CVE-2026-4360

Medium

Advisory

Published 30 Jun 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.003; 20th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 554; of 17,781 indexed, latest versions
Container images: 531; deployed by those charts
Fix available: 15 of 16; affected packages

Tarfile.extract() doesn't fully respect filter parameter

Carried by container images the latest versions of 554 of 17,781 indexed charts deploy, on 531 images.

Affected package	Affected versions	Fixed in	Images
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	3.8.10-0ubuntu1~20.04.18+esm7	100
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+10 more	3.12.3-1ubuntu0.17	87
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+16 more	3.10.12-1~22.04.18	80
python3apk	3.11.12-r1, 3.12.8-r1, 3.12.9-r0, 3.12.10-r0+7 more	3.12.14-r0, 3.14.7-r0	75
python3.13deb	3.13.5-2, 3.13.5-2+deb13u2, 3.13.5-2+deb13u4, 3.13.7-1ubuntu0.1	3.13.5-2+deb13u5	74
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	3.6.9-1~18.04ubuntu1.13+esm10	44
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+9 more	2.7.6-8ubuntu0.6+esm30, 2.7.12-1ubuntu0~16.04.18+esm22, 2.7.17-1~18.04ubuntu1.13+esm15, 2.7.18-13ubuntu1.5+esm9	43
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	3.5.2-2ubuntu0~16.04.13+esm25	25
python3.14deb	3.14.4-1, 3.14.4-1ubuntu0.1	3.14.4-1ubuntu0.2	8
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	3.4.3-1ubuntu1~14.04.7+esm21	7
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	no fix listed	3
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1	3.11.0~rc1-1~22.04.1+esm2	2
python3rpm	3.12.9-13.azl3	3.12.9-14	1
python-3.14apk	3.14.2-r2, 3.14.4-r2, 3.14.6-r0	3.14.6-r3	6
python-3.13apk	3.13.7-r0, 3.13.10-r0, 3.13.12-r2	3.13.14-r2	3
python-3.12apk	3.12.0-r1, 3.12.9-r1	3.12.13-r10	2

OSV records: ALPINE-CVE-2026-4360 BIT-python-2026-4360 DEBIAN-CVE-2026-4360 UBUNTU-CVE-2026-4360 CGA-3j98-689h-m79j CGA-8qxw-mxj5-qqfv CGA-jr9q-86mm-jvfc AZL-91749
Also known as: BIT-libpython-2026-4360, BIT-python-min-2026-4360, CGA-fj7c-qx2m-pqr4, CGA-v6c3-6q52-4qfj, CGA-x27p-jmrc-jcmr, PSF-2026-32, USN-8744-1

Charts affected

554 by stars

Chart

Latest

Affected images

Radar Score

wexa-studiowexa-studio

1.2.0

1 of 15 See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2026-4360.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.29.1-tctl-1.18.4-cli-1.5.0	a3a52e6ca122	python3@3.12.11-r0	3.12.14-r0

Open the chart page →

14,983

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-4360.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18

Open the chart page →

9,248

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-4360.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18

Open the chart page →

14,100

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-4360.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	python3.10@3.10.12-1~22.04.16	3.10.12-1~22.04.18

Open the chart page →

7,849

Container images carrying it

531 by charts deploying them

A fixed version is listed for 15 of the 16 affected packages.

