CVE-2026-28684
MediumAdvisory
Published 20 Apr 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.6
- base score, highest
- EPSS
- 0.003
- 17th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 162
- of 17,781 indexed, latest versions
- Container images
- 158
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback
Carried by container images the latest versions of 162 of 17,781 indexed charts deploy, on 158 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| python-dotenvpypi | 0.9.1, 0.10.3, 0.11.0, 0.13.0+15 more | 1.2.2 | 158 |
| python-dotenvdeb | 0.9.1-1, 0.19.2-1 | no fix listed | 2 |
- OSV records
- GHSA-mf9w-mj56-hr94UBUNTU-CVE-2026-28684
- Also known as
- PYSEC-2026-2270
Charts affected
162 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| take-the-helmtake-the-helm | 0.1.0 | 1 of 1See more | 805 |
| flask-contactstest-configmap | 1.0.1 | 1 of 3See more | 5,704 |
| chatqnatest-opea | 1.0.0 | 1 of 11See more | 39,090 |
| docsumtest-opea | 1.0.0 | 1 of 5See more | 28,858 |
| guardrails-usvctest-opea | 1.0.0 | 1 of 1See more | 5,221 |
| retriever-usvctest-opea | 1.0.0 | 1 of 1See more | 5,198 |
| web-retrievertest-opea | 1.0.0 | 1 of 1See more | 5,350 |
| thanhvt27-lab-k8sthanh-vtVerified publisher | 0.1.4 | 1 of 5See more | 4,661 |
| kasa-exporterth-chartsVerified publisher | 0.1.0 | 1 of 1See more | 1,515 |
| zookeepertwomartensVerified publisher | 0.2.2 | 1 of 1See more | 1,733 |
| calibre-webvista | 0.1.3 | 1 of 1See more | 7,628 |
| supersetwbstack | 0.1.0 | 1 of 1See more | 7,085 |
Container images carrying it
158 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| shashkist/ | 581de1fd6084 | python-dotenv | 1.2.2 | 4 |
| apache/ | 16b50bbef664 | python-dotenv | 1.2.2 | 3 |
| quay.io/ | 6545dac92173 | python-dotenv | 1.2.2 | 3 |
| amancevice/ | 12a0a9e66550 | python-dotenv | 1.2.2 | 2 |
| confluentinc/ | ac776fad95a5 | python-dotenv | 1.2.2 | 2 |
| confluentinc/ | 7610a50b13e7 | python-dotenv | 1.2.2 | 2 |
| confluentinc/ | cae577096489 | python-dotenv | 1.2.2 | 2 |
| lncm/ | 36eaa06f99f4 | python-dotenv | 1.2.2 | 2 |
| opea/ | eb746b263705 | python-dotenv | 1.2.2 | 2 |
| taigaio/ | fd4568a97a59 | python-dotenv | 1.2.2 | 2 |
| ghcr.io/ | fd8d3e6e4cdf | python-dotenv | 1.2.2 | 2 |
| allegroai/ | fca885e8cfc6 | python-dotenv | 1.2.2 | 1 |
| apache/ | 64e58748b6b9 | python-dotenv | 1.2.2 | 1 |
| apache/ | ce90bdc3d2af | python-dotenv | 1.2.2 | 1 |
| apache/ | e5560ad0b86e | python-dotenv | 1.2.2 | 1 |
| apache/ | 975ab033580d | python-dotenv | 1.2.2 | 1 |
| apache/ | ab9467fd712c | python-dotenv | 1.2.2 | 1 |
| apecloud/ | 8ac9947a2c84 | python-dotenv | 1.2.2 | 1 |
| asdkant/ | a23d8bf7c885 | python-dotenv | 1.2.2 | 1 |
| assistiot/ | 792715dd3084 | python-dotenv | 1.2.2 | 1 |
| assistiot/ | 30812ba93555 | python-dotenv | 1.2.2 | 1 |
| baserow/ | e0b3c8130b91 | python-dotenv | 1.2.2 | 1 |
| baserow/ | df0c42eb67e8 | python-dotenv | 1.2.2 | 1 |
| benbusby/ | f77f7e6e4ad2 | python-dotenv | 1.2.2 | 1 |
| berkeleyskypilot/ | 8da2f3cda472 | python-dotenv | 1.2.2 | 1 |
| bmeares/ | 8e9c5bacaa82 | python-dotenv | 1.2.2 | 1 |
| cadmusthefounder/ | e596c5fbf80f | python-dotenv | 1.2.2 | 1 |
| castai/ | da62858c8381 | python-dotenv | 1.2.2 | 1 |
| chandanteekinavar/ | c49ff7c141c0 | python-dotenv | 1.2.2 | 1 |
| ciuse99/ | d72768245ef5 | python-dotenv | 1.2.2 | 1 |
| clsen2024/ | 0ba9eff852c5 | python-dotenv | 1.2.2 | 1 |
| clsen2024/ | 51b1d45961cd | python-dotenv | 1.2.2 | 1 |
| clsen2024/ | efb1586c8299 | python-dotenv | 1.2.2 | 1 |
| confluentinc/ | 3bf359d5e340 | python-dotenv | 1.2.2 | 1 |
| confluentinc/ | 83dbca3efd2a | python-dotenv | 1.2.2 | 1 |
| confluentinc/ | adc392d28a1e | python-dotenv | 1.2.2 | 1 |
| confluentinc/ | c0224a1adf7a | python-dotenv | 1.2.2 | 1 |
| confluentinc/ | dc9b972db002 | python-dotenv | 1.2.2 | 1 |
| confluentinc/ | 8ec46c27982f | python-dotenv | 1.2.2 | 1 |
| confluentinc/ | 0bec03c1f3ce | python-dotenv | 1.2.2 | 1 |
| confluentinc/ | 5ca5f3269814 | python-dotenv | 1.2.2 | 1 |
| douz/ | 4384103d0219 | python-dotenv | 1.2.2 | 1 |
| dserio83/ | 6b3d9115fee2 | python-dotenv | 1.2.2 | 1 |
| dserio83/ | d5deae589229 | python-dotenv | 1.2.2 | 1 |
| evk02/ | ef6ff257ef35 | python-dotenv | 1.2.2 | 1 |
| factly/ | ca5bc71d1d5c | python-dotenv | 1.2.2 | 1 |
| flagsmith/ | fd58556339a4 | python-dotenv | 1.2.2 | 1 |
| freedom98/ | d7ce1533f297 | python-dotenv | 1.2.2 | 1 |
| hkotel/ | a7e6b6abe087 | python-dotenv | 1.2.2 | 1 |
| jamoos/ | 163e2e8a6e87 | python-dotenv | 1.2.2 | 1 |