StackRadar

CVE-2026-28684

Medium

Advisory

Published 20 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.6
base score, highest
EPSS
0.003
17th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
162
of 17,781 indexed, latest versions
Container images
158
deployed by those charts
Fix available
1 of 2
affected packages

python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback

Carried by container images the latest versions of 162 of 17,781 indexed charts deploy, on 158 images.

Affected packageAffected versionsFixed inImages
python-dotenvpypi0.9.1, 0.10.3, 0.11.0, 0.13.0+15 more1.2.2158
python-dotenvdeb0.9.1-1, 0.19.2-1no fix listed2
OSV records
GHSA-mf9w-mj56-hr94UBUNTU-CVE-2026-28684
Also known as
PYSEC-2026-2270

Charts affected

162 by stars
ChartLatestAffected imagesRadar Score
take-the-helmtake-the-helm0.1.01 of 1See more

take-the-helm take-the-helm 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
cadmusthefounder/lnd:take-the-helm-0.1.0e596c5fbf80f
python-dotenv@0.20.0
1.2.2

Open the chart page →

805
flask-contactstest-configmap1.0.11 of 3See more

flask-contacts test-configmap 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
shashkist/flask-contacts-app:latest581de1fd6084
python-dotenv@1.0.1
1.2.2

Open the chart page →

5,704
chatqnatest-opea1.0.01 of 11See more

chatqna test-opea 1.0.0

1 of the 11 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
opea/retriever-redis:1.0eb746b263705
python-dotenv@1.0.1
1.2.2

Open the chart page →

39,090
docsumtest-opea1.0.01 of 5See more

docsum test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
opea/llm-docsum-tgi:1.002f9e8fa5d71
python-dotenv@1.0.1
1.2.2

Open the chart page →

28,858
guardrails-usvctest-opea1.0.01 of 1See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
opea/guardrails-tgi:1.0262c6048aab8
python-dotenv@1.0.1
1.2.2

Open the chart page →

5,221
retriever-usvctest-opea1.0.01 of 1See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
opea/retriever-redis:1.0eb746b263705
python-dotenv@1.0.1
1.2.2

Open the chart page →

5,198
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
python-dotenv@1.0.1
1.2.2

Open the chart page →

5,350
thanhvt27-lab-k8sthanh-vtVerified publisher0.1.41 of 5See more

thanhvt27-lab-k8s thanh-vt 0.1.4

1 of the 5 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
pysga1996/python-redis-web:latestfdeec30ad482
python-dotenv@0.21.1
1.2.2

Open the chart page →

4,661
kasa-exporterth-chartsVerified publisher0.1.01 of 1See more

kasa-exporter th-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
thelande/kasa_exporter:v0.2.3a1fdb8baa152
python-dotenv@1.0.1
1.2.2

Open the chart page →

1,515
zookeepertwomartensVerified publisher0.2.21 of 1See more

zookeeper twomartens 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
confluentinc/cp-zookeeper:latest7610a50b13e7
python-dotenv@0.21.1
1.2.2

Open the chart page →

1,733
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
python-dotenv@1.1.1
1.2.2

Open the chart page →

7,628
supersetwbstack0.1.01 of 1See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
apache/superset:4.0.1ab9467fd712c
python-dotenv@0.19.0
1.2.2

