StackRadar

CVE-2026-22702

Medium

Advisory

Published 10 Jan 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.5
base score, highest
EPSS
0.001
1st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
87
of 17,781 indexed, latest versions
Container images
106
deployed by those charts
Fix available
2 of 3
affected packages

virtualenv Has TOCTOU Vulnerabilities in Directory Creation

Carried by container images the latest versions of 87 of 17,781 indexed charts deploy, on 106 images.

Affected packageAffected versionsFixed inImages
virtualenvpypi1.11.4, 15.1.0, 16.3.0, 16.6.0+42 more20.36.1106
python-virtualenvdeb1.11.4-1ubuntu1, 20.0.17-1ubuntu0.3, 20.17.1+ds-1, 20.25.0+ds-2no fix listed9
virtualenvbitnami20.28.0, 20.31.220.36.13
OSV records
BIT-virtualenv-2026-22702DEBIAN-CVE-2026-22702GHSA-597g-3phw-6986UBUNTU-CVE-2026-22702
Also known as
PYSEC-2026-2009

Charts affected

87 by stars
ChartLatestAffected imagesRadar Score
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
virtualenv@20.25.1
20.36.1

Open the chart page →

11,367
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
allegroai/clearml:2.0.0-613713ae38f7daf
virtualenv@20.28.0
20.36.1

Open the chart page →

10,622
kube-downscalerdeliveryheroVerified publisher0.7.61 of 1See more

kube-downscaler deliveryhero 0.7.6

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
virtualenv@20.23.1
20.36.1

Open the chart page →

4,293
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
virtualenv@20.14.1
20.36.1

Open the chart page →

7,705
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
virtualenv@20.32.0
20.36.1

Open the chart page →

5,987
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
virtualenv@20.25.0
20.36.1

Open the chart page →

6,041
stackstorm-hastackstormVerified publisher1.1.011 of 17See more

stackstorm-ha stackstorm 1.1.0

11 of the 17 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
stackstorm/st2actionrunner:3.888235ba70cad
virtualenv@20.4.0
20.36.1
stackstorm/st2api:3.86f56d239d280
virtualenv@20.4.0
20.36.1
stackstorm/st2auth:3.833ecfda16608
virtualenv@20.4.0
20.36.1
stackstorm/st2garbagecollector:3.84e3f8c7ca52d
virtualenv@20.4.0
20.36.1
stackstorm/st2notifier:3.8f190a6212195
virtualenv@20.4.0
20.36.1
stackstorm/st2rulesengine:3.8259503496ff9
virtualenv@20.4.0
20.36.1
stackstorm/st2scheduler:3.8b1de2055c362
virtualenv@20.4.0
20.36.1
stackstorm/st2sensorcontainer:3.8b1a338f64773
virtualenv@20.4.0
20.36.1
stackstorm/st2stream:3.81c8904a3bf67
virtualenv@20.4.0
20.36.1
stackstorm/st2timersengine:3.81bf35bfaf00c
virtualenv@20.4.0
20.36.1
stackstorm/st2workflowengine:3.819fdfffdbba8
virtualenv@20.4.0
20.36.1

Open the chart page →

96,419
awx-operatorawx-operator-helm3.2.11 of 2See more

awx-operator awx-operator-helm 3.2.1

1 of the 2 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
quay.io/ansible/awx-operator:2.19.17302e0c8e5a7
virtualenv@20.25.0
20.36.1

Open the chart page →

9,868
thehivestrangebee-helmOfficialVerified publisher1.0.61 of 7See more

thehive strangebee-helm 1.0.6

1 of the 7 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
bitnamilegacy/cassandra:4.1.7-debian-12-r32b7a217999a1
virtualenv@20.28.0
virtualenv@20.28.0
20.36.1
20.36.1

Open the chart page →

16,210
daskhubdask2024.1.11 of 9See more

daskhub dask 2024.1.1

1 of the 9 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
virtualenv@20.25.0
20.36.1

Open the chart page →

14,094
alerta-webalerta-webVerified publisher0.1.121 of 2See more

alerta-web alerta-web 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
hayk96/alerta-web:9.0.486377705e9e3
virtualenv@20.26.3
20.36.1

Open the chart page →

3,569
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
virtualenv@20.14.1
20.36.1

Open the chart page →

7,579
kiali-operatorkiali2.31.01 of 1See more

kiali-operator kiali 2.31.0

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
quay.io/kiali/kiali-operator:v2.31.0f837d8f25545
virtualenv@20.29.3
20.36.1

