CVE-2026-58203
MediumAdvisory
Published 19 Jun 2026In the index since 6 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.002
- 8th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 34
- of 17,781 indexed, latest versions
- Container images
- 34
- deployed by those charts
- Fix available
- 1 of 1
- affected package
pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size
Carried by container images the latest versions of 34 of 17,781 indexed charts deploy, on 34 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| pydantic-settingspypi | 2.12.0, 2.13.0, 2.13.1, 2.14.0+1 more | 2.14.2 | 34 |
- OSV records
- GHSA-4xgf-cpjx-pc3j
Charts affected
34 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| difydoubanVerified publisher | 0.10.0 | 1 of 6See more | 19,391 |
| difydify-helmVerified publisher | 0.38.0 | 1 of 11See more | 22,002 |
| openvpn-asas-helm-chartOfficialVerified publisher | 0.2.1 | 1 of 1See more | 2,668 |
| home-assistantk8s-home-lab-repo | 16.3.1 | 1 of 1See more | 4,634 |
| klancesklances | 0.1.4 | 1 of 1See more | 1,693 |
| mealieth-chartsVerified publisher | 0.5.1 | 1 of 1See more | 3,804 |
| brightdata-exporterbrightdata-chartsVerified publisher | 0.2.17 | 1 of 1See more | 1,284 |
| aibrixdanchevVerified publisher | 0.7.0 | 1 of 5See more | 5,274 |
| dyff-orchestratordyff-orchestratorVerified publisher | 0.22.19 | 1 of 1See more | 1,354 |
| tocktock | 0.6.3 | 1 of 9See more | 12,907 |
| workflows-sinkworkflows-sinkVerified publisher | 0.16.3 | 1 of 1See more | 1,397 |
| ansible-inspecansible-inspec | 0.2.17 | 1 of 2See more | 5,558 |
| backstage-pyactionsbackstage-pyactionsVerified publisher | 0.1.0 | 1 of 1See more | 2,738 |
| kitchenowlchart-kitchenowl | 0.1.12 | 1 of 2See more | 4,803 |
| galaxycloudve | 6.8.6 | 1 of 3See more | 4,601 |
| csghubcsghubVerified publisher | 2.4.3 | 1 of 34See more | 58,897 |
| decisionrules-ocpdecisionrules-ocpVerified publisher | 0.1.0 | 1 of 4See more | 2,685 |
| external-secrets-reloaderexternal-secrets-reloader | 0.1.0 | 1 of 1See more | 1,030 |
| skypilotgeek-cookbookVerified publisher | 0.0.1 | 1 of 3See more | 8,923 |
| glassflow-etlglassflowVerified publisher | 0.5.21 | 1 of 16See more | 12,056 |
| fastmcp-serverhelmforgeVerified publisher | 1.7.4 | 1 of 1See more | 3,281 |
| immichhelmforgeVerified publisher | 1.2.8 | 1 of 5See more | 11,042 |
| mcp-serverhelmforgeVerified publisher | 1.0.0 | 1 of 1See more | 3,430 |
| mindsdbkronkltdVerified publisher | 0.1.0 | 1 of 1See more | 9,620 |
| memgraph-mcpmemgraphVerified publisher | 1.0.0 | 1 of 1See more | 1,672 |
| octantisoctantis | 0.1.0 | 1 of 1See more | 2,555 |
| mockoidcoidcmockVerified publisher | 0.0.1 | 1 of 1See more | 2,298 |
| osdfir-infrastructureosdfir-infrastructureVerified publisher | 2.15.0 | 1 of 40See more | 71,208 |
| yetiosdfir-infrastructureVerified publisher | 1.0.5 | 1 of 4See more | 6,583 |
| home-assistantpascaliskeVerified publisher | 0.1.1 | 1 of 1See more | 4,749 |
| runwhen-localrunwhen-contribVerified publisher | 0.6.17 | 1 of 3See more | 3,707 |
| showroom-docs-mcpshowroom-docs-mcpVerified publisher | 2.1.0 | 1 of 4See more | 5,201 |
| sibylsibyl | 0.2.0 | 1 of 1See more | 1,020 |
| srebotsrebot | 0.14.0 | 1 of 2See more | 1,542 |
Container images carrying it
34 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| aibrix/ | 63fb81a64377 | pydantic-settings | 2.14.2 | 1 |
| berkeleyskypilot/ | 8da2f3cda472 | pydantic-settings | 2.14.2 | 1 |
| decisionrules/ | 38c377e7c01e | pydantic-settings | 2.14.2 | 1 |
| helmforge/ | 61f759a1421f | pydantic-settings | 2.14.2 | 1 |
| helmforge/ | fcb7017327d6 | pydantic-settings | 2.14.2 | 1 |
| langgenius/ | 097d3fd27a7b | pydantic-settings | 2.14.2 | 1 |
| langgenius/ | 8269050f192e | pydantic-settings | 2.14.2 | 1 |
| litellm/ | 09b217802ded | pydantic-settings | 2.14.2 | 1 |
| marcoimme/ | b6035c0721a8 | pydantic-settings | 2.14.2 | 1 |
| mawad98/ | 99422c56a274 | pydantic-settings | 2.14.2 | 1 |
| memgraph/ | ecdf7faea3f7 | pydantic-settings | 2.14.2 | 1 |
| mindsdb/ | 163011c09299 | pydantic-settings | 2.14.2 | 1 |
| opencsghq/ | af7191a9cf8a | pydantic-settings | 2.14.2 | 1 |
| openvpn/ | 2253c10ec652 | pydantic-settings | 2.14.2 | 1 |
| tock/ | abf7880e0449 | pydantic-settings | 2.14.2 | 1 |
| tombursch/ | b48e4ab727cd | pydantic-settings | 2.14.2 | 1 |
| yetiplatform/ | 9bcbe2650a14 | pydantic-settings | 2.14.2 | 1 |
| yetiplatform/ | 9c3006cedcca | pydantic-settings | 2.14.2 | 1 |
| ghcr.io/ | 8e31b5a81853 | pydantic-settings | 2.14.2 | 1 |
| ghcr.io/ | 6dca4455fde3 | pydantic-settings | 2.14.2 | 1 |
| ghcr.io/ | 6920d17cf6ff | pydantic-settings | 2.14.2 | 1 |
| ghcr.io/ | d1b0ce10b513 | pydantic-settings | 2.14.2 | 1 |
| ghcr.io/ | 9a5a3eb4a213 | pydantic-settings | 2.14.2 | 1 |
| ghcr.io/ | 067e54e2e107 | pydantic-settings | 2.14.2 | 1 |
| ghcr.io/ | cd25a5cc3f1b | pydantic-settings | 2.14.2 | 1 |
| ghcr.io/ | 5a0839dc5303 | pydantic-settings | 2.14.2 | 1 |
| ghcr.io/ | bb2939094eed | pydantic-settings | 2.14.2 | 1 |
| ghcr.io/ | 74d6d33376eb | pydantic-settings | 2.14.2 | 1 |
| ghcr.io/ | 533ce58c6e02 | pydantic-settings | 2.14.2 | 1 |
| ghcr.io/ | 9b4415e937b2 | pydantic-settings | 2.14.2 | 1 |
| ghcr.io/ | 45459c0910fc | pydantic-settings | 2.14.2 | 1 |
| quay.io/ | 2c324c9789f5 | pydantic-settings | 2.14.2 | 1 |
| registry.gitlab.com/ | 9bd5d93aaff7 | pydantic-settings | 2.14.2 | 1 |
| registry.gitlab.com/ | 564718e28931 | pydantic-settings | 2.14.2 | 1 |