CVE-2026-26958
MediumAdvisory
Published 17 Feb 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.3
- base score, highest
- EPSS
- 0.004
- 30th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 215
- of 17,781 indexed, latest versions
- Container images
- 198
- deployed by those charts
- Fix available
- 1 of 1
- affected package
filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity
Carried by container images the latest versions of 215 of 17,781 indexed charts deploy, on 198 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| filippo.io/ | v1.0.0, v1.0.0-rc.1, v1.1.0 | 1.1.1 | 198 |
- OSV records
- GHSA-fw7p-63qq-7hpr
- Also known as
- GO-2026-4503
Charts affected
215 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| ctlogsigstoreVerified publisher | 0.2.68 | 1 of 4See more | 2,728 |
| trilliansigstoreVerified publisher | 0.3.17 | 1 of 5See more | 2,808 |
| tailscale-operatorskyloud-helm-chartsVerified publisher | 1.70.3 | 1 of 1See more | 1,045 |
| kedasoftonic | 2.17.0 | 2 of 3See more | 2,583 |
| retail-store-sample-catalog-chartstacksimplifyVerified publisher | 2.0.0 | 1 of 1See more | 759 |
| wonder-mesh-netstrrl-helm | 2026.629.0 | 1 of 3See more | 5,063 |
| ping-exporterth-chartsVerified publisher | 0.1.1 | 1 of 1See more | 1,236 |
| the0the0Verified publisher | 0.9.8 | 1 of 9See more | 7,248 |
| tfy-cloudflaredtruefoundryVerified publisher | 0.5.0 | 1 of 2See more | 2,015 |
| opencloudunxwaresVerified publisher | 0.2.3 | 2 of 13See more | 45,239 |
| vals-operatorvals-operatorVerified publisher | 0.8.1 | 1 of 1See more | 696 |
| argo-eventswenerme | 2.4.27 | 1 of 1See more | 969 |
| juicefs-csi-driverwenerme | 0.32.5 | 1 of 5See more | 9,117 |
| wexa-studiowexa-studio | 1.2.0 | 2 of 15See more | 14,983 |
| prometheusalertygqygq2Verified publisher | 1.0.0 | 1 of 1See more | 1,611 |
Container images carrying it
198 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 4e4d09552f91 | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | cce8ff866f60 | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 06ed5db6cd33 | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | b914032ef9ad | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | a61c7022abcf | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 832a32779e6d | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 63f7eaf5aa8a | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | c62e3347611c | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 89028adefcff | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 528f2174fa2f | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | b3256cbc7b68 | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 5dfa86b6451f | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 90097a08b87c | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 45e744fc623f | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 7ea1820c1da1 | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 9c7bc0f9bb35 | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 3ebe2fd253f6 | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 2434560e8f0e | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | b880da90aa1a | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 3c1ee82d450d | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 87db0eda7a03 | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | e0334f124863 | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 3a98245a7667 | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 76f0a650e44b | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | d6c9b7a1f7b8 | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 759f3850eda9 | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | ce1862e6b3a5 | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 9476cc5adb12 | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 9f157fe035f1 | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 4723d86e6797 | filippo.io/ | 1.1.1 | 1 |
| ghcr.io/ | 13fd0cccafe8 | filippo.io/ | 1.1.1 | 1 |
| public.ecr.aws/ | b654b266fa32 | filippo.io/ | 1.1.1 | 1 |
| public.ecr.aws/ | 87cbd356af2e | filippo.io/ | 1.1.1 | 1 |
| public.ecr.aws/ | e8014c6c58b6 | filippo.io/ | 1.1.1 | 1 |
| public.ecr.aws/ | cfc92cc2de65 | filippo.io/ | 1.1.1 | 1 |
| public.ecr.aws/ | 9083e60c38bc | filippo.io/ | 1.1.1 | 1 |
| public.ecr.aws/ | 573779e57fae | filippo.io/ | 1.1.1 | 1 |
| public.ecr.aws/ | 08c90bd040bf | filippo.io/ | 1.1.1 | 1 |
| quay.io/ | 6efd1cb89dc1 | filippo.io/ | 1.1.1 | 1 |
| quay.io/ | a83d2699ae53 | filippo.io/ | 1.1.1 | 1 |
| quay.io/ | 66388d1b2f08 | filippo.io/ | 1.1.1 | 1 |
| quay.io/ | 5f9aa6a9c385 | filippo.io/ | 1.1.1 | 1 |
| quay.io/ | b741efae8d31 | filippo.io/ | 1.1.1 | 1 |
| quay.io/ | c6b68f158628 | filippo.io/ | 1.1.1 | 1 |
| quay.io/ | 7b4202c25b67 | filippo.io/ | 1.1.1 | 1 |
| registry.gitlab.com/ | f91b602ca572 | filippo.io/ | 1.1.1 | 1 |
| registry.gitlab.com/ | f2194e526915 | filippo.io/ | 1.1.1 | 1 |
| registry.gitlab.com/ | 86d87291ffd4 | filippo.io/ | 1.1.1 | 1 |