Open the chart page →

1,157
kubeviouskubevious1.2.21 of 7See more

kubevious kubevious 1.2.2

1 of the 7 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
redislabs/redisearch:2.4.1433561794c5c8
virtualenv@20.16.3
20.36.1

Open the chart page →

14,204
pretixtechwolf12Verified publisher2026.7.01 of 3See more

pretix techwolf12 2026.7.0

1 of the 3 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
pretix/standalone:2026.7.05df3b7aa852e
virtualenv@20.31.2
20.36.1

Open the chart page →

9,770
mealieth-chartsVerified publisher0.5.11 of 1See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
virtualenv@20.35.4
20.36.1

Open the chart page →

3,804
clearml-agentallegroaiVerified publisher5.3.31 of 1See more

clearml-agent allegroai 5.3.3

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
allegroai/clearml-agent-k8s-base:1.24-21772827a01bb5
virtualenv@20.15.0
20.36.1

Open the chart page →

12,046
archerydoubanVerified publisher0.4.31 of 6See more

archery douban 0.4.3

1 of the 6 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
hhyo/archery:v1.9.11aa41843419e
virtualenv@20.15.1
20.36.1

Open the chart page →

5,853
hpe-greenlake-file-csi-driverhpe-storageVerified publisher2.6.41 of 7See more

hpe-greenlake-file-csi-driver hpe-storage 2.6.4

1 of the 7 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
quay.io/hpestorage/filex-csi-driver:2.6.4b7f960bbf472
virtualenv@20.35.4
20.36.1

Open the chart page →

6,095
huehue1.0.31 of 3See more

hue hue 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
gethue/hue:latest7d5c1b9f8a79
virtualenv@20.24.4
20.36.1

Open the chart page →

12,397
kuma-ingress-watcherkuma-ingress-watcherVerified publisher1.4.01 of 1See more

kuma-ingress-watcher kuma-ingress-watcher 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
ghcr.io/squent/kuma-ingress-watcher:1.7.014d45b2a1f00
virtualenv@20.29.1
20.36.1

Open the chart page →

2,662
locustlocustVerified publisher0.1.41 of 1See more

locust locust 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
hansehe/locust:1.1.0bc8e45262bc4
virtualenv@20.29.3
20.36.1

Open the chart page →

2,757
opta-agentopta-agentVerified publisher0.1.31 of 1See more

opta-agent opta-agent 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
runx1/opta-agent:latest0ca3867d3200
virtualenv@20.14.1
20.36.1

Open the chart page →

1,543
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
treskon/portrait-web-setup:DEV-latesta475d80e4ecf
virtualenv@20.29.2
20.36.1

Open the chart page →

31,844
kube-resource-reportrlex0.10.11 of 2See more

kube-resource-report rlex 0.10.1

1 of the 2 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
hjacobs/kube-resource-report:22.11.0c173cd02f5af
virtualenv@20.17.0
20.36.1

Open the chart page →

1,266
alertasomeblackmagic0.2.31 of 2See more

alerta someblackmagic 0.2.3

1 of the 2 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
alerta/alerta-web:8.5.04786b9eaa606
virtualenv@20.10.0
20.36.1

Open the chart page →

3,162
ckanstatcan0.0.351 of 8See more

ckan statcan 0.0.35

1 of the 8 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
statcan/ckan:2.93921305425b8
python-virtualenv@20.0.17-1ubuntu0.3
virtualenv@20.0.17
no fix listed
20.36.1

Open the chart page →

24,930
verbacapverbacapVerified publisher1.0.71 of 1See more

verbacap verbacap 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
ghcr.io/mirio/verbacap:v1.5.084928e2fc4f2
virtualenv@20.26.1
20.36.1

Open the chart page →

2,233
arlas-aiasarlas-stackVerified publisher28.8.01 of 22See more

arlas-aias arlas-stack 28.8.0

1 of the 22 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
ghcr.io/developmentseed/titiler:0.22.48ac53eb38393
virtualenv@20.28.0
virtualenv@20.28.0
20.36.1
20.36.1

Open the chart page →

40,238
keystonearzu0.2.292 of 4See more

keystone arzu 0.2.29

2 of the 4 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
openstackhelm/heat:wallaby-ubuntu_focalf728510bab3c
virtualenv@20.7.2
20.36.1
openstackhelm/keystone:wallaby-ubuntu_focale07d75953d2e
virtualenv@20.7.2
20.36.1

Open the chart page →

22,568
asya-playgroundasya1.1.31 of 1See more

asya-playground asya 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
localstack/localstack:3.19d278167f2b7
virtualenv@20.25.0
20.36.1

