CVE-2026-4360

Medium

Advisory

Published 30 Jun 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.003; 20th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 553; of 17,787 indexed, latest versions
Container images: 531; deployed by those charts
Fix available: 15 of 16; affected packages

Tarfile.extract() doesn't fully respect filter parameter

Carried by container images the latest versions of 553 of 17,787 indexed charts deploy, on 531 images.

Affected package	Affected versions	Fixed in	Images
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	3.8.10-0ubuntu1~20.04.18+esm7	100
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3+11 more	3.12.3-1ubuntu0.17	86
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+16 more	3.10.12-1~22.04.18	80
python3apk	3.11.12-r1, 3.12.8-r1, 3.12.9-r0, 3.12.10-r0+7 more	3.12.14-r0, 3.14.7-r0	75
python3.13deb	3.13.5-2, 3.13.5-2+deb13u2, 3.13.5-2+deb13u4, 3.13.7-1ubuntu0.1	3.13.5-2+deb13u5	75
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	3.6.9-1~18.04ubuntu1.13+esm10	44
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+9 more	2.7.6-8ubuntu0.6+esm30, 2.7.12-1ubuntu0~16.04.18+esm22, 2.7.17-1~18.04ubuntu1.13+esm15, 2.7.18-13ubuntu1.5+esm9	43
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	3.5.2-2ubuntu0~16.04.13+esm25	25
python3.14deb	3.14.4-1, 3.14.4-1ubuntu0.1	3.14.4-1ubuntu0.2	8
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	3.4.3-1ubuntu1~14.04.7+esm21	7
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	no fix listed	3
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1	3.11.0~rc1-1~22.04.1+esm2	2
python3rpm	3.12.9-13.azl3	3.12.9-14	1
python-3.14apk	3.14.2-r2, 3.14.4-r2, 3.14.6-r0	3.14.6-r3	6
python-3.13apk	3.13.7-r0, 3.13.10-r0, 3.13.12-r2	3.13.14-r2	3
python-3.12apk	3.12.0-r1, 3.12.9-r1	3.12.13-r10	2

OSV records: ALPINE-CVE-2026-4360 BIT-python-2026-4360 DEBIAN-CVE-2026-4360 UBUNTU-CVE-2026-4360 CGA-3j98-689h-m79j CGA-8qxw-mxj5-qqfv CGA-jr9q-86mm-jvfc AZL-91749
Also known as: BIT-libpython-2026-4360, BIT-python-min-2026-4360, CGA-fj7c-qx2m-pqr4, CGA-v6c3-6q52-4qfj, CGA-x27p-jmrc-jcmr, PSF-2026-32, USN-8744-1

Charts affected

553 by stars

Chart

Latest

Affected images

Radar Score

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-4360.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18

Open the chart page →

9,296

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-4360.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18

Open the chart page →

14,172

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-4360.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	python3.10@3.10.12-1~22.04.16	3.10.12-1~22.04.18

Open the chart page →

7,916

Container images carrying it

531 by charts deploying them

A fixed version is listed for 15 of the 16 affected packages.