Container image	Digest	Package	Fixed in	Used by
oomk8s/readiness-check :2.0.2	875814cc853d	python2.7@2.7.12-1ubuntu0~16.04.4 python3.5@3.5.2-2ubuntu0~16.04.5	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	11
library/rabbitmq :3.9-management	8a279e9396a8	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18	10
library/rabbitmq :3.13-management :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.17	8
oomk8s/readiness-check :2.0.0	7daa08b81954	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	6
hyperledger/fabric-ca-tools :latest	4ce6f43ded2e	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	4
hyperledger/fabric-couchdb :0.4.15	f6c724592abf	python2.7@2.7.12-1ubuntu0~16.04.4 python3.5@3.5.2-2ubuntu0~16.04.5	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	4
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18	4
library/rabbitmq :3.13-management-alpine :3-management-alpine	606d8c0d6b3c	python3@3.12.12-r0	3.12.14-r0	4
library/rabbitmq :3.11-management	c3f70098e01d	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18	4
cloudve/cloudlaunch-server :latest	4a3d7fae90bb	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7	3
dgraph/dgraph :v21.12.0	3b55ea83fffe	python3.8@3.8.10-0ubuntu1~20.04	3.8.10-0ubuntu1~20.04.18+esm7	3
omecproject/cdn-video-repo :1.0.0 :remote-v3	d59ccb138ffb	python2.7@2.7.12-1ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22	3
prompve/prometheus-pve-exporter :3.10.0	4867684c0a93	python3@3.14.5-r0	3.14.7-r0	3
selenium/hub :3.141.59	02f251d48d5f	python3.8@3.8.10-0ubuntu1~20.04	3.8.10-0ubuntu1~20.04.18+esm7	3
quay.io/devtron/argocd-cert-refresh :v10	2b6db27eaf3d	python3.10@3.10.6-1~22.04.2	3.10.12-1~22.04.18	3
alpine/k8s :1.32.12	048f8d9c8cc7	python3@3.12.12-r0	3.14.7-r0	2
apache/tika :2.9.2.1-full	ae0b86d3c4d0	python3.12@3.12.3-1	3.12.3-1ubuntu0.17	2
freeradius/freeradius-server :3.0.21	21c8bfa904d8	python2.7@2.7.17-1~18.04	2.7.17-1~18.04ubuntu1.13+esm15	2
gotenberg/gotenberg :8.36.0	87c16b9f3642	python3.13@3.13.5-2+deb13u4	3.13.5-2+deb13u5	2
gotenberg/gotenberg :8 :8.37.0	f29984bd1e22	python3.13@3.13.5-2+deb13u4	3.13.5-2+deb13u5	2
homebridge/homebridge :latest	77c685a40911	python3.12@3.12.3-1ubuntu0.16	3.12.3-1ubuntu0.17	2
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7	2
istio/kubectl :1.5.10	dbb7726d1bf0	python3.6@3.6.9-1~18.04ubuntu1.1	3.6.9-1~18.04ubuntu1.13+esm10	2
istio/proxyv2 :1.10.3	a78b7a165744	python3.6@3.6.9-1~18.04ubuntu1.4	3.6.9-1~18.04ubuntu1.13+esm10	2
library/cassandra :3.11.6	5aa8400b4b3b	python2.7@2.7.17-1~18.04ubuntu1.1	2.7.17-1~18.04ubuntu1.13+esm15	2
library/cassandra :4.1.3	7cbcec0086ac	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18	2
library/nextcloud :34.0.3 :34.0.3-apache	b97df9e0e1ee	python3.13@3.13.5-2+deb13u4	3.13.5-2+deb13u5	2
library/rabbitmq :4.1.0-management	935b3f84c1e4	python3.12@3.12.3-1ubuntu0.5	3.12.3-1ubuntu0.17	2
library/rabbitmq :3.12.1-management	f020c06da226	python3.10@3.10.6-1~22.04.2ubuntu1.1	3.10.12-1~22.04.18	2
library/redmine :6.1.3-trixie	f474a901faec	python3.13@3.13.5-2+deb13u4	3.13.5-2+deb13u5	2
lightstep/collector :2021-01-26_23-02-36Z	11c5569aaf3b	python3.5@3.5.2-2ubuntu0~16.04.5	3.5.2-2ubuntu0~16.04.13+esm25	2
memgraph/memgraph :3.13.0	a1dc375774ed	python3.12@3.12.3-1ubuntu0.16	3.12.3-1ubuntu0.17	2
nacos/nacos-server :latest	1c191c30c8cd	python3.14@3.14.4-1ubuntu0.1	3.14.4-1ubuntu0.2	2
nutanix/nai-jobs :v2.8.0	9c373718e1b1	python3.13@3.13.5-2+deb13u4	3.13.5-2+deb13u5	2
obolnetwork/charon :v1.10.0	278c7e2897b6	python3.13@3.13.5-2	3.13.5-2+deb13u5	2
omecproject/mcord-synchronizer :comac-1.0.0	cfdb566dd949	python2.7@2.7.12-1ubuntu0~16.04.4 python3.5@3.5.2-2ubuntu0~16.04.5	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	2
opendatacube/ows :latest	668cbb41473c	python3.12@3.12.3-1ubuntu0.3	3.12.3-1ubuntu0.17	2
redis/redis-stack :7.2.0-v9	1c5f43fddcdd	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18	2
redis/redis-stack-server :7.4.0 :7.4.0-v1	72035434f455	python3.10@3.10.12-1~22.04.6	3.10.12-1~22.04.18	2
redis/redis-stack-server :7.2.0-v10	e44b2b49d059	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18	2
smartedge/generic-multi-access-network-virtualization :1.0	4cd63c22ce36	python3.8@3.8.10-0ubuntu1~20.04.5	3.8.10-0ubuntu1~20.04.18+esm7	2
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	2
svtechnmaa/svtech_debuger :v1.0.0	b2987abe57d3	python3.10@3.10.4-3	3.10.12-1~22.04.18	2
tzahi12345/youtubedl-material :4.3.2 :latest	2f943d584711	python3.10@3.10.6-1~22.04.2ubuntu1	3.10.12-1~22.04.18	2
wurstmeister/zookeeper :latest	7a7fd44a7210	python2.7@2.7.6-8 python3.4@3.4.0-2ubuntu1	2.7.6-8ubuntu0.6+esm30 3.4.3-1ubuntu1~14.04.7+esm21	2
ghcr.io/bryopsida/k8s-dev-pod :main	82d0b161161d	python3.12@3.12.3-1ubuntu0.5	3.12.3-1ubuntu0.17	2
ghcr.io/codingducksrl/laravel :8.1	5be52524664c	python2.7@2.7.18-13ubuntu1.1 python3.10@3.10.6-1~22.04	2.7.18-13ubuntu1.5+esm9 3.10.12-1~22.04.18	2
ghcr.io/games-on-whales/retroarch :1.0.0	103fbcec2314	python3.8@3.8.10-0ubuntu1~20.04	3.8.10-0ubuntu1~20.04.18+esm7	2
ghcr.io/linuxserver/openvpn-as :version-2.8.6-916f8e7d-ubuntu18	4ee0764310e7	python2.7@2.7.17-1~18.04ubuntu1.2	2.7.17-1~18.04ubuntu1.13+esm15	2
ghcr.io/plausible/community-edition :v3.2.1	33e60bfb40f2	python3@3.12.13-r0	3.12.14-r0	2