CVE-2026-6357

Medium

Advisory

Published 27 Apr 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.001; 4th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,264; of 17,790 indexed, latest versions
Container images: 1,214; deployed by those charts
Fix available: 2 of 3; affected packages

pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere

Carried by container images the latest versions of 1,264 of 17,790 indexed charts deploy, on 1,214 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+65 more	26.1	1,207
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+25 more	no fix listed	139
py3-pipapk	25.0.1-r0, 25.2-r0, 25.3-r2, 25.3-r3+2 more	26.1.1-r0	9

OSV records: CGA-62q8-238c-v33c CGA-6934-j8w5-ggwc CGA-8w3m-p9rg-vfgv DEBIAN-CVE-2026-6357 GHSA-jp4c-xjxw-mgf9 UBUNTU-CVE-2026-6357
Also known as: CGA-65q2-63cw-4355, CGA-69j4-wp86-cj67, CGA-74h5-68pc-h963, CGA-7pw2-rhmg-m2hr, CGA-7vq8-m28w-6rmf, CGA-qmmj-2pmg-2vpx, CGA-r482-24m8-gv9h, CGA-vqpj-m7r7-vf4j, CGA-w8wp-q9p5-56fw, PYSEC-2026-2876

Charts affected

1,264 by stars

Chart

Latest

Affected images

Radar Score

onyx-stackonyx

0.3.1

1 of 12 See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
onyxdotapp/onyx-backend :latest	473fdffe4e67	pip@26.0.1	26.1

Open the chart page →

6,252

anchore-engineopencloudcx

1.13.0

1 of 2 See more

anchore-engine opencloudcx 1.13.0

1 of the 2 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
anchore/anchore-engine :v0.10.0	bde9eedf639d	pip@19.3.1	26.1

Open the chart page →

18,023

comacopencord

1.0.0

3 of 9 See more

comac opencord 1.0.0

3 of the 9 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
omecproject/kubernetes-synchronizer :comac-1.0.0	7c17a7b1d1ef	pip@18.1	26.1
omecproject/mcord-synchronizer :comac-1.0.0	cfdb566dd949	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	26.1 no fix listed
omecproject/progran-synchronizer :comac-1.0.0	d109a8e57e71	pip@9.0.3 python-pip@8.1.1-2ubuntu0.4	26.1 no fix listed

Open the chart page →

88,616

comac-platformopencord

0.0.17

2 of 11 See more

comac-platform opencord 0.0.17

2 of the 11 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
omecproject/kubernetes-synchronizer :comac-1.0.0	7c17a7b1d1ef	pip@18.1	26.1
omecproject/mcord-synchronizer :comac-1.0.0	cfdb566dd949	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	26.1 no fix listed

Open the chart page →

26,234

nem-monitoringopencord

1.3.22

1 of 9 See more

nem-monitoring opencord 1.3.22

1 of the 9 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
kiwigrid/k8s-sidecar :0.1.20	af151f677a63	pip@19.2.1	26.1

Open the chart page →

4,612

omec-control-planeopencord

0.1.31

1 of 8 See more

omec-control-plane opencord 0.1.31

1 of the 8 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
omecproject/mme-exporter :paging-latest	bcc5f19fd676	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.1	26.1 no fix listed

Open the chart page →

40,795

ponsimv2opencord

1.2.3

1 of 2 See more

ponsimv2 opencord 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
voltha/voltha-tester :1.7.0	655c3048a602	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	26.1 no fix listed

Open the chart page →

12,631

sebaopencord

1.0.0

4 of 17 See more

seba opencord 1.0.0

4 of the 17 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
voltha/voltha-cli :1.6.0	c4e41e92f046	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	26.1 no fix listed
voltha/voltha-netconf :1.6.0	37f80524c207	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	26.1 no fix listed
voltha/voltha-ofagent :1.6.0	9ee8c1f4428c	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	26.1 no fix listed
voltha/voltha-voltha :1.6.0	ff596b62de59	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	26.1 no fix listed

Open the chart page →

93,965

opencost-parquet-exporteropencost

0.3.1

1 of 1 See more

opencost-parquet-exporter opencost 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
ghcr.io/opencost/opencost-parquet-exporter :v0.2.1	ce85ef0ce665	pip@24.0	26.1

Open the chart page →

11,003

open-pdcopen-pdc

0.1.0

1 of 3 See more

3,423

llm-stackopenproject-helm-charts

1.1.0

1 of 2 See more

llm-stack openproject-helm-charts 1.1.0

1 of the 2 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
library/python :3.12-slim	78387bc3881b	pip@25.0.1	26.1

