StackRadar

CVE-2026-28684

Medium

Advisory

Published 20 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.6
base score, highest
EPSS
0.003
17th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
162
of 17,781 indexed, latest versions
Container images
158
deployed by those charts
Fix available
1 of 2
affected packages

python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback

Carried by container images the latest versions of 162 of 17,781 indexed charts deploy, on 158 images.

Affected packageAffected versionsFixed inImages
python-dotenvpypi0.9.1, 0.10.3, 0.11.0, 0.13.0+15 more1.2.2158
python-dotenvdeb0.9.1-1, 0.19.2-1no fix listed2
OSV records
GHSA-mf9w-mj56-hr94UBUNTU-CVE-2026-28684
Also known as
PYSEC-2026-2270

Charts affected

162 by stars
ChartLatestAffected imagesRadar Score
monitoringantmediaVerified publisher1.0.01 of 6See more

monitoring antmedia 1.0.0

1 of the 6 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
confluentinc/cp-zookeeper:latest7610a50b13e7
python-dotenv@0.21.1
1.2.2

Open the chart page →

2,453
arlas-aiasarlas-stackVerified publisher28.8.01 of 22See more

arlas-aias arlas-stack 28.8.0

1 of the 22 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
ghcr.io/developmentseed/titiler:0.22.48ac53eb38393
python-dotenv@1.1.1
1.2.2

Open the chart page →

40,238
automatedconfigurationassist-iot-automated-configuration1.0.02 of 5See more

automatedconfiguration assist-iot-automated-configuration 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:7.5.1dc9b972db002
python-dotenv@0.21.1
1.2.2
confluentinc/cp-zookeeper:7.5.10bec03c1f3ce
python-dotenv@0.21.1
1.2.2

Open the chart page →

14,728
trainingcollectorassist-iot-fl-training-collector1.1.01 of 1See more

trainingcollector assist-iot-fl-training-collector 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
assistiot/fl_training_collector:latest792715dd3084
python-dotenv@0.19.1
1.2.2

Open the chart page →

1,719
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
assistiot/open_api_backend:1.1.230812ba93555
python-dotenv@1.0.0
1.2.2

Open the chart page →

18,277
asya-playgroundasya1.1.31 of 1See more

asya-playground asya 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
localstack/localstack:3.19d278167f2b7
python-dotenv@1.0.1
1.2.2

Open the chart page →

9,412
shynetatrox0.1.11 of 1See more

shynet atrox 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.12.0e821e31140f7
python-dotenv@0.18.0
1.2.2

Open the chart page →

5,507
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
python-dotenv@1.0.1
1.2.2

Open the chart page →

10,145
castai-hibernatecastaiVerified publisher0.2.121 of 1See more

castai-hibernate castai 0.2.12

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
castai/hibernate:v0.14da62858c8381
python-dotenv@0.21.1
1.2.2

Open the chart page →

1,146
suggestarrcharliecharts0.4.41 of 1See more

suggestarr charliecharts 0.4.4

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
ciuse99/suggestarr:v1.0.20d72768245ef5
python-dotenv@1.0.1
1.2.2

Open the chart page →

1,126
chat-searchchat-searchVerified publisher0.1.71 of 1See more

chat-search chat-search 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
ghcr.io/hemslo/chat-search:latest39d48995a5bd
python-dotenv@1.0.1
1.2.2

Open the chart page →

4,042
kube-acp-stackcloudentity2.28.01 of 7See more

kube-acp-stack cloudentity 2.28.0

1 of the 7 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
python-dotenv@1.0.1
1.2.2

Open the chart page →

20,900
pbcore-utilcluster-deploy0.0.11 of 1See more

pbcore-util cluster-deploy 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/pbcore-util:pr-66e04659a3baa
python-dotenv@1.2.1
1.2.2

Open the chart page →

9,128
sumoconsensys0.4.1451 of 4See more

sumo consensys 0.4.145

1 of the 4 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:7.1.2.amd643bf359d5e340
python-dotenv@0.20.0
1.2.2

Open the chart page →

5,958
csghubcsghubVerified publisher2.4.32 of 34See more

csghub csghub 2.4.3

2 of the 34 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
python-dotenv@1.1.1
1.2.2
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
python-dotenv@1.2.1
1.2.2

