CVE-2026-6357

Medium

Advisory

Published 27 Apr 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.001; 4th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,264; of 17,790 indexed, latest versions
Container images: 1,214; deployed by those charts
Fix available: 2 of 3; affected packages

pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere

Carried by container images the latest versions of 1,264 of 17,790 indexed charts deploy, on 1,214 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+65 more	26.1	1,207
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+25 more	no fix listed	139
py3-pipapk	25.0.1-r0, 25.2-r0, 25.3-r2, 25.3-r3+2 more	26.1.1-r0	9

OSV records: CGA-62q8-238c-v33c CGA-6934-j8w5-ggwc CGA-8w3m-p9rg-vfgv DEBIAN-CVE-2026-6357 GHSA-jp4c-xjxw-mgf9 UBUNTU-CVE-2026-6357
Also known as: CGA-65q2-63cw-4355, CGA-69j4-wp86-cj67, CGA-74h5-68pc-h963, CGA-7pw2-rhmg-m2hr, CGA-7vq8-m28w-6rmf, CGA-qmmj-2pmg-2vpx, CGA-r482-24m8-gv9h, CGA-vqpj-m7r7-vf4j, CGA-w8wp-q9p5-56fw, PYSEC-2026-2876

Charts affected

1,264 by stars

Chart

Latest

Affected images

Radar Score

prometheus-operatorstatcan

0.2.2

1 of 7 See more

prometheus-operator statcan 0.2.2

1 of the 7 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
kiwigrid/k8s-sidecar :0.1.151	7b98eecdf6d1	pip@20.1	26.1

Open the chart page →

12,237

pagesstephendillondell

1.0.0

1 of 3 See more

20,233

storageclass-routerstorageclass-router

0.4.1

1 of 1 See more

storageclass-router storageclass-router 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
quay.io/maxiv/storageclass-router :0.4.1	60725dab588c	pip@24.0	26.1

Open the chart page →

1,057

sn-platform-slimstreamnative

1.11.44

1 of 6 See more

sn-platform-slim streamnative 1.11.44

1 of the 6 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	pip@20.0.2 python-pip@20.0.2-5ubuntu1.10	26.1 no fix listed

Open the chart page →

10,182

studygovernorstudy-governor

0.1.38

1 of 3 See more

studygovernor study-governor 0.1.38

1 of the 3 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
registry.gitlab.com/radiology/infrastructure/study-governor :8.0.0	4e7faf6f8d5f	pip@22.0.4	26.1

Open the chart page →

1,447

artifactory-cleanupsubshell

1.0.1

1 of 1 See more

artifactory-cleanup subshell 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
devopshq/artifactory-cleanup :1.0.18	30e093bffa91	pip@23.0.1	26.1

Open the chart page →

2,540

substra-backendsubstra

26.15.3

1 of 7 See more

substra-backend substra 26.15.3

1 of the 7 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
ghcr.io/substra/substra-backend :1.0.1	21967f54ec86	pip@24.0	26.1

Open the chart page →

4,782

verbasubstratus

0.4.0

1 of 1 See more

verba substratus 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
substratusai/verba :v0.4.0-baseURL2	61695be635eb	pip@23.0.1	26.1

Open the chart page →

12,937

3d-printing-cost-calculatorssudo-kraken-3d-printing-cost-calculators

0.1.4

1 of 1 See more

3d-printing-cost-calculators sudo-kraken-3d-printing-cost-calculators 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
ghcr.io/sudo-kraken/3d-printing-cost-calculators :v1.1.1	220c5e4e1a3d	pip@25.2	26.1

Open the chart page →

2,577

authentik-webfinger-proxysudo-kraken-authentik-webfinger-proxy

0.1.4

1 of 1 See more

authentik-webfinger-proxy sudo-kraken-authentik-webfinger-proxy 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
ghcr.io/sudo-kraken/authentik-webfinger-proxy :v1.1.1	e1351a977607	pip@25.2	26.1

Open the chart page →

2,657

fantasy-dice-chambersudo-kraken-fantasy-dice-chamber

0.1.3

1 of 1 See more

fantasy-dice-chamber sudo-kraken-fantasy-dice-chamber 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
ghcr.io/sudo-kraken/fantasy-dice-chamber :v1.3.2	99fd4cb0f4fe	pip@25.2	26.1

Open the chart page →

2,689

finances-trackersudo-kraken-finances-tracker

0.1.5

1 of 1 See more

finances-tracker sudo-kraken-finances-tracker 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
ghcr.io/sudo-kraken/finances-tracker :v1.1.1	c73527cde81c	pip@25.2	26.1

