CVE-2026-4360

Medium

Advisory

Published 30 Jun 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.003; 20th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 553; of 17,787 indexed, latest versions
Container images: 531; deployed by those charts
Fix available: 15 of 16; affected packages

Tarfile.extract() doesn't fully respect filter parameter

Carried by container images the latest versions of 553 of 17,787 indexed charts deploy, on 531 images.

Affected package	Affected versions	Fixed in	Images
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	3.8.10-0ubuntu1~20.04.18+esm7	100
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3+11 more	3.12.3-1ubuntu0.17	86
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+16 more	3.10.12-1~22.04.18	80
python3apk	3.11.12-r1, 3.12.8-r1, 3.12.9-r0, 3.12.10-r0+7 more	3.12.14-r0, 3.14.7-r0	75
python3.13deb	3.13.5-2, 3.13.5-2+deb13u2, 3.13.5-2+deb13u4, 3.13.7-1ubuntu0.1	3.13.5-2+deb13u5	75
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	3.6.9-1~18.04ubuntu1.13+esm10	44
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+9 more	2.7.6-8ubuntu0.6+esm30, 2.7.12-1ubuntu0~16.04.18+esm22, 2.7.17-1~18.04ubuntu1.13+esm15, 2.7.18-13ubuntu1.5+esm9	43
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	3.5.2-2ubuntu0~16.04.13+esm25	25
python3.14deb	3.14.4-1, 3.14.4-1ubuntu0.1	3.14.4-1ubuntu0.2	8
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	3.4.3-1ubuntu1~14.04.7+esm21	7
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	no fix listed	3
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1	3.11.0~rc1-1~22.04.1+esm2	2
python3rpm	3.12.9-13.azl3	3.12.9-14	1
python-3.14apk	3.14.2-r2, 3.14.4-r2, 3.14.6-r0	3.14.6-r3	6
python-3.13apk	3.13.7-r0, 3.13.10-r0, 3.13.12-r2	3.13.14-r2	3
python-3.12apk	3.12.0-r1, 3.12.9-r1	3.12.13-r10	2

OSV records: ALPINE-CVE-2026-4360 BIT-python-2026-4360 DEBIAN-CVE-2026-4360 UBUNTU-CVE-2026-4360 CGA-3j98-689h-m79j CGA-8qxw-mxj5-qqfv CGA-jr9q-86mm-jvfc AZL-91749
Also known as: BIT-libpython-2026-4360, BIT-python-min-2026-4360, CGA-fj7c-qx2m-pqr4, CGA-v6c3-6q52-4qfj, CGA-x27p-jmrc-jcmr, PSF-2026-32, USN-8744-1

Charts affected

553 by stars

Chart

Latest

Affected images

Radar Score

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-4360.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18

Open the chart page →

9,296

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-4360.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18

Open the chart page →

14,172

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-4360.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	python3.10@3.10.12-1~22.04.16	3.10.12-1~22.04.18