Open the chart page →

58,897
csgshipcsghubVerified publisher0.4.62 of 10See more

csgship csghub 0.4.6

2 of the 10 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
opencsghq/csgship-agentic:v0.4.02cd29671a03e
python-dotenv@1.1.1
1.2.2
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
python-dotenv@1.1.1
1.2.2

Open the chart page →

11,335
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
python-dotenv@0.19.2
1.2.2

Open the chart page →

5,062
supersetdeliveryheroVerified publisher1.1.31 of 1See more

superset deliveryhero 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
apache/superset:latest16b50bbef664
python-dotenv@1.1.0
1.2.2

Open the chart page →

2,305
design-cataloguedesign-catalogue0.1.01 of 2See more

design-catalogue design-catalogue 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
registry.gitlab.com/open-forms/design-catalogue:latestf21f19346b29
python-dotenv@0.15.0
1.2.2

Open the chart page →

2,770
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
python-dotenv@1.0.1
1.2.2

Open the chart page →

9,607
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
python-dotenv@1.0.1
1.2.2

Open the chart page →

9,607
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
python-dotenv@1.0.1
1.2.2

Open the chart page →

19,224
adventurelogdjjudas21Verified publisher0.1.11 of 3See more

adventurelog djjudas21 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
ghcr.io/seanmorley15/adventurelog-backend:v0.13.00250d9cb0d74
python-dotenv@1.1.0
1.2.2

Open the chart page →

7,459
wizarrdjjudas21Verified publisher0.1.51 of 1See more

wizarr djjudas21 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
python-dotenv@1.0.0
1.2.2

Open the chart page →

14,627
helpdeskdoubanVerified publisher0.3.31 of 2See more

helpdesk douban 0.3.3

1 of the 2 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
douz/helpdesk:latest4384103d0219
python-dotenv@0.20.0
1.2.2

Open the chart page →

4,550
rommernail-romm1.0.11 of 1See more

romm ernail-romm 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
rommapp/romm:4.4.1b909e95d1aab
python-dotenv@1.0.1
1.2.2

Open the chart page →

2,896
external-secrets-reloaderexternal-secrets-reloader0.1.01 of 1See more

external-secrets-reloader external-secrets-reloader 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
ghcr.io/bensoer/external-secrets-reloader:v0.1.38e31b5a81853
python-dotenv@1.2.1
1.2.2

Open the chart page →

1,030
huntingfactlyVerified publisher0.4.141 of 1See more

hunting factly 0.4.14

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
python-dotenv@0.21.0
1.2.2

Open the chart page →

4,085
findery-marketfindery-market0.1.01 of 7See more

findery-market findery-market 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
chandanteekinavar/findery-market-product-service:1.0c49ff7c141c0
python-dotenv@0.19.0
1.2.2

Open the chart page →

7,691
flask-contactsfirst-idror-chart1.0.11 of 3See more

flask-contacts first-idror-chart 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
shashkist/flask-contacts-app:latest581de1fd6084
python-dotenv@1.0.1
1.2.2

Open the chart page →

5,704
flask-contactsflask-contacts-generic1.0.11 of 3See more

flask-contacts flask-contacts-generic 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
shashkist/flask-contacts-app:latest581de1fd6084
python-dotenv@1.0.1
1.2.2

Open the chart page →

5,704
forms-catalogueforms-catalogue0.1.01 of 2See more

forms-catalogue forms-catalogue 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
registry.gitlab.com/open-forms/forms-catalogue:latest4eaf9c911f33
python-dotenv@0.19.0
1.2.2

Open the chart page →

2,188
tandoorgabe565Verified publisher0.9.91 of 2See more

tandoor gabe565 0.9.9

1 of the 2 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
python-dotenv@1.0.0
1.2.2

Open the chart page →

2,183
spectergaloymoney0.3.11 of 1See more

specter galoymoney 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
lncm/specter-desktop:v1.10.536eaa06f99f4
python-dotenv@0.13.0
1.2.2

Open the chart page →

1,691
spectergaloymoney20.3.11 of 1See more

specter galoymoney2 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
lncm/specter-desktop:v1.10.536eaa06f99f4
python-dotenv@0.13.0
1.2.2

Open the chart page →

1,691
babybuddygeek-cookbookVerified publisher1.2.21 of 1See more

babybuddy geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
linuxserver/babybuddy:1.10.2f7d7c7704249
python-dotenv@0.19.2
1.2.2

Open the chart page →

1,489
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
python-dotenv@1.2.1
1.2.2