Open the chart page →

2,657

flaresolverrsudo-kraken-flaresolverr

2.1.4

1 of 1 See more

flaresolverr sudo-kraken-flaresolverr 2.1.4

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
ghcr.io/flaresolverr/flaresolverr :v3.4.6	7962759d99d7	pip@25.2	26.1

Open the chart page →

33,591

jf-pushover-webhooksudo-kraken-jf-pushover-webhook

0.1.3

1 of 1 See more

jf-pushover-webhook sudo-kraken-jf-pushover-webhook 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
ghcr.io/sudo-kraken/jf-pushover-webhook :v1.1.0	ee9cf22a39ab	pip@25.2	26.1

Open the chart page →

2,657

qbittorrentsudo-kraken-qbittorrent

5.1.5

1 of 2 See more

qbittorrent sudo-kraken-qbittorrent 5.1.5

1 of the 2 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
ghcr.io/home-operations/qbittorrent :5.1.4	bb82ad6668f8	pip@25.3	26.1

Open the chart page →

2,130

pagessunilb2590-pages

1.0.0

1 of 3 See more

20,233

netforge-besvtech

0.0.2

1 of 3 See more

4,687

csv-viewsvtech-public-helm-charts

1.0.0

1 of 1 See more

csv-view svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_csv :v1.0.1	b9d7ecf8de24	pip@20.2.2	26.1

Open the chart page →

1,220

freeradiussvtech-public-helm-charts

0.1.5

1 of 4 See more

freeradius svtech-public-helm-charts 0.1.5

1 of the 4 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
library/mysql :8.2.0	212fe73edca5	pip@20.2.4	26.1

Open the chart page →

12,708

icinga2svtech-public-helm-charts

1.0.0

1 of 4 See more

icinga2 svtech-public-helm-charts 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_icinga2 :v1.1.6	67be2aba9436	pip@9.0.3	26.1

Open the chart page →

5,101

icinga2-reportsvtech-public-helm-charts

1.0.0

1 of 1 See more

icinga2-report svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
trungkien210493/icinga2-report :v1.7.1	2cc8c3763c4c	pip@20.1.1	26.1

Open the chart page →

1,779

maxscalesvtech-public-helm-charts

1.0.0

1 of 2 See more

maxscale svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
library/mysql :8.2.0	212fe73edca5	pip@20.2.4	26.1

Open the chart page →

5,880

rundecksvtech-public-helm-charts

1.0.0

1 of 2 See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_rundeck :v1.2.2	6e368ace0977	pip@24.0	26.1

Open the chart page →

18,828

rundeck-option-providersvtech-public-helm-charts

1.0.0

1 of 2 See more

rundeck-option-provider svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_rundeck_option_provider :v1.1.1	674fad30a51f	pip@20.2.2	26.1

Open the chart page →

1,428

stashswuuper-github

0.1.16

1 of 1 See more

stash swuuper-github 0.1.16

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
stashapp/stash :v0.31.1	df744af5a0c9	pip@25.1.1	26.1

Open the chart page →

2,397

cronjobt3n

0.1.0

1 of 1 See more

10,545

gtmetrix-bqt3n

1.0.0

1 of 1 See more

1,287

take-the-helmtake-the-helm

0.1.0

1 of 1 See more

take-the-helm take-the-helm 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
cadmusthefounder/lnd :take-the-helm-0.1.0	e596c5fbf80f	pip@22.0.4	26.1

Open the chart page →

805

tarkatarka

0.4.1

1 of 4 See more

tarka tarka 0.4.1

1 of the 4 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
ghcr.io/tarkyaio/tarka :0.4.1	e8d3f1512f06	py3-pip@26.0.1-r2	26.1.1-r0

Open the chart page →

1,556

democharttech-challenge

0.1.0

2 of 4 See more

demochart tech-challenge 0.1.0

2 of the 4 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
alexvm6/generator :latest	fb99ee4f760a	pip@22.3.1	26.1
alexvm6/pythonalex :latest	89a05786879c	pip@22.3.1	26.1

Open the chart page →

3,630

rundeck-exportertechpreta

0.1.9

1 of 1 See more

rundeck-exporter techpreta 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
phsmith/rundeck-exporter :2.6.1	0265a7616ae8	pip@22.3.1	26.1

Open the chart page →

1,104

hadoop-deploymenttejaswita-hadoop-helmchart

1.0.0

1 of 1 See more

hadoop-deployment tejaswita-hadoop-helmchart 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
apache/hadoop :3	af361b20bec0	pip@8.1.2	26.1

Open the chart page →

4,239

temporaltemporal

0.28.9

1 of 13 See more

temporal temporal 0.28.9

1 of the 13 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.22.0	836af062af30	pip@23.1.2	26.1

