a40911	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed	2
ilum/api :6.7.3	624fd09528c8	pip@25.0.1	26.0	2
istio/examples-bookinfo-productpage-v1 :1.15.0	0a5eb4795952	pip@19.1.1	26.0	2
istio/examples-bookinfo-productpage-v1 :1.14.0	22a0410f35a8	pip@19.1	26.0	2
jvstein/bitcoin-prometheus-exporter :v0.6.0	7645ba790ea8	pip@21.1.2	26.0	2
kiwigrid/k8s-sidecar :1.24.4	4138bea678f0	pip@23.1.2	26.0	2
kiwigrid/k8s-sidecar :1.24.3	5af76eebbba7	pip@22.3.1	26.0	2