Open the chart page →

7,916

Container images carrying it

531 by charts deploying them

A fixed version is listed for 15 of the 16 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/k8s-at-home/haste-server :latest	827aa2f2389d	python3.8@3.8.10-0ubuntu1~20.04	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/k8s-at-home/nzbget :v21.1	e5571acd10ce	python3.10@3.10.4-3ubuntu0.1	3.10.12-1~22.04.18	1
ghcr.io/k8s-at-home/nzbhydra2 :v3.14.2	ef3670f7e0a8	python3.8@3.8.5-1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/k8s-at-home/prowlarr :v0.3.0.1710	c863aa9875fa	python3.8@3.8.10-0ubuntu1~20.04.4	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/k8s-at-home/qbittorrent :v4.4.2	61deadd1ec78	python3.8@3.8.10-0ubuntu1~20.04.4	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/k8s-at-home/sabnzbd :v3.3.1	c2d6e775db5a	python3.8@3.8.5-1~20.04.3	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/k8s-at-home/tautulli :v2.7.7	4ea617c30397	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/k8s-at-home/transmission :v3.00	6011182e3946	python3.8@3.8.10-0ubuntu1~20.04.5	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/k8s-at-home/xteve :v2.2.0.200	292b3614670f	python3.8@3.8.10-0ubuntu1~20.04.4	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/kamu-data/kamu-api-server :0.89.0	4ed7a896dd2b	python3.8@3.8.10-0ubuntu1~20.04.18	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/karakeep-app/karakeep :0.27.1	abd7d6b11b1b	python3@3.12.11-r0	3.12.14-r0	1
ghcr.io/karakeep-app/karakeep :0.26.0	f575a34ed3f8	python3@3.12.11-r0	3.12.14-r0	1
ghcr.io/kore3lab/kore-board.terminal :v0.5.5	f52e66eff50b	python3.6@3.6.9-1~18.04ubuntu1.9	3.6.9-1~18.04ubuntu1.13+esm10	1
ghcr.io/kubeflow/spark-operator/controller :2.2.1	865ff4da5686	python3.8@3.8.10-0ubuntu1~20.04.18	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/kubelauncher/cassandra	b66aba320083	python3.14@3.14.4-1ubuntu0.1	3.14.4-1ubuntu0.2	1
ghcr.io/kubiyabot/agent-manager :v0.4.13	757bdd779345	python3.13@3.13.5-2	3.13.5-2+deb13u5	1
ghcr.io/kvaps/kubefarm-ltsp :v0.13.4	24efef013a53	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/lerentis/bitwarden-crd-operator :0.17.0	0a608c6ead85	python3@3.12.12-r0	3.12.14-r0	1
ghcr.io/linuxserver/calibre-web :0.6.26	7c0464228f2f	python3.12@3.12.3-1ubuntu0.15	3.12.3-1ubuntu0.17	1
ghcr.io/linuxserver/duplicati :latest	a792931146b4	python3.12@3.12.3-1ubuntu0.16	3.12.3-1ubuntu0.17	1
ghcr.io/linuxserver/healthchecks :version-v3.9	b5c6bfb00b03	python3@3.12.10-r0	3.12.14-r0	1
ghcr.io/linuxserver/syslog-ng :4.10.2	47fae7f540f9	python3@3.12.13-r0	3.12.14-r0	1
ghcr.io/lloesche/valheim-server :latest	20fde516ce31	python3.13@3.13.5-2	3.13.5-2+deb13u5	1
ghcr.io/maastrichtu-ids/rstudio :latest	981aa4c109e1	python3.12@3.12.3-1ubuntu0.5	3.12.3-1ubuntu0.17	1
ghcr.io/middleware-labs/mw-kube-agent :1.12.0	9c7bc0f9bb35	python3.12@3.12.3-1ubuntu0.3	3.12.3-1ubuntu0.17	1
ghcr.io/music-assistant/server :2.10.3	885872224fa5	python3.13@3.13.5-2+deb13u4	3.13.5-2+deb13u5	1
ghcr.io/nathanvaughn/webtrees :2.2.6	034151b61a80	python3.13@3.13.5-2+deb13u2	3.13.5-2+deb13u5	1
ghcr.io/openrelik/openrelik-worker-analyzer-config :latest	1269d3d8d2c2	python3.12@3.12.3-1ubuntu0.15	3.12.3-1ubuntu0.17	1
ghcr.io/openrelik/openrelik-worker-analyzer-logs :latest	b175cc61959a	python3.12@3.12.3-1ubuntu0.15	3.12.3-1ubuntu0.17	1
ghcr.io/openrelik/openrelik-worker-bulkextractor :latest	67498ee2e639	python3.12@3.12.3-1ubuntu0.15	3.12.3-1ubuntu0.17	1
ghcr.io/openrelik/openrelik-worker-containers :latest	a6d5abe94706	python3.12@3.12.3-1ubuntu0.15	3.12.3-1ubuntu0.17	1
ghcr.io/openrelik/openrelik-worker-extraction :latest	ec9fc5864cd5	python3.12@3.12.3-1ubuntu0.15	3.12.3-1ubuntu0.17	1
ghcr.io/openrelik/openrelik-worker-os-creds :latest	7fc7ec101f08	python3.12@3.12.3-1ubuntu0.15	3.12.3-1ubuntu0.17	1
ghcr.io/openrelik/openrelik-worker-plaso :latest	75537ea8c851	python3.12@3.12.3-1ubuntu0.15	3.12.3-1ubuntu0.17	1
ghcr.io/openrelik/openrelik-worker-timesketch :latest	4cb88b603cdc	python3.12@3.12.3-1ubuntu0.15	3.12.3-1ubuntu0.17	1
ghcr.io/oznu/homebridge :2022-07-08	ff2af53897e7	python3.8@3.8.10-0ubuntu1~20.04.4	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/plausible/community-edition :v3.0.1	14c1afde21d6	python3@3.12.10-r0	3.12.14-r0	1
ghcr.io/runwhen-contrib/runwhen-local :0.12.0	533ce58c6e02	python3.13@3.13.5-2+deb13u4	3.13.5-2+deb13u5	1
ghcr.io/sdr-enthusiasts/docker-flightradar24 :latest	917e53402d51	python3.13@3.13.5-2+deb13u4	3.13.5-2+deb13u5	1
ghcr.io/seanmorley15/adventurelog-backend :v0.13.0	0250d9cb0d74	python3.13@3.13.5-2+deb13u4	3.13.5-2+deb13u5	1
ghcr.io/smarter-project/audio-client :v3.1.2	3c8375dc5487	python3.8@3.8.10-0ubuntu1~20.04.5	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/smarter-project/gstreamer :v1.0.2	5ecb16015aa8	python3.8@3.8.10-0ubuntu1~20.04.5	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/smarter-project/image-detector :v2.5.3	1dcca70c6446	python3.8@3.8.10-0ubuntu1~20.04.5	3.8.10-0ubuntu1~20.04.18+esm7	1
ghcr.io/stirling-tools/stirling-pdf :2.14.3	3b3670fce70b	python3.12@3.12.3-1ubuntu0.12	3.12.3-1ubuntu0.17	1
ghcr.io/streamingfast/firehose-core :v1.12.3	91fca773a63f	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.17	1
ghcr.io/streamingfast/firehose-ethereum :v2.12.4	89969b78fb07	python3.12@3.12.3-1ubuntu0.7	3.12.3-1ubuntu0.17	1
ghcr.io/streamingfast/firehose-ethereum :v2.14.3	bf816072380e	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.17	1
ghcr.io/streamingfast/firehose-ethereum :v2.12.4-geth	d7bdfa7b41da	python3.12@3.12.3-1ubuntu0.7	3.12.3-1ubuntu0.17	1
ghcr.io/streamingfast/go-ethereum :geth-v1.16.9-fh3.0	8e3cb38953a3	python3.12@3.12.3-1ubuntu0.10	3.12.3-1ubuntu0.17	1
ghcr.io/streamingfast/substreams-sink-kv :v2.3.0	26953ec68d5d	python3.8@3.8.10-0ubuntu1~20.04.13	3.8.10-0ubuntu1~20.04.18+esm7	1