Open the chart page →

21,004

tensor_apptensor-app

0.2.2

2 of 3 See more

tensor_app tensor-app 0.2.2

2 of the 3 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	pip@23.0.1	26.1
xeladock/mysql_dns :latest	4baf531453f1	pip@22.0.2 python-pip@22.0.2+dfsg-1	26.1 no fix listed

Open the chart page →

17,561

krokiteochenglim

1.0.1

1 of 5 See more

kroki teochenglim 1.0.1

1 of the 5 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
yuzutech/kroki-blockdiag :0.16.0	7c1917c66d96	pip@21.2.4	26.1

Open the chart page →

8,716

pagestest4322

1.0.0

1 of 3 See more

20,233

flask-contactstest-configmap

1.0.1

2 of 3 See more

flask-contacts test-configmap 1.0.1

2 of the 3 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.1
shashkist/flask-contacts-app :latest	581de1fd6084	pip@24.2	26.1

Open the chart page →

5,624

webapp1test-helm-chart-1

0.1.0

1 of 1 See more

webapp1 test-helm-chart-1 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
devopsjourney1/mywebapp :latest	bd1ec6838570	pip@22.0.4	26.1

Open the chart page →

1,469

asrtest-opea

1.0.0

1 of 1 See more

4,176

chatqnatest-opea

1.0.0

5 of 11 See more

chatqna test-opea 1.0.0

5 of the 11 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
opea/chatqna :1.0	38c51b791efa	pip@24.2	26.1
opea/embedding-tei :1.0	5c9639de61c1	pip@24.0	26.1
opea/llm-tgi :1.0	0c25aab3f106	pip@24.0	26.1
opea/reranking-tei :1.0	e48613afb191	pip@24.2	26.1
opea/retriever-redis :1.0	eb746b263705	pip@24.0	26.1

Open the chart page →

36,661

codegentest-opea

1.0.0

2 of 5 See more

codegen test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
opea/codegen :1.0	58f91683892d	pip@24.2	26.1
opea/llm-tgi :1.0	0c25aab3f106	pip@24.0	26.1

Open the chart page →

26,489

codetranstest-opea

1.0.0

2 of 5 See more

codetrans test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
opea/codetrans :1.0	e2436483b73d	pip@24.2	26.1
opea/llm-tgi :1.0	0c25aab3f106	pip@24.0	26.1

Open the chart page →

26,060

docsumtest-opea

1.0.0

2 of 5 See more

docsum test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
opea/docsum :1.0	3eaa91849512	pip@24.2	26.1
opea/llm-docsum-tgi :1.0	02f9e8fa5d71	pip@24.0	26.1

Open the chart page →

26,535

embedding-usvctest-opea

1.0.0

1 of 1 See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
opea/embedding-tei :1.0	5c9639de61c1	pip@24.0	26.1

Open the chart page →

4,829

guardrails-usvctest-opea

1.0.0

1 of 1 See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
opea/guardrails-tgi :1.0	262c6048aab8	pip@24.2	26.1

Open the chart page →

4,865

llm-uservicetest-opea

1.0.0

1 of 1 See more

4,363

reranking-usvctest-opea

1.0.0

1 of 1 See more

reranking-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
opea/reranking-tei :1.0	e48613afb191	pip@24.2	26.1

Open the chart page →

4,629

retriever-usvctest-opea

1.0.0

1 of 1 See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
opea/retriever-redis :1.0	eb746b263705	pip@24.0	26.1

