CVE-2026-28684
MediumAdvisory
Published 20 Apr 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.6
- base score, highest
- EPSS
- 0.003
- 17th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 162
- of 17,781 indexed, latest versions
- Container images
- 158
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback
Carried by container images the latest versions of 162 of 17,781 indexed charts deploy, on 158 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| python-dotenvpypi | 0.9.1, 0.10.3, 0.11.0, 0.13.0+15 more | 1.2.2 | 158 |
| python-dotenvdeb | 0.9.1-1, 0.19.2-1 | no fix listed | 2 |
- OSV records
- GHSA-mf9w-mj56-hr94UBUNTU-CVE-2026-28684
- Also known as
- PYSEC-2026-2270
Charts affected
162 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| take-the-helmtake-the-helm | 0.1.0 | 1 of 1See more | 805 |
| flask-contactstest-configmap | 1.0.1 | 1 of 3See more | 5,704 |
| chatqnatest-opea | 1.0.0 | 1 of 11See more | 39,090 |
| docsumtest-opea | 1.0.0 | 1 of 5See more | 28,858 |
| guardrails-usvctest-opea | 1.0.0 | 1 of 1See more | 5,221 |
| retriever-usvctest-opea | 1.0.0 | 1 of 1See more | 5,198 |
| web-retrievertest-opea | 1.0.0 | 1 of 1See more | 5,350 |
| thanhvt27-lab-k8sthanh-vtVerified publisher | 0.1.4 | 1 of 5See more | 4,661 |
| kasa-exporterth-chartsVerified publisher | 0.1.0 | 1 of 1See more | 1,515 |
| zookeepertwomartensVerified publisher | 0.2.2 | 1 of 1See more | 1,733 |
| calibre-webvista | 0.1.3 | 1 of 1See more | 7,628 |
| supersetwbstack | 0.1.0 | 1 of 1See more | 7,085 |
Container images carrying it
158 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| quay.io/ | 70d138997acd | python-dotenv | 1.2.2 | 1 |
| quay.io/ | 1a9ce0b8fbd4 | python-dotenv | 1.2.2 | 1 |
| quay.io/ | 55b12c2a8440 | python-dotenv | 1.2.2 | 1 |
| quay.io/ | a68453858339 | python-dotenv | 1.2.2 | 1 |
| registry.gitlab.com/ | f21f19346b29 | python-dotenv | 1.2.2 | 1 |
| registry.gitlab.com/ | 4eaf9c911f33 | python-dotenv | 1.2.2 | 1 |
| registry.gitlab.com/ | 0886cbbc5f95 | python-dotenv | 1.2.2 | 1 |
| registry.gitlab.com/ | 4e7faf6f8d5f | python-dotenv | 1.2.2 | 1 |