CVE-2026-26007

High

Advisory

Published 10 Feb 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.003; 28th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 474; of 17,787 indexed, latest versions
Container images: 468; deployed by those charts
Fix available: 2 of 2; affected packages

cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

Carried by container images the latest versions of 474 of 17,787 indexed charts deploy, on 468 images.

Affected package	Affected versions	Fixed in	Images
cryptographypypi	1.7.2, 1.9, 2.1.4, 2.2.2+68 more	46.0.5	468
python-cryptographydeb	2.1.4-1ubuntu1.2, 2.1.4-1ubuntu1.3, 2.1.4-1ubuntu1.4, 2.8-3ubuntu0.1+8 more	2.1.4-1ubuntu1.4+esm3, 2.8-3ubuntu0.3+esm2, 3.4.8-1ubuntu2.3, 41.0.7-4ubuntu0.3	41

OSV records: GHSA-r6ph-v2qm-q3c2 UBUNTU-CVE-2026-26007 DEBIAN-CVE-2026-26007
Also known as: PYSEC-2026-2141, USN-8087-1, USN-8087-3

Charts affected

474 by stars

Chart

Latest

Affected images

Radar Score

scribesynapse

0.2.16

1 of 7 See more

scribe synapse 0.2.16

1 of the 7 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
mysql/mysql-server :latest	d6c8301b7834	cryptography@37.0.2	46.0.5

Open the chart page →

2,680

sinnersynapse

0.1.0

1 of 6 See more

sinner synapse 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
mysql/mysql-server :latest	d6c8301b7834	cryptography@37.0.2	46.0.5

Open the chart page →

1,955

tensor_apptensor-app

0.2.2

1 of 3 See more

tensor_app tensor-app 0.2.2

1 of the 3 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	cryptography@3.2.1	46.0.5

Open the chart page →

17,461

supabaseteochenglim

0.1.2

1 of 13 See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
supabase/realtime :latest	d3aa0c86c7b3	cryptography@43.0.0	46.0.5

Open the chart page →

9,556

kasa-exporterth-charts

0.1.0

1 of 1 See more

kasa-exporter th-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
thelande/kasa_exporter :v0.2.3	a1fdb8baa152	cryptography@42.0.7	46.0.5

Open the chart page →

1,515

the0the0

0.9.8

1 of 9 See more

the0 the0 0.9.8

1 of the 9 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
ghcr.io/alexanderwanyoike/the0/runtime :1.14.7	459010a02aff	cryptography@41.0.7	46.0.5

Open the chart page →

7,248

synapsetranhailong

0.1.0

1 of 2 See more

synapse tranhailong 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
matrixdotorg/synapse :v1.78.0	def97fd537d8	cryptography@39.0.1	46.0.5

Open the chart page →

3,164

jupyterhubuninettsigma2

1.6.0

1 of 5 See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
quay.io/nird-toolkit/jupyterhub-server :20221215-e6aa80e	cae8c0622533	cryptography@38.0.1	46.0.5

Open the chart page →

8,607

opencloudunxwares

0.2.3

1 of 13 See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
apache/tika :2.9.2.1-full	ae0b86d3c4d0	cryptography@41.0.7 python-cryptography@41.0.7-4build3	46.0.5 41.0.7-4ubuntu0.3

Open the chart page →

45,239

phonebook-chartusuladams2

0.2.1

1 of 3 See more

phonebook-chart usuladams2 0.2.1

1 of the 3 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	cryptography@3.2.1	46.0.5

Open the chart page →

3,176

simple-prima-notavcnngr

0.5.3

1 of 4 See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
dpage/pgadmin4 :9.2	52cb72a9e3da	cryptography@44.0.2	46.0.5

Open the chart page →

4,768

browserlessvictorlane

0.2.0

1 of 1 See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	cryptography@41.0.7 python-cryptography@41.0.7-4ubuntu0.1	46.0.5 41.0.7-4ubuntu0.3

Open the chart page →

4,305

twenty-crmvictorlane

0.0.1

1 of 3 See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	cryptography@3.4.8 python-cryptography@3.4.8-1ubuntu2.1	46.0.5 3.4.8-1ubuntu2.3

Open the chart page →

13,459

calibre-webvista

0.1.3

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	cryptography@43.0.3	46.0.5

Open the chart page →

7,628

wazuhwazuh-helm-eks

1.2.10

1 of 6 See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
wazuh/wazuh-manager :4.14.4	5a065930682d	cryptography@44.0.1	46.0.5