Container image	Digest	Package	Fixed in	Used by
loeken/jellyfin :10.11.8	7efbc24e47b0	python3@3.12.13-r0	3.12.14-r0	1
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7	1
longhornio/longhorn-manager :v1.1.1	ede61fe2a472	python3.6@3.6.9-1~18.04ubuntu1.4	3.6.9-1~18.04ubuntu1.13+esm10	1
lsstsqre/nublado2 :2.0.1	b75bf8aaafa4	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7	1
mauricenino/dashdot :5.9.2	236997816917	python3@3.12.9-r0	3.12.14-r0	1
mbround18/valheim :3.1.0	70bd4da591cd	python3.10@3.10.12-1~22.04.9	3.10.12-1~22.04.18	1
mediagis/nominatim :5.3.2	7923a8e67197	python3.12@3.12.3-1ubuntu0.13	3.12.3-1ubuntu0.17	1
mediagis/nominatim :3.7	c15e941485ef	python3.8@3.8.10-0ubuntu1~20.04.5	3.8.10-0ubuntu1~20.04.18+esm7	1
mediagis/nominatim :4.2	d0eae7b51374	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18	1
mindsdb/mindsdb :latest	163011c09299	python3.13@3.13.5-2	3.13.5-2+deb13u5	1
mlikiowa/napcat-docker :latest	1336a777f9a4	python3.10@3.10.12-1~22.04.6	3.10.12-1~22.04.18	1
mshanley80/httpbin2022 :latest	5b189a70c0fb	python3.8@3.8.10-0ubuntu1~20.04.6	3.8.10-0ubuntu1~20.04.18+esm7	1
muluder/prograncontrollermcord :0.1.8	43b597a93da7	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	1
netboxcommunity/netbox :v3.2.8	3d652dca5351	python3.10@3.10.4-3ubuntu0.1	3.10.12-1~22.04.18	1
netboxcommunity/netbox :v4.6.10-5.0.2	91b823a05cb5	python3.14@3.14.4-1ubuntu0.1	3.14.4-1ubuntu0.2	1
netdata/netdata :v2.11.0	c45c71eb23ff	python3.13@3.13.5-2+deb13u4	3.13.5-2+deb13u5	1
netskopeprivateaccess/publisher_u22 :latest	93e2fd164a93	python3.10@3.10.12-1~22.04.16	3.10.12-1~22.04.18	1
nodered/node-red :5.0.4	10f40d0a83e7	python3@3.14.5-r0	3.14.7-r0	1
nodered/node-red :4.1.2	216e7403aab9	python3@3.12.12-r0	3.12.14-r0	1
nousresearch/hermes-agent :v2026.8.27	e0df6adebddf	python3.13@3.13.5-2+deb13u4	3.13.5-2+deb13u5	1
oled01/automx2 :2025.1.1	05d3e398e675	python@3.13.5-1	no fix listed	1
omecproject/mme-exporter :paging-latest	bcc5f19fd676	python3.6@3.6.9-1~18.04	3.6.9-1~18.04ubuntu1.13+esm10	1
omecproject/onos-progran :1.0.0	5715e5648aa0	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	1
omecproject/progran-synchronizer :comac-1.0.0	d109a8e57e71	python2.7@2.7.12-1ubuntu0~16.04.4 python3.5@3.5.2-2ubuntu0~16.04.5	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	1
opendatacube/explorer :latest	120457ffcd69	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.17	1
opendatacube/pipelines :wofs-1.22	5d810e8504b8	python3.6@3.6.7-1~18.04	3.6.9-1~18.04ubuntu1.13+esm10	1
opendatacube/restcube :latest	91870111837c	python3.6@3.6.7-1~18.04	3.6.9-1~18.04ubuntu1.13+esm10	1
opendatacube/wms :latest	1b90cdf68831	python3.6@3.6.7-1~18.04	3.6.9-1~18.04ubuntu1.13+esm10	1
opendatacube/wps :latest	80df355a660b	python3.10@3.10.12-1~22.04.10	3.10.12-1~22.04.18	1
openebs/rawfile-localpv :v0.15.2	a39ef27ea28b	python3.13@3.13.5-2+deb13u4	3.13.5-2+deb13u5	1
openelevation/open-elevation :latest	82fb21612e86	python3.8@3.8.10-0ubuntu1~20.04	3.8.10-0ubuntu1~20.04.18+esm7	1
openkm/openkm-ce :6.3.11	3bc465a7461b	python3.8@3.8.10-0ubuntu1~20.04.5	3.8.10-0ubuntu1~20.04.18+esm7	1
openmined/syft-backend :0.9.5	b72f74a68b32	python-3.12@3.12.9-r1	3.12.13-r10	1
opennode/waldur-mastermind :8.1.2	4c82b15d9042	python3.13@3.13.5-2+deb13u4	3.13.5-2+deb13u5	1
openstackhelm/heat :wallaby-ubuntu_focal	f728510bab3c	python3.8@3.8.10-0ubuntu1~20.04.8	3.8.10-0ubuntu1~20.04.18+esm7	1
openstackhelm/keystone :wallaby-ubuntu_focal	e07d75953d2e	python3.8@3.8.10-0ubuntu1~20.04.8	3.8.10-0ubuntu1~20.04.18+esm7	1
openthread/otbr :latest	f307f59f6432	python2.7@2.7.17-1~18.04ubuntu1.11 python3.6@3.6.9-1~18.04ubuntu1.12	2.7.17-1~18.04ubuntu1.13+esm15 3.6.9-1~18.04ubuntu1.13+esm10	1
openvino/model_server :2025.2.1	1e7cd1d70cc1	python3.12@3.12.3-1ubuntu0.7	3.12.3-1ubuntu0.17	1
openvpn/openvpn-as :latest	2253c10ec652	python3.12@3.12.3-1ubuntu0.15	3.12.3-1ubuntu0.17	1
openwhisk/ow-utils :1.0.0	c80dba0de3aa	python2.7@2.7.17-1~18.04ubuntu1.2	2.7.17-1~18.04ubuntu1.13+esm15	1
opsmx11/issuegen :v2.1.0	5c50ca123d88	python3.4@3.4.3-1ubuntu1~14.04.6	3.4.3-1ubuntu1~14.04.7+esm21	1
owncloud/server :10.15.0	51d9b74fc2a8	python3.8@3.8.10-0ubuntu1~20.04.11	3.8.10-0ubuntu1~20.04.18+esm7	1
owncloud/server :10.16.2	74c53d341076	python3.10@3.10.12-1~22.04.15	3.10.12-1~22.04.18	1
owncloud/server :10.16.3	b3f9efdcd7f7	python3.10@3.10.12-1~22.04.16	3.10.12-1~22.04.18	1
passbolt/passbolt :5.13.0-1-ce	af3a620902a0	python3.13@3.13.5-2+deb13u2	3.13.5-2+deb13u5	1
penpotapp/backend :2.2.1	47853d9bb9dd	python3.10@3.10.12-1~22.04.6	3.10.12-1~22.04.18	1
penpotapp/exporter :2.2.1	5c835ffd87ab	python3.10@3.10.12-1~22.04.6	3.10.12-1~22.04.18	1
penpotapp/exporter :2.17.2	72a8061e8806	python3.14@3.14.4-1ubuntu0.1	3.14.4-1ubuntu0.2	1
photoprism/photoprism :251130	db16ee6b1ba3	python3.13@3.13.7-1ubuntu0.1	no fix listed	1
photoprism/photoprism :240711-ce	fc6fd632ca74	python3.12@3.12.3-1	3.12.3-1ubuntu0.17	1