Open the chart page →

1,977

open-pubopen-pub

0.1.0

1 of 3 See more

3,423

akeyless-api-gatewayopenshift

1.41.2

1 of 1 See more

akeyless-api-gateway openshift 1.41.2

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
akeyless/base-rhel :0.0.1	4ba8900a0061	pip@20.2.4	26.1

Open the chart page →

11,795

chatbot-ai-sampleopenshift

0.1.6

2 of 4 See more

chatbot-ai-sample openshift 0.1.6

2 of the 4 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
quay.io/ai-lab/llamacpp_python :latest	70d138997acd	pip@22.3.1	26.1
quay.io/redhat-ai-dev/chatbot :latest	59fe607dfdf2	pip@24.0	26.1

Open the chart page →

18,991

exporteropenshift

1.0.47

1 of 3 See more

exporter openshift 1.0.47

1 of the 3 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
public.ecr.aws/perfectscale-io/kube-state-metrics :4.1.14-redhat	849e235e2d3e	pip@9.0.3	26.1

Open the chart page →

13,034

flomesh-consoleopenshift

0.70.0-30-ubi8

2 of 2 See more

flomesh-console openshift 0.70.0-30-ubi8

2 of the 2 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
quay.io/flomesh/flomesh-console-ubi8 :0.70.0-30	ce6938ff6709	pip@9.0.3	26.1
quay.io/flomesh/pipy-repo-ubi8 :0.70.0-46	9912fdf6c183	pip@9.0.3	26.1

Open the chart page →

9,968

fsmopenshift

0.1.8-ubi.6

1 of 6 See more

fsm openshift 0.1.8-ubi.6

1 of the 6 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.50.0-88	24352dca6672	pip@9.0.3	26.1

Open the chart page →

16,554

hamiopenshift

2.10.0-r0-openshift.c4e22e88

1 of 2 See more

hami openshift 2.10.0-r0-openshift.c4e22e88

1 of the 2 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
ghcr.io/dynamia-ai/hami-enterprise :v2.10.0-r0-openshift.c4e22e88	745504757300	pip@9.0.3	26.1

Open the chart page →

4,749

orion-ldopenshift

1.0.3

2 of 2 See more

orion-ld openshift 1.0.3

2 of the 2 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
quay.io/fiware/orion-ld :1.0.1	ea838e5b4051	pip@9.0.3	26.1
quay.io/opencloudio/ibm-mongodb :4.0.24	d8c631a6dc43	pip@9.0.3	26.1

Open the chart page →

14,727

osm-edgeopenshift

1.2.1-ubi8

1 of 7 See more

osm-edge openshift 1.2.1-ubi8

1 of the 7 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.70.0-46	35d87a381432	pip@9.0.3	26.1

Open the chart page →

19,449

open-webconceptopen-webconcept

0.1.0

1 of 3 See more

open-webconcept open-webconcept 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	pip@23.0.1	26.1

Open the chart page →

3,423

terminalsopen-webui

0.7.0

2 of 2 See more

terminals open-webui 0.7.0

2 of the 2 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
ghcr.io/open-webui/terminals :latest	5d2fd44366a4	pip@25.0.1	26.1
ghcr.io/open-webui/terminals-operator :latest	6287ce8be502	pip@25.0.1	26.1

Open the chart page →

1,998

openwhiskopenwhisk

1.0.0

2 of 10 See more

openwhisk openwhisk 1.0.0

2 of the 10 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
openwhisk/kafkaprovider :2.1.0	63dc3d2a0904	pip@19.3.1	26.1
openwhisk/ow-utils :1.0.0	c80dba0de3aa	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.4	26.1 no fix listed

Open the chart page →

36,230

osdfir-infrastructureosdfir-infrastructure

2.15.0

8 of 40 See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

8 of the 40 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
ghcr.io/openrelik/openrelik-mediator :latest	42efc445b19e	pip@25.0.1	26.1
ghcr.io/openrelik/openrelik-metrics :latest	3d0f1ddeebf5	pip@25.0.1	26.1
ghcr.io/openrelik/openrelik-server :latest	ce1132261523	pip@25.0.1	26.1
ghcr.io/openrelik/openrelik-worker-analyzer-config :latest	1269d3d8d2c2	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-logs :latest	b175cc61959a	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-containers :latest	a6d5abe94706	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.1 no fix listed
ghcr.io/openrelik/openrelik-worker-os-creds :latest	7fc7ec101f08	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-plaso :latest	75537ea8c851	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.1 no fix listed