Open the chart page →

4,842

speecht5test-opea

1.0.0

1 of 1 See more

8,877

ttstest-opea

1.0.0

1 of 1 See more

4,160

Container images carrying it

1,214 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
kfirfer/gcloud-mysql :1.0.3	c257c1e0e8b9	pip@23.2.1	26.1	1
kfirfer/kibana-index-pattern-updater :1.0.12	e88cfcec5c93	pip@20.3.3	26.1	1
kfirfer/percona-xtradb-healthcheck :0.0.1	ef7b909a8e6b	pip@20.2.4	26.1	1
kfirfer/scripts :0.0.24	81e5c4e5d70e	pip@22.3.1	26.1	1
kfirfer/slackgpt :0.0.15	461331bd838e	pip@23.2.1	26.1	1
kfserving/models-web-app :v0.6.1	f322d6ffdfa3	pip@21.2.4	26.1	1
kinseii/wazuh-agent :4.14.1	7160eb143728	pip@23.0.1 python-pip@23.0.1+dfsg-1	26.1 no fix listed	1
kiwigrid/k8s-sidecar :1.1.0	3e86186656d3	pip@20.2.3	26.1	1
kiwigrid/k8s-sidecar :1.3.0	65095a82d4a1	pip@20.2.4	26.1	1
kiwigrid/k8s-sidecar :0.0.18	6eb52513d59e	pip@19.1.1	26.1	1
kiwigrid/k8s-sidecar :1.12.0	89739be9ff38	pip@21.0.1	26.1	1
kiwigrid/k8s-sidecar :0.0.16	899ccd0b1f54	pip@19.0.3	26.1	1
kiwigrid/k8s-sidecar :0.1.20	af151f677a63	pip@19.2.1	26.1	1
kiwigrid/k8s-sidecar :1.27.6	db85bd553253	pip@24.2	26.1	1
kiwigrid/k8s-sidecar :1.26.2	e271016441af	pip@24.0	26.1	1
knspar/phronetis :0.1.46	09499d2dc91a	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.1	26.1 no fix listed	1
knspar/phronetis-operator :0.1.6	0c4f0543ee58	pip@24.0	26.1	1
kobotoolbox/kobocat :2.022.24a	b15679454415	pip@22.2.1	26.1	1
kobotoolbox/kpi :2.022.24d	bcacc01bccd4	pip@22.2.1	26.1	1
kocolosk/couchdb-statefulset-assembler :1.2.0	6effb982154e	pip@9.0.1	26.1	1
kodekloud/webapp-color :latest	99c3821ea49b	pip@18.1	26.1	1
kong/httpbin :latest	a6ac46531193	pip@22.0.2 python-pip@22.0.2+dfsg-1ubuntu0.5	26.1 no fix listed	1
kpetrem/mqtt-exporter :latest	dca3255f3531	pip@23.0.1	26.1	1
kporwit/vinyl_lib_app :v0.1.1	217de0302218	pip@22.1.2	26.1	1
kserve/models-web-app :v0.8.0	63ea05e73842	pip@22.0.4	26.1	1
kserve/models-web-app :v0.13.0	73486345a602	pip@24.0	26.1	1
kubeaws/kube-spot-termination-notice-handler :1.13.0-1	c9cd2ba4373a	pip@19.0.3	26.1	1
kubeflownotebookswg/jupyter-web-app :v1.9.2	afb52057c997	pip@23.0.1	26.1	1
kubeflownotebookswg/jupyter-web-app :v1.6.1	d762690e21c1	pip@22.0.4	26.1	1
kubeflownotebookswg/tensorboards-web-app :v1.6.1	0876fef1973b	pip@22.0.4	26.1	1
kubeflownotebookswg/tensorboards-web-app :v1.9.2	77f07f52a84a	pip@23.0.1	26.1	1
kubeflownotebookswg/volumes-web-app :v1.6.1	7299fa94db15	pip@22.0.4	26.1	1
kubeflownotebookswg/volumes-web-app :v1.9.2	f63c3e550af3	pip@23.0.1	26.1	1
kubesphere/examples-bookinfo-productpage-v1 :1.13.0	378f49ec9c44	pip@19.1.1	26.1	1
kubitodev/traefik-ip-whitelist-sync :1.0.2	aa24869319bf	pip@22.0.4	26.1	1
kunchalavikram/connectedcity :v1	4a559a47579e	pip@19.0.1	26.1	1
kunchalavikram/connectedfactory :v1	52c13fb9b1d9	pip@19.0.1	26.1	1
kusionstack/kusion :v0.14.0	126c8f0b0976	pip@22.0.2 python-pip@22.0.2+dfsg-1ubuntu0.5	26.1 no fix listed	1
kyovint/kyoimgtransactions :1.0.0	48c19e3ae9a3	pip@24.0	26.1	1
kyovint/kyoimgusers :1.0.0	80084149156e	pip@24.0	26.1	1
kyso/kyso-nbdime :latest	4aa9d38ee81d	pip@22.3.1	26.1	1
langgenius/dify-agent-backend :1.16.1	097d3fd27a7b	pip@25.0.1	26.1	1
langgenius/dify-agent-local-sandbox :1.16.1	bf8027ddccf3	pip@25.0.1	26.1	1
langgenius/dify-api :1.0.0	066035f93856	pip@25.0.1	26.1	1
langgenius/dify-api :1.16.1	dcefa5f7c47c	pip@25.0.1	26.1	1
langgenius/dify-api :0.6.11	fca918260dd6	pip@23.0.1	26.1	1
langgenius/dify-plugin-daemon :0.6.3-local	3c694329357b	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.1 no fix listed	1
langgenius/dify-plugin-daemon :0.5.1-local	8269050f192e	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.1 no fix listed	1
langgenius/dify-plugin-daemon :main-local	da995c129e2f	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.1 no fix listed	1
langgenius/dify-sandbox :0.2.12	4e65e8a351a2	pip@23.0.1	26.1	1