CVE-2026-59890
MediumAdvisory
Published 8 Jul 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.1
- base score, highest
- EPSS
- 0.004
- 34th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 1,264
- of 17,787 indexed, latest versions
- Container images
- 1,323
- deployed by those charts
- Fix available
- 4 of 5
- affected packages
setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
Carried by container images the latest versions of 1,264 of 17,787 indexed charts deploy, on 1,323 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| setuptoolspypi | 0.9.8, 20.7.0, 20.8.0, 29.0.1.post20161130+135 more | 83.0.0 | 1,261 |
| setuptoolsdeb | 45.2.0-1, 45.2.0-1ubuntu0.1, 45.2.0-1ubuntu0.2, 45.2.0-1ubuntu0.3+9 more | no fix listed | 161 |
| setuptoolsbitnami | 70.3.0, 80.9.0 | 83.0.0 | 3 |
| py3-setuptoolsapk | 75.8.0-r0 | 83.0.0-r0 | 1 |
| python-3.11deb | 3.11.15+e4 | 3.11.16+e2 | 1 |
- OSV records
- BIT-setuptools-2026-59890CGA-45cv-ppqx-4qxhGHSA-h35f-9h28-mq5cUBUNTU-CVE-2026-59890ECHO-732c-d358-5fef
- Also known as
- CGA-4hr8-28qq-pc5f, CGA-7mpr-r977-c726, CGA-qfw9-8w49-7c33, PYSEC-2026-3447
Charts affected
1,264 by stars
Container images carrying it
1,323 by charts deploying them
A fixed version is listed for 4 of the 5 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| stackstorm/ | 6f56d239d280 | setuptools setuptools | no fix listed 83.0.0 | 1 |
| stackstorm/ | 33ecfda16608 | setuptools setuptools | no fix listed 83.0.0 | 1 |
| stackstorm/ | 4e3f8c7ca52d | setuptools setuptools | no fix listed 83.0.0 | 1 |
| stackstorm/ | f190a6212195 | setuptools setuptools | no fix listed 83.0.0 | 1 |
| stackstorm/ | 259503496ff9 | setuptools setuptools | no fix listed 83.0.0 | 1 |
| stackstorm/ | b1de2055c362 | setuptools setuptools | no fix listed 83.0.0 | 1 |
| stackstorm/ | b1a338f64773 | setuptools setuptools | no fix listed 83.0.0 | 1 |
| stackstorm/ | 1c8904a3bf67 | setuptools setuptools | no fix listed 83.0.0 | 1 |
| stackstorm/ | 1bf35bfaf00c | setuptools setuptools | no fix listed 83.0.0 | 1 |
| stackstorm/ | 19fdfffdbba8 | setuptools setuptools | no fix listed 83.0.0 | 1 |
| stakater/ | a47e96ebb285 | setuptools | 83.0.0 | 1 |
| stakater/ | 4f8e409f30c2 | setuptools | 83.0.0 | 1 |
| stakewiselabs/ | 2afd0c0b34cb | setuptools | 83.0.0 | 1 |
| stashapp/ | 24dbd7607174 | setuptools | no fix listed | 1 |
| stashapp/ | df744af5a0c9 | setuptools | 83.0.0 | 1 |
| statcan/ | 3921305425b8 | setuptools setuptools | no fix listed 83.0.0 | 1 |
| stratospire/ | a4c34cb01117 | setuptools | 83.0.0 | 1 |
| streamnative/ | 11bceacec8fb | setuptools setuptools | no fix listed 83.0.0 | 1 |
| streamnative/ | ebcf7f033b54 | setuptools | 83.0.0 | 1 |
| substratusai/ | 61695be635eb | setuptools | 83.0.0 | 1 |
| surajwarbhe/ | 85248611e9f1 | setuptools | 83.0.0 | 1 |
| svtechnmaa/ | b9d7ecf8de24 | setuptools | 83.0.0 | 1 |
| svtechnmaa/ | 67be2aba9436 | setuptools | 83.0.0 | 1 |
| svtechnmaa/ | d5327df8b8a2 | setuptools | 83.0.0 | 1 |
| svtechnmaa/ | 6e368ace0977 | setuptools setuptools | no fix listed 83.0.0 | 1 |
| svtechnmaa/ | 674fad30a51f | setuptools | 83.0.0 | 1 |
| swisscomcloud/ | b6639d1a922e | setuptools | 83.0.0 | 1 |
| sysnet4admin/ | 74ded2d92f07 | setuptools | 83.0.0 | 1 |
| szurubooru/ | accf2ad9fbc3 | setuptools | 83.0.0 | 1 |
| t3nde/ | d2939e9a719b | setuptools | 83.0.0 | 1 |
| tachyongroup/ | 7e79b9000856 | setuptools | 83.0.0 | 1 |
| tachyongroup/ | f4f7fabe1037 | setuptools | 83.0.0 | 1 |
| taemon1337/ | 247bc1dc4f07 | setuptools | 83.0.0 | 1 |
| taigaio/ | 9f97323cc150 | setuptools | 83.0.0 | 1 |
| taigaio/ | 36318831b3e7 | setuptools | 83.0.0 | 1 |
| tautulli/ | c4da15f058ea | setuptools | 83.0.0 | 1 |
| teknas09/ | 12a1fa85c4aa | setuptools | 83.0.0 | 1 |
| temporalio/ | 258958fe2ff2 | setuptools | 83.0.0 | 1 |
| temporalio/ | 35034611d981 | setuptools | 83.0.0 | 1 |
| temporalio/ | 37e2e33dbd7b | setuptools | 83.0.0 | 1 |
| temporalio/ | 836af062af30 | setuptools | 83.0.0 | 1 |
| temporalio/ | cda4901bab53 | setuptools | 83.0.0 | 1 |
| tenableofficial/ | c88e43fe1a8c | setuptools | 83.0.0 | 1 |
| tensorflow/ | 1e3172090703 | setuptools | 83.0.0 | 1 |
| thecloudspark/ | c7da7417a86a | setuptools | 83.0.0 | 1 |
| thelande/ | a1fdb8baa152 | setuptools | 83.0.0 | 1 |
| thingsboard/ | 1bd61a0da6d3 | setuptools | 83.0.0 | 1 |
| thongngo3301/ | a341af5976e3 | setuptools | 83.0.0 | 1 |
| timescale/ | a8e3322e1cf9 | setuptools setuptools | no fix listed 83.0.0 | 1 |
| timescale/ | cdb9ae118899 | setuptools setuptools | no fix listed 83.0.0 | 1 |