CVE-2026-26958
MediumAdvisory
Published 17 Feb 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.3
- base score, highest
- EPSS
- 0.004
- 30th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 215
- of 17,781 indexed, latest versions
- Container images
- 198
- deployed by those charts
- Fix available
- 1 of 1
- affected package
filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity
Carried by container images the latest versions of 215 of 17,781 indexed charts deploy, on 198 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| filippo.io/ | v1.0.0, v1.0.0-rc.1, v1.1.0 | 1.1.1 | 198 |
- OSV records
- GHSA-fw7p-63qq-7hpr
- Also known as
- GO-2026-4503
Charts affected
215 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| mimir-distributedgrafana | 6.2.0 | 1 of 6See more | 4,517 |
| dexdexVerified publisher | 0.24.1 | 1 of 1See more | 1,765 |
| argo-eventsargoOfficialVerified publisher | 2.4.27 | 1 of 1See more | 969 |
| openebsopenebsOfficialVerified publisher | 4.6.1 | 2 of 35See more | 23,894 |
| miniominio-official | 5.4.0 | 1 of 2See more | 2,483 |
| chaos-meshchaos-meshVerified publisher | 2.8.4 | 1 of 4See more | 6,342 |
| semaphoresemaphoreuiOfficialVerified publisher | 16.2.2 | 1 of 1See more | 2,221 |
| pulsarapache | 4.7.0 | 1 of 10See more | 9,864 |
| miniocloudpirates-minioVerified publisher | 0.13.4 | 1 of 1See more | 961 |
| pyroscopegrafana | 2.3.1 | 1 of 3See more | 3,157 |
| headscalegabe565Verified publisher | 0.16.0 | 1 of 2See more | 1,979 |
| dgraphdgraph | 24.1.4 | 1 of 1See more | 2,993 |
| netbirdjaconiVerified publisher | 0.15.1 | 1 of 4See more | 8,390 |
| plane-cemakeplaneOfficialVerified publisher | 1.8.1 | 1 of 11See more | 4,854 |
| milvusmilvus-helm | 5.0.27 | 1 of 4See more | 10,670 |
| ansible-semaphorecloudhippieVerified publisher | 15.2.10 | 1 of 1See more | 1,235 |
| renterdartur9010Verified publisher | 1.4.4 | 1 of 2See more | 8,493 |
| budibasebudibase | 0.0.0-master | 1 of 7See more | 10,775 |
| ilumilumOfficialVerified publisher | 6.7.3 | 2 of 19See more | 23,228 |
| k8s-infrasignoz | 0.17.1 | 1 of 1See more | 1,039 |
| doris-operatordorisVerified publisher | 25.8.0 | 1 of 1See more | 438 |
| gotifygotifyVerified publisher | 0.8.1 | 1 of 1See more | 568 |
| tailscale-relaymvisonneau | 0.2.7 | 1 of 1See more | 1,356 |
| rekorsigstoreVerified publisher | 1.8.5 | 1 of 9See more | 5,415 |
| thehivestrangebee-helmOfficialVerified publisher | 1.0.6 | 1 of 7See more | 16,210 |
| baserowbaserow-chartVerified publisher | 1.0.56 | 2 of 6See more | 17,263 |
| celestia-appcelestia-labsVerified publisher | 0.5.0 | 1 of 3See more | 1,066 |
| dolibarrcowboysysopVerified publisher | 9.0.3 | 1 of 3See more | 9,106 |
| seafiledatamateVerified publisher | 0.6.0 | 1 of 6See more | 27,267 |
| headplanenbcloudVerified publisher | 0.1.2 | 1 of 4See more | 7,949 |
| fulciosigstoreVerified publisher | 2.11.1 | 2 of 6See more | 3,490 |
| caddy-ingress-controllercaddy-ingress | 1.3.0 | 1 of 1See more | 1,884 |
| convertigoconvertigoOfficialVerified publisher | 8.4.3 | 1 of 5See more | 17,404 |
| cosmocosmo-platformOfficialVerified publisher | 0.20.0 | 1 of 10See more | 28,839 |
| hoppscotchdeliveryheroVerified publisher | 0.3.2 | 1 of 1See more | 3,451 |
| coreinstill-aiOfficialVerified publisher | 0.1.75 | 5 of 15See more | 30,816 |
| kubeviouskubevious | 1.2.2 | 1 of 7See more | 14,204 |
| kubevpnkubevpn-charts | 2.11.7 | 1 of 1See more | 1,596 |
| repoflowrepoflow-helm-public | 0.9.1 | 1 of 8See more | 13,521 |
| miniosolidchartsVerified publisher | 0.5.0 | 1 of 1See more | 1,055 |