Open the chart page →

9,412
shynetatrox0.1.11 of 1See more

shynet atrox 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.12.0e821e31140f7
virtualenv@20.12.0
20.36.1

Open the chart page →

5,507
huebigdata-chartsVerified publisher1.0.41 of 2See more

hue bigdata-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
gethue/hue:4.10.05702b2c37ff9
virtualenv@20.4.7
20.36.1

Open the chart page →

22,891
couchpotatobryanalves0.3.01 of 1See more

couchpotato bryanalves 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
linuxserver/couchpotato:75e576ee-ls32c4d2766b9eb7
virtualenv@16.7.9
20.36.1

Open the chart page →

2,018
sickchillbryanalves0.3.01 of 1See more

sickchill bryanalves 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
virtualenv@16.7.9
20.36.1

Open the chart page →

2,504
camerahubcamerahub0.10.211 of 2See more

camerahub camerahub 0.10.21

1 of the 2 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
camerahub/camerahub:0.36.23a5af37dd6e1b
virtualenv@20.21.1
20.36.1

Open the chart page →

2,507
kube-ops-viewchristianhuthVerified publisher8.3.31 of 1See more

kube-ops-view christianhuth 8.3.3

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
hjacobs/kube-ops-view:23.5.0a4fae38f93d7
virtualenv@20.21.1
20.36.1

Open the chart page →

1,227
galaxy-stablecloudve2.0.02 of 5See more

galaxy-stable cloudve 2.0.0

2 of the 5 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
galaxy/galaxy-init:v18.010267bad550e6
python-virtualenv@1.11.4-1ubuntu1
virtualenv@1.11.4
no fix listed
20.36.1
galaxy/galaxy-stable:v18.018e577a626dfd
python-virtualenv@1.11.4-1ubuntu1
virtualenv@1.11.4
no fix listed
20.36.1

Open the chart page →

70,895
pulsarcloudve0.2.01 of 2See more

pulsar cloudve 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
galaxy/pulsar-kubernetes:0.15.7e50a890e24c9
python-virtualenv@20.17.1+ds-1
virtualenv@20.17.1+ds
no fix listed
20.36.1

Open the chart page →

6,162
metaflowcluster-deploy0.2.21 of 1See more

metaflow cluster-deploy 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
virtualenv@20.27.1
20.36.1

Open the chart page →

8,009
couchpotatocronce0.0.11 of 1See more

couchpotato cronce 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
linuxserver/couchpotato:75e576ee-ls389cd8d5fb1ac
virtualenv@16.3.0
20.36.1

Open the chart page →

3,871
csghubcsghubVerified publisher2.4.31 of 34See more

csghub csghub 2.4.3

1 of the 34 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
virtualenv@20.32.0
20.36.1

Open the chart page →

58,897
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
virtualenv@20.24.7
20.36.1

Open the chart page →

6,179
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
virtualenv@20.29.3
20.36.1

Open the chart page →

5,062
deployhubdeployhubVerified publisher10.0.4157 of 11See more

deployhub deployhub 10.0.415

7 of the 11 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
virtualenv@20.35.4
20.36.1
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
virtualenv@20.35.4
20.36.1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
virtualenv@20.35.4
20.36.1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
virtualenv@20.35.4
20.36.1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
virtualenv@20.35.4
20.36.1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
virtualenv@20.35.4
20.36.1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
virtualenv@20.35.4
20.36.1

Open the chart page →

11,160
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
virtualenv@20.27.1
20.36.1

Open the chart page →

9,607
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
virtualenv@20.27.1
20.36.1

Open the chart page →

9,607
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
virtualenv@20.29.2
20.36.1

Open the chart page →

19,224
autonodelabeldjjudas21Verified publisher0.0.101 of 1See more

autonodelabel djjudas21 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
djjudas21/autonodelabel:0.0.6f17233350c4f
virtualenv@20.24.2
20.36.1

Open the chart page →

1,304
codecovdoubanVerified publisher0.2.42 of 8See more

codecov douban 0.2.4

2 of the 8 container images this version deploys carry CVE-2026-22702.

Container imageDigestPackageFixed in
codecov/self-hosted-api:24.4.10475cb1c3136
virtualenv@20.4.3
20.36.1
codecov/self-hosted-worker:24.4.1837f546b479b
virtualenv@20.24.5
20.36.1

Open the chart page →

24,917

Container images carrying it

106 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
virtualenv@20.35.4
20.36.1
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
virtualenv@20.35.4
20.36.1
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
virtualenv@20.35.4
20.36.1
1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
virtualenv@20.35.4
20.36.1
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
virtualenv@20.35.4
20.36.1
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
virtualenv@20.35.4
20.36.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.