CVE-2026-44431

High

Advisory

Published 11 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.003; 26th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,033; of 17,790 indexed, latest versions
Container images: 970; deployed by those charts
Fix available: 4 of 5; affected packages

Red Hat Security Advisory: python-urllib3 security update

Carried by container images the latest versions of 1,033 of 17,790 indexed charts deploy, on 970 images.

Affected package	Affected versions	Fixed in	Images
py3-pipapk	25.0.1-r0, 25.2-r0, 26.0.1-r1	26.1.2-r1	3
python-urllib3rpm	1.24.2-4.el8, 1.24.2-5.el8, 1.24.2-5.el8_6.1, 1.24.2-5.el8_9.2+2 more	0:1.24.2-10.el8_10	43
urllib3pypi	1.23, 1.24, 1.24.1, 1.24.2+47 more	2.7.0	913
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+23 more	no fix listed	108
python-urllib3deb	1.7.1-1build1, 1.7.1-1ubuntu4, 1.13.1-2ubuntu0.16.04.1, 1.13.1-2ubuntu0.16.04.2+14 more	1.26.5-1~exp1ubuntu0.7, 1.26.12-1+deb12u4, 2.0.7-1ubuntu0.7, 2.3.0-3+deb13u2	64

OSV records: CGA-36hp-r4x4-75wj CGA-m6w2-x26r-3r44 DEBIAN-CVE-2026-44431 GHSA-qccp-gfcp-xxvc RHSA-2026:36732 UBUNTU-CVE-2026-44431
Also known as: CGA-r2h3-92r9-9fw6, CGA-rw9r-pxcj-mmj5, PYSEC-2026-141, USN-8379-1

Charts affected

1,033 by stars

Chart

Latest

Affected images

Radar Score

chatbot-ai-sampleopenshift

0.1.6

2 of 4 See more

chatbot-ai-sample openshift 0.1.6

2 of the 4 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
quay.io/ai-lab/llamacpp_python :latest	70d138997acd	urllib3@2.5.0	2.7.0
quay.io/redhat-ai-dev/chatbot :latest	59fe607dfdf2	urllib3@2.2.1	2.7.0

Open the chart page →

19,051

exporteropenshift

1.0.47

3 of 3 See more

exporter openshift 1.0.47

3 of the 3 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
public.ecr.aws/perfectscale-io/kube-state-metrics :4.1.14-redhat	849e235e2d3e	python-urllib3@1.24.2-8.el8_10 urllib3@1.24.2	0:1.24.2-10.el8_10 2.7.0
public.ecr.aws/perfectscale-io/psc-exporter :v1.0.45-redhat	9083e60c38bc	urllib3@1.26.5	2.7.0
public.ecr.aws/perfectscale-io/ubi9/ubi :9.5	d7c3def9252b	urllib3@1.26.5	2.7.0

Open the chart page →

13,041

hamiopenshift

2.10.0-r0-openshift.c4e22e88

1 of 2 See more

hami openshift 2.10.0-r0-openshift.c4e22e88

1 of the 2 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
ghcr.io/dynamia-ai/hami-enterprise :v2.10.0-r0-openshift.c4e22e88	745504757300	urllib3@1.24.2	2.7.0

Open the chart page →

4,756

kb-cloud-installeropenshift

2.1.35

1 of 1 See more

kb-cloud-installer openshift 2.1.35

1 of the 1 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
apecloud/kb-cloud-installer :v2.1.42-certified	98abc64aa985	urllib3@1.26.5	2.7.0

Open the chart page →

4,170

kite-agentopenshift

1.0.0

1 of 1 See more

kite-agent openshift 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
quay.io/fengyuanxing/zte_endogenous_security/kite-agent :V2.0.0	734808044936	python-urllib3@1.24.2-9.el8_10 urllib3@1.24.2	0:1.24.2-10.el8_10 2.7.0

Open the chart page →

5,863

orion-ldopenshift

1.0.3

1 of 2 See more

orion-ld openshift 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
quay.io/fiware/orion-ld :1.0.1	ea838e5b4051	python-urllib3@1.24.2-5.el8 urllib3@1.24.2	0:1.24.2-10.el8_10 2.7.0