Open the chart page →

7,085

Container images carrying it

158 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
tock/gen-ai-orchestrator-server:25.10.7abf7880e0449
python-dotenv@1.2.1
1.2.2
1
vabene1111/recipes:2.3.50f8d061895e9
python-dotenv@1.1.1
1.2.2
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
python-dotenv@0.19.2
1.2.2
1
witcherek7/pav:0.0.342a744f29ac0
python-dotenv@0.21.0
1.2.2
1
youssef11gaber10/flask-service:latest9c727fcfde76
python-dotenv@1.0.0
1.2.2
1
zepai/knowledge-graph-mcp:v0.2.16ab0ee79926b
python-dotenv@1.1.1
1.2.2
1
zurdi15/romm:2.3.12db88fe44c89
python-dotenv@1.0.0
1.2.2
1
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
python-dotenv@1.0.1
1.2.2
1
ghcr.io/bensoer/external-secrets-reloader:v0.1.38e31b5a81853
python-dotenv@1.2.1
1.2.2
1
ghcr.io/bensoer/sibyl:v0.2.06dca4455fde3
python-dotenv@1.2.1
1.2.2
1
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
python-dotenv@1.0.1
1.2.2
1
ghcr.io/colenio/slo-reporting:0.3.316b64d194a27d
python-dotenv@1.0.1
1.2.2
1
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
python-dotenv@1.0.0
1.2.2
1
ghcr.io/ctfd/ctfd:3.8.2870e396fddf8
python-dotenv@0.13.0
1.2.2
1
ghcr.io/developmentseed/titiler:0.22.48ac53eb38393
python-dotenv@1.1.1
1.2.2
1
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
python-dotenv@1.2.1
1.2.2
1
ghcr.io/drewburr-labs/mum-discord-bot:3.1.26e82914e1051
python-dotenv@0.11.0
1.2.2
1
ghcr.io/eslupmi/impulse:v3.7.03ded1b7ebca0
python-dotenv@1.0.1
1.2.2
1
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
python-dotenv@1.2.1
1.2.2
1
ghcr.io/hemslo/chat-search:latest39d48995a5bd
python-dotenv@1.0.1
1.2.2
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
python-dotenv@1.0.1
1.2.2
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
python-dotenv@1.2.1
1.2.2
1
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
python-dotenv@0.20.0
1.2.2
1
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
python-dotenv@1.2.1
1.2.2
1
ghcr.io/immich-app/immich-machine-learning:v2.3.1379e31b8c751
python-dotenv@1.0.0
1.2.2
1
ghcr.io/immich-app/immich-machine-learning:v3.1.05a0839dc5303
python-dotenv@1.0.0
1.2.2
1
ghcr.io/jaydee94/kubeseal-webgui/api:4.5.33cceb9462ae1
python-dotenv@1.1.0
1.2.2
1
ghcr.io/libretime/libretime-api:latesteae026cc8909
python-dotenv@1.1.1
1.2.2
1
ghcr.io/m0nsterrr/hyperglass:v2.0.4f7b5d20c5e42
python-dotenv@1.0.1
1.2.2
1
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
python-dotenv@1.1.1
1.2.2
1
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
python-dotenv@1.0.1
1.2.2
1
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
python-dotenv@1.2.1
1.2.2
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
python-dotenv@1.2.1
1.2.2
1
ghcr.io/open-telemetry/demo:1.12.0-recommendationserviceb294a4278407
python-dotenv@1.0.0
1.2.2
1
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
python-dotenv@1.0.1
1.2.2
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
python-dotenv@1.2.1
1.2.2
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
python-dotenv@1.2.1
1.2.2
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
python-dotenv@1.2.1
1.2.2
1
ghcr.io/paperless-ngx/paperless-ngx:1.8.09bbc9a90641e
python-dotenv@0.20.0
1.2.2
1
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
python-dotenv@1.0.0
1.2.2
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
python-dotenv@1.2.1
1.2.2
1
ghcr.io/port-labs/port-agent:v0.8.12c92d1e223f5c
python-dotenv@1.1.0
1.2.2
1
ghcr.io/rodg/rtmp-controller:latest67f99a5beab7
python-dotenv@1.0.0
1.2.2
1
ghcr.io/seanmorley15/adventurelog-backend:v0.13.00250d9cb0d74
python-dotenv@1.1.0
1.2.2
1
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
python-dotenv@1.0.0
1.2.2
1
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
python-dotenv@1.0.1
1.2.2
1
ghcr.io/virtuos/librechat_exporter:2.0.050ea1cf0086f
python-dotenv@1.1.0
1.2.2
1
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
python-dotenv@1.1.1
1.2.2
1
ghcr.io/wgbh-mla/pbcore-util:pr-66e04659a3baa
python-dotenv@1.2.1
1.2.2
1
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
python-dotenv@1.0.0
1.2.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.