Open the chart page →

8,923
whooglegeek-cookbookVerified publisher3.4.21 of 1See more

whoogle geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
benbusby/whoogle-search:0.5.4f77f7e6e4ad2
python-dotenv@0.16.0
1.2.2

Open the chart page →

2,061
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-recommendationserviceb294a4278407
python-dotenv@1.0.0
1.2.2

Open the chart page →

49,025
gwangju_2-3gwangju2-30.1.03 of 5See more

gwangju_2-3 gwangju2-3 0.1.0

3 of the 5 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
clsen2024/gwangju_2-3:service-b-10ba9eff852c5
python-dotenv@1.0.1
1.2.2
clsen2024/gwangju_2-3:service-a-151b1d45961cd
python-dotenv@1.0.1
1.2.2
clsen2024/gwangju_2-3:service-c-1efb1586c8299
python-dotenv@1.0.1
1.2.2

Open the chart page →

6,491
librechat-exporterhajowielandVerified publisher1.0.01 of 1See more

librechat-exporter hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
ghcr.io/virtuos/librechat_exporter:2.0.050ea1cf0086f
python-dotenv@1.1.0
1.2.2

Open the chart page →

2,284
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
python-dotenv@1.0.1
1.2.2

Open the chart page →

4,647
supersethelm-charts-nr1.1.31 of 1See more

superset helm-charts-nr 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
apache/superset:latest16b50bbef664
python-dotenv@1.1.0
1.2.2

Open the chart page →

2,305
immichhelmforgeVerified publisher1.2.81 of 5See more

immich helmforge 1.2.8

1 of the 5 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-machine-learning:v3.1.05a0839dc5303
python-dotenv@1.0.0
1.2.2

Open the chart page →

11,042
supersethelmforgeVerified publisher1.3.61 of 5See more

superset helmforge 1.3.6

1 of the 5 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
apache/superset:6.1.016b50bbef664
python-dotenv@1.1.0
1.2.2

Open the chart page →

5,714
nominatimheywood8-helm-chartsVerified publisher3.10.81 of 3See more

nominatim heywood8-helm-charts 3.10.8

1 of the 3 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
mediagis/nominatim:4.2d0eae7b51374
python-dotenv@0.19.2-1
python-dotenv@0.19.2
no fix listed
1.2.2

Open the chart page →

14,290
paperlesshomelabcihelmchartstestVerified publisher9.1.91 of 1See more

paperless homelabcihelmchartstest 9.1.9

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
python-dotenv@1.0.0
1.2.2

Open the chart page →

16,384
impulseimpulse1.0.161 of 1See more

impulse impulse 1.0.16

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
ghcr.io/eslupmi/impulse:v3.7.03ded1b7ebca0
python-dotenv@1.0.1
1.2.2

Open the chart page →

1,348
guardrails-usvcinfracloud-chartsVerified publisher1.0.11 of 1See more

guardrails-usvc infracloud-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
opea/guardrails-tgi:latestf68bec6a1271
python-dotenv@1.0.1
1.2.2

Open the chart page →

5,062
kweather-chartjamoos0.1.01 of 1See more

kweather-chart jamoos 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-28684.

Container imageDigestPackageFixed in
jamoos/kweather:history163e2e8a6e87
python-dotenv@1.0.1
1.2.2

Open the chart page →

607

Container images carrying it

158 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/ai-lab/llamacpp_python:latest70d138997acd
python-dotenv@1.1.0
1.2.2
1
quay.io/mongodb/farm-intro-backend:0.11a9ce0b8fbd4
python-dotenv@0.14.0
1.2.2
1
quay.io/netscaler/netscaler-k8s-ingress-controller:4.1.1755b12c2a8440
python-dotenv@0.10.3
1.2.2
1
quay.io/netscaler/netscaler-k8s-ingress-controller:4.2.26a68453858339
python-dotenv@0.10.3
1.2.2
1
registry.gitlab.com/open-forms/design-catalogue:latestf21f19346b29
python-dotenv@0.15.0
1.2.2
1
registry.gitlab.com/open-forms/forms-catalogue:latest4eaf9c911f33
python-dotenv@0.19.0
1.2.2
1
registry.gitlab.com/open-forms/request-registry:latest0886cbbc5f95
python-dotenv@0.19.0
1.2.2
1
registry.gitlab.com/radiology/infrastructure/study-governor:8.0.04e7faf6f8d5f
python-dotenv@0.19.2
1.2.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.