Open the chart page →

14,727

redhat-trusted-application-pipelineopenshift

1.0.2

1 of 2 See more

redhat-trusted-application-pipeline openshift 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
quay.io/redhat-appstudio/appstudio-utils :dbbdd82734232e6289e8fbae5b4c858481a7c057	7b4202c25b67	urllib3@1.26.5	2.7.0

Open the chart page →

8,643

smsf-configurationopenshift

1.0.4

1 of 1 See more

smsf-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
gurolakman/smsf-configuration :1.0.4	9abb3882bcbd	python-urllib3@1.24.2-5.el8_9.2 urllib3@1.24.2	0:1.24.2-10.el8_10 2.7.0

Open the chart page →

13,612

smsf-dispatcheropenshift

1.0.4

1 of 1 See more

smsf-dispatcher openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
gurolakman/smsf-dispatcher :1.0.4	6537e8ed8de8	python-urllib3@1.24.2-5.el8_9.2 urllib3@1.24.2	0:1.24.2-10.el8_10 2.7.0

Open the chart page →

11,740

smsf-momtopenshift

1.0.4

1 of 1 See more

smsf-momt openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
gurolakman/smsf-momt :1.0.4	ce23b20a8a17	python-urllib3@1.24.2-5.el8_9.2 urllib3@1.24.2	0:1.24.2-10.el8_10 2.7.0

Open the chart page →

13,573

smsf-registrationopenshift

1.0.4

1 of 1 See more

smsf-registration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
gurolakman/smsf-registration :1.0.4	b22e746edd5d	python-urllib3@1.24.2-5.el8_9.2 urllib3@1.24.2	0:1.24.2-10.el8_10 2.7.0

Open the chart page →

13,556

ussigw-configurationopenshift

1.0.4

1 of 1 See more

ussigw-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
gurolakman/ussigw-configuration :1.0.4	bf18525c5ad9	python-urllib3@1.24.2-5.el8_9.2 urllib3@1.24.2	0:1.24.2-10.el8_10 2.7.0

Open the chart page →

13,460

ussigw-coreopenshift

1.0.4

1 of 1 See more

ussigw-core openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
gurolakman/ussigw-core :1.0.4	8739565c3ea2	python-urllib3@1.24.2-5.el8_9.2 urllib3@1.24.2	0:1.24.2-10.el8_10 2.7.0

Open the chart page →

13,105

openwhiskopenwhisk

1.0.0

1 of 10 See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
openwhisk/ow-utils :1.0.0	c80dba0de3aa	python-pip@9.0.1-2.3~ubuntu1.18.04.4 urllib3@1.25.11	no fix listed 2.7.0

Open the chart page →

36,252

osdfir-infrastructureosdfir-infrastructure

2.15.0

8 of 40 See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

8 of the 40 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
yetiplatform/yeti :2.9.0	9bcbe2650a14	urllib3@2.4.0	2.7.0
ghcr.io/openrelik/openrelik-metrics :latest	3d0f1ddeebf5	urllib3@2.6.3	2.7.0
ghcr.io/openrelik/openrelik-worker-analyzer-config :latest	1269d3d8d2c2	python-pip@24.0+dfsg-1ubuntu1.3 urllib3@2.0.7	no fix listed 2.7.0
ghcr.io/openrelik/openrelik-worker-analyzer-logs :latest	b175cc61959a	python-pip@24.0+dfsg-1ubuntu1.3 urllib3@2.0.7	no fix listed 2.7.0
ghcr.io/openrelik/openrelik-worker-containers :latest	a6d5abe94706	python-pip@24.0+dfsg-1ubuntu1.3 urllib3@2.0.7	no fix listed 2.7.0
ghcr.io/openrelik/openrelik-worker-extraction :latest	ec9fc5864cd5	urllib3@2.0.7	2.7.0
ghcr.io/openrelik/openrelik-worker-os-creds :latest	7fc7ec101f08	python-pip@24.0+dfsg-1ubuntu1.3 urllib3@2.0.7	no fix listed 2.7.0
ghcr.io/openrelik/openrelik-worker-plaso :latest	75537ea8c851	python-pip@24.0+dfsg-1ubuntu1.3 urllib3@2.0.7	no fix listed 2.7.0