Open the chart page →

72,154

loki-standaloneot-container-kit

1.0.2

1 of 5 See more

loki-standalone ot-container-kit 1.0.2

1 of the 5 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
quay.io/opstree/k8s-sidecar :2.7.1	26aa9bb3386b	pip@26.0.1	26.1

Open the chart page →

3,593

mysqlot-container-kit

0.1.0

1 of 1 See more

463

pgaot-container-kit

1.0.3

1 of 6 See more

pga ot-container-kit 1.0.3

1 of the 6 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.26.1	b8d5067137fe	pip@24.0	26.1

Open the chart page →

5,136

vmot-container-kit

0.0.3

1 of 7 See more

vm ot-container-kit 0.0.3

1 of the 7 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	pip@24.0	26.1

Open the chart page →

5,410

devpiowan-charts

0.1.0

1 of 1 See more

devpi owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
owanio1992/devpi :6.16.0	4ade8e1e4d7e	pip@25.1.1	26.1

Open the chart page →

510

p4p4

0.1.0

1 of 7 See more

27,667

myappp4-helm

0.1.0

1 of 6 See more

19,725

pagespages

1.0.0

1 of 3 See more

20,233

pagespages10

1.0.0

1 of 3 See more

20,233

pagespages111

1.0.0

1 of 3 See more

20,233

pagespages2

1.0.0

1 of 3 See more

20,233

pagespages-alexchmielu

1.0.0

1 of 3 See more

20,233

pagespages-alps

1.0.0

1 of 3 See more

20,233

pagespages-alstom

1.0.0

1 of 3 See more

20,233

pagespages-ambala

1.0.0

1 of 3 See more

20,233

pagespages-andromeda

1.0.0

1 of 3 See more

20,233

pagespagesbadami

1.0.0

1 of 3 See more

20,233

pagespages-blackburn

1.0.0

1 of 3 See more

20,233

pagespages-botes

1.0.0

1 of 3 See more

20,233

pagespages-brian

1.0.0

1 of 3 See more

20,233

pagespages-buckll

1.0.0

1 of 3 See more

20,233

pagespages-camden

1.0.0

1 of 3 See more

20,233

pagespages-camden771

1.0.0

1 of 3 See more

20,233

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-6357.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.1