Open the chart page →

5,484

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	cryptography@3.3.2	46.0.5

Open the chart page →

11,119

supersetwbstack

0.1.0

1 of 1 See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
apache/superset :4.0.1	ab9467fd712c	cryptography@42.0.4	46.0.5

Open the chart page →

7,085

juicefs-csi-driverwenerme

0.32.5

1 of 5 See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.32.5	95008ba63318	cryptography@38.0.4 python-cryptography@38.0.4-3+deb12u1	46.0.5 no fix listed

Open the chart page →

9,117

ceph-csi-cephfswikimedia

0.1.8

1 of 5 See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	cryptography@3.2.1	46.0.5

Open the chart page →

10,285

ceph-csi-rbdwikimedia

0.1.13

1 of 6 See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	cryptography@3.2.1	46.0.5

Open the chart page →

11,784

powerdnsadminwitcom-gmbh

0.3.4

1 of 1 See more

powerdnsadmin witcom-gmbh 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
ngoduykhanh/powerdns-admin :v0.2.4	ba36ab196d3d	cryptography@35.0.0	46.0.5

Open the chart page →

2,643

zerossl-cert-managerzerossl-cert-manager

0.1.0

1 of 2 See more

zerossl-cert-manager zerossl-cert-manager 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
andreymileshin/zerossl-issuer :v1.0.0	e0825acc9e48	cryptography@44.0.2	46.0.5

Open the chart page →

570

alertmanager-matrix-forwarderzloi-space

1.0.1

1 of 2 See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
matrixdotorg/pantalaimon :v0.10.4	ba6a587fa508	cryptography@36.0.1	46.0.5

Open the chart page →

3,118

grafana-matrix-forwarderzloi-space

1.0.0

1 of 2 See more

grafana-matrix-forwarder zloi-space 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-26007.

Container image	Digest	Package	Fixed in
matrixdotorg/pantalaimon :v0.10.4	ba6a587fa508	cryptography@36.0.1	46.0.5