Open the chart page →

72,547

yetiosdfir-infrastructure

1.0.5

1 of 4 See more

yeti osdfir-infrastructure 1.0.5

1 of the 4 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
yetiplatform/yeti :latest	9c3006cedcca	urllib3@2.4.0	2.7.0

Open the chart page →

6,679

loki-standaloneot-container-kit

1.0.2

1 of 5 See more

loki-standalone ot-container-kit 1.0.2

1 of the 5 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
quay.io/opstree/k8s-sidecar :2.7.1	26aa9bb3386b	urllib3@2.6.3	2.7.0

Open the chart page →

3,620

mysqlot-container-kit

0.1.0

1 of 1 See more

mysql ot-container-kit 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	urllib3@2.6.3	2.7.0

Open the chart page →

463

pgaot-container-kit

1.0.3

1 of 6 See more

pga ot-container-kit 1.0.3

1 of the 6 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.26.1	b8d5067137fe	urllib3@1.26.18	2.7.0

Open the chart page →

5,143

vmot-container-kit

0.0.3

1 of 7 See more

vm ot-container-kit 0.0.3

1 of the 7 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	urllib3@2.2.1	2.7.0

Open the chart page →

5,418

devpiowan-charts

0.1.0

1 of 1 See more

devpi owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
owanio1992/devpi :6.16.0	4ade8e1e4d7e	urllib3@2.5.0	2.7.0

Open the chart page →

513

p4p4

0.1.0

1 of 7 See more

27,702

myappp4-helm

0.1.0

1 of 6 See more

19,728

pagespages

1.0.0

1 of 3 See more

20,242

pagespages10

1.0.0

1 of 3 See more

20,242

pagespages111

1.0.0

1 of 3 See more

20,242

pagespages2

1.0.0

1 of 3 See more

20,242

pagespages-alexchmielu

1.0.0

1 of 3 See more

pages pages-alexchmielu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	urllib3@2.6.3	2.7.0

Open the chart page →

20,242

pagespages-alps

1.0.0

1 of 3 See more

20,242

pagespages-alstom

1.0.0

1 of 3 See more

pages pages-alstom 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	urllib3@2.6.3	2.7.0

Open the chart page →

20,242

pagespages-ambala

1.0.0

1 of 3 See more

pages pages-ambala 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	urllib3@2.6.3	2.7.0

Open the chart page →

20,242

pagespages-andromeda

1.0.0

1 of 3 See more

pages pages-andromeda 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	urllib3@2.6.3	2.7.0

Open the chart page →

20,242

pagespagesbadami

1.0.0

1 of 3 See more

20,242

pagespages-blackburn

1.0.0

1 of 3 See more

pages pages-blackburn 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	urllib3@2.6.3	2.7.0

Open the chart page →

20,242

pagespages-botes

1.0.0

1 of 3 See more

20,242

pagespages-brian

1.0.0

1 of 3 See more

20,242

pagespages-buckll

1.0.0

1 of 3 See more

pages pages-buckll 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	urllib3@2.6.3	2.7.0

Open the chart page →

20,242

pagespages-camden

1.0.0

1 of 3 See more

pages pages-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	urllib3@2.6.3	2.7.0

Open the chart page →

20,242

pagespages-camden771

1.0.0

1 of 3 See more

pages pages-camden771 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	urllib3@2.6.3	2.7.0

Open the chart page →

20,242

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	urllib3@2.6.3	2.7.0

Open the chart page →

20,242

pagespages-draco

1.0.0

1 of 3 See more

20,242

pagespages-ellora

1.0.0

1 of 3 See more

pages pages-ellora 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	urllib3@2.6.3	2.7.0