| agentareaagentareaVerified publisher | 0.0.18 | 2 of 16See more | 14,914 |
| alertmanager-matrixalertmanager-matrixVerified publisher | 0.1.16 | 1 of 1See more | 454 |
| upcloud-csiankra-chartsVerified publisher | 0.4.0 | 1 of 8See more | 14,917 |
| scannerappscodeVerified publisher | 2026.1.15 | 1 of 3See more | 5,299 |
| stash-enterpriseappscodeVerified publisher | 0.42.0 | 2 of 4See more | 3,620 |
| kedaarieotechVerified publisher | 0.1.0 | 2 of 3See more | 2,276 |
| aramid-participationbiatec-repoVerified publisher | 4.4.1 | 1 of 1See more | 7,190 |
| aramid-relaybiatec-repoVerified publisher | 4.4.1 | 1 of 1See more | 5,059 |
| voimain-participationbiatec-repoVerified publisher | 4.4.1 | 1 of 1See more | 7,190 |
| celestia-nodecelestia-node | 0.1.7 | 1 of 1See more | 1,799 |
Container images carrying it
198 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| flanksource/ | 689687a7cf95 | filippo.io/ | 1.1.1 | 1 |
| fleetdm/ | 12e644b7f40e | filippo.io/ | 1.1.1 | 1 |
| foxcpp/ | a4b839985b9b | filippo.io/ | 1.1.1 | 1 |
| foxcpp/ | eeb5813fc4d1 | filippo.io/ | 1.1.1 | 1 |
| gboxproxy/ | 3a9f4a711d5c | filippo.io/ | 1.1.1 | 1 |
| gitea/ | 76f516a1a8c2 | filippo.io/ | 1.1.1 | 1 |
| gotify/ | a3af47067ce6 | filippo.io/ | 1.1.1 | 1 |
| grafana/ | 8c7256f412fe | filippo.io/ | 1.1.1 | 1 |
| grafana/ | 847c287ada0e | filippo.io/ | 1.1.1 | 1 |
| grafana/ | 92bd5700577b | filippo.io/ | 1.1.1 | 1 |
| grafana/ | cd6e176883a9 | filippo.io/ | 1.1.1 | 1 |
| grafana/ | 09d8c3ce4f3a | filippo.io/ | 1.1.1 | 1 |
| hashicorp/ | bbb7f98dc67d | filippo.io/ | 1.1.1 | 1 |
| headscale/ | a7a8ae9616bb | filippo.io/ | 1.1.1 | 1 |
| headscale/ | cd37b3001857 | filippo.io/ | 1.1.1 | 1 |
| hoppscotch/ | 538fe6ded4b6 | filippo.io/ | 1.1.1 | 1 |
| instill/ | c4a393e601ed | filippo.io/ | 1.1.1 | 1 |
| instill/ | ebe12f77a3f9 | filippo.io/ | 1.1.1 | 1 |
| instill/ | e980125e5ba5 | filippo.io/ | 1.1.1 | 1 |
| iotaledger/ | 01206f1ba89c | filippo.io/ | 1.1.1 | 1 |
| iotaledger/ | 12c669cb8748 | filippo.io/ | 1.1.1 | 1 |
| juicedata/ | 95008ba63318 | filippo.io/ | 1.1.1 | 1 |
| kubevious/ | 6233e84bdd59 | filippo.io/ | 1.1.1 | 1 |
| library/ | 60fb54d36b4b | filippo.io/ | 1.1.1 | 1 |
| library/ | b4e3952384eb | filippo.io/ | 1.1.1 | 1 |
| minio/ | 14b7076ca85a | filippo.io/ | 1.1.1 | 1 |
| minio/ | 391d1d45fdbe | filippo.io/ | 1.1.1 | 1 |
| minio/ | 46b3009bf704 | filippo.io/ | 1.1.1 | 1 |
| minio/ | d249d1fb6966 | filippo.io/ | 1.1.1 | 1 |
| mvisonneau/ | fc45ad8abf10 | filippo.io/ | 1.1.1 | 1 |
| nathanfirmo/ | 6b0487e6e987 | filippo.io/ | 1.1.1 | 1 |
| neosmemo/ | 3eefcc231141 | filippo.io/ | 1.1.1 | 1 |
| neosmemo/ | c6defc2dfb98 | filippo.io/ | 1.1.1 | 1 |
| netbirdio/ | 0c9994b393ea | filippo.io/ | 1.1.1 | 1 |
| openfga/ | 5e94966c11df | filippo.io/ | 1.1.1 | 1 |
| oryd/ | b94007e19a1f | filippo.io/ | 1.1.1 | 1 |
| otel/ | 37fa87091cfa | filippo.io/ | 1.1.1 | 1 |
| otel/ | 3bc07732530c | filippo.io/ | 1.1.1 | 1 |
| otel/ | 5ac3e0ba2b0b | filippo.io/ | 1.1.1 | 1 |
| otel/ | 923eb1cfae32 | filippo.io/ | 1.1.1 | 1 |
| otel/ | a7343f018690 | filippo.io/ | 1.1.1 | 1 |
| otel/ | faf125d656fa | filippo.io/ | 1.1.1 | 1 |
| owncloud/ | 88e7c854517d | filippo.io/ | 1.1.1 | 1 |
| owncloud/ | b38fd8fdd58f | filippo.io/ | 1.1.1 | 1 |
| peterdavehello/ | 0cc12d36d312 | filippo.io/ | 1.1.1 | 1 |
| photoprism/ | db16ee6b1ba3 | filippo.io/ | 1.1.1 | 1 |
| schemahero/ | 1609e1a05cd3 | filippo.io/ | 1.1.1 | 1 |
| scholtz2/ | f12ce1cfb72e | filippo.io/ | 1.1.1 | 1 |
| scholtz2/ | 5aaa5d4ab8b8 | filippo.io/ | 1.1.1 | 1 |
| scholtz2/ | 64966de56d9f | filippo.io/ | 1.1.1 | 1 |