Open the chart page →

1,636

Container images carrying it

468 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
voltha/voltha-tester :1.7.0	655c3048a602	cryptography@2.7	46.0.5	1
voltha/voltha-voltha :1.6.0	ff596b62de59	cryptography@2.4.1	46.0.5	1
wallabag/wallabag :2.4.2	5e4c26a7fb4a	cryptography@2.9.2	46.0.5	1
wazuh/wazuh-manager :4.11.1	1da5c38c6a78	cryptography@43.0.1	46.0.5	1
wazuh/wazuh-manager :4.4.1	21994f40e0da	cryptography@3.3.2	46.0.5	1
wazuh/wazuh-manager :4.14.4	5a065930682d	cryptography@44.0.1	46.0.5	1
wazuh/wazuh-manager :4.14.3	f09282d281f6	cryptography@44.0.1	46.0.5	1
weblate/weblate :3.11.3-1	82848df56ecd	cryptography@2.8	46.0.5	1
wiremind/pghoard :12-2019-11-26	4dea42c8166c	cryptography@2.8	46.0.5	1
yetiplatform/yeti :2.9.0	9bcbe2650a14	cryptography@44.0.2	46.0.5	1
yetiplatform/yeti :latest	9c3006cedcca	cryptography@44.0.2	46.0.5	1
ygqygq2/mysql-exec-sql :latest	54f30def1558	cryptography@41.0.3	46.0.5	1
zepai/knowledge-graph-mcp :v0.2.1	6ab0ee79926b	cryptography@45.0.4	46.0.5	1
zurdi15/romm :2.3.1	2db88fe44c89	cryptography@41.0.6	46.0.5	1
gcr.io/kubecost1/kubecost-modeling :v0.1.24	a2259b098b13	cryptography@44.0.2	46.0.5	1
gcr.io/kubecost1/kubecost-modeling :v0.1.22	a461dc5cb96a	cryptography@44.0.1	46.0.5	1
gcr.io/rotationalio-habanero/imgtag :89ec287	a534a3170d03	cryptography@44.0.2	46.0.5	1
ghcr.io/alexanderwanyoike/the0/runtime :1.14.7	459010a02aff	cryptography@41.0.7	46.0.5	1
ghcr.io/berriai/litellm-database :litellm_stable_release_branch-v1.75.5-stable	ab63d26a8a2c	cryptography@43.0.1	46.0.5	1
ghcr.io/blakeblackshear/frigate :0.14.1	22e3d0b486df	cryptography@43.0.0	46.0.5	1
ghcr.io/browserless/chrome :v2.56.7	d600eac6283f	cryptography@41.0.7	46.0.5	1
ghcr.io/browserless/chromium :v2.55.4	2ed0183564d7	cryptography@41.0.7	46.0.5	1
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	cryptography@41.0.7 python-cryptography@41.0.7-4ubuntu0.1	46.0.5 41.0.7-4ubuntu0.3	1
ghcr.io/cfi2017/opencve-scheduler :3.0.0	8d943799621b	cryptography@42.0.8	46.0.5	1
ghcr.io/cloudnative-pg/postgresql :14.5	b3b30d04b362	cryptography@38.0.3	46.0.5	1
ghcr.io/colenio/slo-reporting :0.3.31	6b64d194a27d	cryptography@44.0.0	46.0.5	1
ghcr.io/cosmo-tech/cosmotech-copilot-api :latest	a2be95de450c	cryptography@42.0.5	46.0.5	1
ghcr.io/ctfd/ctfd :3.8.2	870e396fddf8	cryptography@45.0.6	46.0.5	1
ghcr.io/dask/dask :2024.1.0	080150de7d86	cryptography@41.0.3	46.0.5	1
ghcr.io/dask/dask-gateway-server :2024.1.0	881e7acfc5a0	cryptography@41.0.7	46.0.5	1
ghcr.io/dfir-iris/iriswebapp_app :v2.4.26	e59ebde55709	cryptography@46.0.3	46.0.5	1
ghcr.io/dgtlmoon/changedetection.io :0.60.4	7bb6963b730d	cryptography@44.0.0	46.0.5	1
ghcr.io/dgtlmoon/changedetection.io :0.39.4	f1ce4c56ccaa	cryptography@3.4.8	46.0.5	1
ghcr.io/dodevops/azure-advanced-backup :0.4.0	1041d4449e49	cryptography@3.3.2	46.0.5	1
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter :0.1.38	b472877847f5	cryptography@43.0.0	46.0.5	1
ghcr.io/ducksify/pgdump-to-s3 :latest	c42c0946bd0f	cryptography@37.0.2	46.0.5	1
ghcr.io/element-hq/synapse :v1.111.0	22ae556e0de4	cryptography@42.0.8	46.0.5	1
ghcr.io/gabe565/obico/web :latest	a5c1daef46c0	cryptography@44.0.0	46.0.5	1
ghcr.io/gamosoft/notediscovery :0.31.5	c06aa0fa9a85	cryptography@41.0.7	46.0.5	1
ghcr.io/grycap/im :latest	06a16d4f279f	cryptography@46.0.1	46.0.5	1
ghcr.io/home-assistant/home-assistant :2025.3.0	26c51e44d932	cryptography@44.0.1	46.0.5	1
ghcr.io/home-assistant/home-assistant :2025.12.5	9a5a3eb4a213	cryptography@46.0.2	46.0.5	1
ghcr.io/home-assistant/home-assistant :2022.5.4	ec6d67fbedfa	cryptography@36.0.2	46.0.5	1
ghcr.io/home-assistant/home-assistant :2023.11.3	feffc0b8227d	cryptography@41.0.4	46.0.5	1
ghcr.io/hoverkraft-tech/ovh-snapshoter/app :0.4.10	10d271f08ab3	cryptography@43.0.3	46.0.5	1
ghcr.io/iisas/domino-rest :latest	3009350bfc11	cryptography@45.0.7	46.0.5	1
ghcr.io/jfwenisch/steamcmd-manager :v0.4.5	dab685e668d9	cryptography@41.0.7 python-cryptography@41.0.7-4ubuntu0.1	46.0.5 41.0.7-4ubuntu0.3	1
ghcr.io/jfwenisch/webtools :v0.1.4	4569cae83c70	cryptography@41.0.7 python-cryptography@41.0.7-4ubuntu0.1	46.0.5 41.0.7-4ubuntu0.3	1
ghcr.io/k8s-at-home/sabnzbd :v3.3.1	c2d6e775db5a	cryptography@3.4.7	46.0.5	1
ghcr.io/karakeep-app/karakeep :0.27.1	abd7d6b11b1b	cryptography@44.0.3	46.0.5	1