Open the chart page →

20,233

pagespages-draco

1.0.0

1 of 3 See more

20,233

pagespages-ellora

1.0.0

1 of 3 See more

20,233

Container images carrying it

1,214 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
rezachalak/bzen-mongo :1.0.0	34f694325191	pip@20.0.2 python-pip@20.0.2-5ubuntu1.9	26.1 no fix listed	1
rhasspy/wyoming-piper :2.3.1	69b7f797ae3a	pip@23.0.1 python-pip@23.0.1+dfsg-1	26.1 no fix listed	1
rhasspy/wyoming-piper :2.5.2	7d39aafac409	pip@25.1.1 python-pip@25.1.1+dfsg-1	26.1 no fix listed	1
rhasspy/wyoming-speech-to-phrase :1.4.3	e532f0dbc6b2	pip@23.0.1 python-pip@23.0.1+dfsg-1	26.1 no fix listed	1
rhasspy/wyoming-whisper :3.5.0	308b7959a925	pip@23.0.1 python-pip@23.0.1+dfsg-1	26.1 no fix listed	1
rhasspy/wyoming-whisper :1.0.0	80b99ddeef6c	pip@20.3.4	26.1	1
richardchesterwood/k8s-fleetman-webapp-angular :release2	ed7d720878ac	pip@9.0.1	26.1	1
roadiehq/community-backstage-image :latest	ef355bf5b639	pip@19.2.3	26.1	1
robmarkcole/deepstack-ui :latest	410275726459	pip@21.2.4	26.1	1
robotshop/rs-payment :latest	774b52c6180d	pip@21.2.4	26.1	1
rommapp/romm :5.2.0	3512f2ca4557	pip@25.3	26.1	1
rommapp/romm :4.4.1	b909e95d1aab	pip@25.2	26.1	1
runx1/opta-agent :latest	0ca3867d3200	pip@22.0.4	26.1	1
saidsef/scapy-containerised :v2025.02	f17f7c435891	pip@24.3.1	26.1	1
salehmir/jesse :1.10.10	1afa95f979e9	pip@24.2	26.1	1
saltstack/salt :3006.3	e9c7906b7a5c	pip@22.0.4	26.1	1
samueldg/snappass :latest	3987195edbe6	pip@19.3.1	26.1	1
santisbon/evwatcher :latest	c4e994ca4540	pip@23.0.1 python-pip@23.0.1+dfsg-1	26.1 no fix listed	1
santisbon/evworker :latest	e807283f8d69	pip@23.0.1 python-pip@23.0.1+dfsg-1	26.1 no fix listed	1
santisbon/speedtest :latest	8ee3a1697227	pip@23.0.1 python-pip@23.0.1+dfsg-1	26.1 no fix listed	1
sashafefler/spacecapybara_app :latest	f96d7804c0ca	pip@23.0.1	26.1	1
scrapinghub/splash :3.4.1	a5f89bc84606	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.1	26.1 no fix listed	1
seafileltd/seafile-mc :9.0.10	6693911bcc40	pip@20.0.2 python-pip@20.0.2-5ubuntu1.6	26.1 no fix listed	1
seafileltd/seafile-mc :10.0.1	70628f29c663	pip@20.0.2 python-pip@20.0.2-5ubuntu1.9	26.1 no fix listed	1
seafileltd/seafile-mc :9.0.9	7ac833196f60	pip@20.0.2 python-pip@20.0.2-5ubuntu1.6	26.1 no fix listed	1
seafileltd/seafile-mc :11.0.12	d0c66e4621bd	pip@24.2 python-pip@22.0.2+dfsg-1ubuntu0.4	26.1 no fix listed	1
seafileltd/seafile-mc :8.0.7	ed0fcda5e6a9	pip@21.2.3 python-pip@20.0.2-5ubuntu1.6	26.1 no fix listed	1
searx/searx :1.0.0-211-968b2899	3dbb3a6d9419	pip@21.2.4	26.1	1
seldonio/locust-core :0.8	1d0da98a2d76	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	26.1 no fix listed	1
seldonio/seldon-request-logger :1.11.2	4e985d2006a8	pip@19.3.1	26.1	1
semaphoreui/semaphore :latest :v2.19.12	3996804607eb	pip@24.3.1	26.1	1
semaphoreui/semaphore :v2.19.14	98ad9bc7a2a0	pip@24.3.1	26.1	1
semaphoreui/semaphore :v2.18.3	e9260bfa8255	pip@24.3.1	26.1	1
seoulorigin/janus-ml-sidecar :v3.1	92cbaad0c540	pip@25.0.1	26.1	1
shadowrhyder/gke-volume-autoscaler :3.0.2	4aae9270356a	pip@23.2.1	26.1	1
shaowenchen/ops-controller-manager :latest	26da43bb5b66	pip@22.0.2 python-pip@22.0.2+dfsg-1ubuntu0.7	26.1 no fix listed	1
shaowenchen/ops-server :latest	315444f703f4	pip@22.0.2 python-pip@22.0.2+dfsg-1ubuntu0.6	26.1 no fix listed	1
sharanalwar/redchef-backend :latest	8d3cab80df49	pip@23.0.1	26.1	1
shlomibendavid/k8s-applier :0311240529	a22ffbe0f04e	pip@24.0	26.1	1
shwcloud/seawise-backup :v1.7.1	a97479a54df4	pip@24.0	26.1	1
signalen/backend :2.50.14	760256000738	pip@25.0.1	26.1	1
signalen/classification :ad60447d1733473e30ab0a3ba53d58141cc1d250	9496ae672877	pip@23.0.1	26.1	1
sirrend/helmup-engine :0.1.13	699e79e3d4e2	pip@24.0	26.1	1
sirrend/helmup-github-scraper :0.1.4	7ca688c7abf5	pip@24.0	26.1	1
sirrend/helmup-notifications-service :0.1.3	997866417011	pip@23.3.1	26.1	1
sissbruecker/linkding :1.46.2	0c0a9a04c7eb	pip@25.2	26.1	1
sissbruecker/linkding :1.35.0	0c5dddf0b37c	pip@24.2	26.1	1
sissbruecker/linkding :1.41.0-plus	a222fb777e1f	pip@25.1.1	26.1	1
skylenet/ethereum-genesis-generator :latest	210353ce7c89	pip@20.3.4	26.1	1
socialmediamacroscope/autophrase :0.1.5	70fb11d4f531	pip@20.0.2 python-pip@20.0.2-5ubuntu1.9	26.1 no fix listed	1