Open the chart page →

20,242

pagespages-finchley

1.0.0

1 of 3 See more

pages pages-finchley 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	urllib3@2.6.3	2.7.0

Open the chart page →

20,242

pagespages-fornax

1.0.0

1 of 3 See more

pages pages-fornax 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	urllib3@2.6.3	2.7.0

Open the chart page →

20,242

pagespages-harsh

1.0.0

1 of 3 See more

20,242

pagespagesk

1.0.0

1 of 3 See more

20,242

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	urllib3@2.6.3	2.7.0

Open the chart page →

20,242

pagespages-mihai

1.0.0

1 of 3 See more

20,242

pagespages-nivesh

1.0.0

1 of 3 See more

pages pages-nivesh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	urllib3@2.6.3	2.7.0

Open the chart page →

20,242

pagespagessandeepgudu

1.0.0

1 of 3 See more

pages pagessandeepgudu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-44431.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	urllib3@2.6.3	2.7.0

Open the chart page →

20,242

Container images carrying it

970 by charts deploying them

A fixed version is listed for 4 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/ortelius/ms-textfile-crud :main-v10.0.1635-g5076aa	f5c4c8adfc82	urllib3@2.6.2	2.7.0	1
quay.io/ortelius/ms-validate-user :main-v10.0.1694-g98ed94	b5054bd4e97a	urllib3@2.6.2	2.7.0	1
quay.io/redhat-ai-dev/chatbot :latest	59fe607dfdf2	urllib3@2.2.1	2.7.0	1
quay.io/redhat-appstudio/appstudio-utils :dbbdd82734232e6289e8fbae5b4c858481a7c057	7b4202c25b67	urllib3@1.26.5	2.7.0	1
quay.io/rhdh/rhdh-hub-rhel9 :latest	0b26358f5793	urllib3@2.2.2	2.7.0	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	python-urllib3@1.24.2-5.el8 urllib3@1.24.2	0:1.24.2-10.el8_10 2.7.0	1
quay.io/stackgres/operator :1.19.1	f241b0b20326	urllib3@2.2.3	2.7.0	1
registry.gitlab.com/crafty-controller/crafty-4 :latest	166a06f73d8c	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed	1
registry.gitlab.com/dyff/workflows-sink :0.16.3	564718e28931	urllib3@2.6.3	2.7.0	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb :4.4.5	cf72810d33f5	python-urllib3@1.24.2-5.el8 urllib3@1.24.2	0:1.24.2-10.el8_10 2.7.0	1
registry.gitlab.com/infinitydon/registry/open5gs-aio :v2.2.2	f6385712935f	python-pip@20.0.2-5ubuntu1.1	no fix listed	1
registry.gitlab.com/open-forms/forms-catalogue :latest	4eaf9c911f33	urllib3@1.26.7	2.7.0	1
registry.gitlab.com/open-forms/request-registry :latest	0886cbbc5f95	urllib3@1.26.7	2.7.0	1
registry.gitlab.com/radiology/infrastructure/study-governor :8.0.0	4e7faf6f8d5f	urllib3@2.1.0	2.7.0	1
registry.gitlab.com/xrow-public/ci-tools/tools :main	9b9d1ed86b6a	urllib3@1.26.19	2.7.0	1
registry.gitlab.com/xrow-public/helm-iframely/iframely :2.3.5	fcf07d5ff7e2	urllib3@1.26.5	2.7.0	1
registry.gitlab.com/xrow-public/helm-mssql/mssql :1.10.3	f923d842bc47	urllib3@1.26.19	2.7.0	1
registry.gitlab.com/xrow-public/helm-openclaw/openclaw :1.91.3	ed44d81a65de	urllib3@1.26.19	2.7.0	1
registry.gitlab.com/xrow-public/helm-smtp/postfix :1.3.3	7eea4f0883dd	urllib3@2.6.2	2.7.0	1
registry.gitlab.com/xrow-public/velero-client/velero-client :1.4.2	03015f863a3e	urllib3@1.26.19	2.7.0	1