CVE-2026-66035

High

Advisory

Published 24 Jul 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.7; base score, highest
EPSS: 0.005; 39th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 454; of 17,781 indexed, latest versions
Container images: 292; deployed by those charts
Fix available: 1 of 1; affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 454 of 17,781 indexed charts deploy, on 292 images.

Affected package	Affected versions	Fixed in	Images
libssh2deb	1.5.0-2ubuntu0.1, 1.8.0-2.1build1, 1.10.0-3, 1.11.0-4.1build2+9 more	1.11.0-4.1ubuntu0.24.04.4, 1.11.1-1+deb13u2, 1.11.1-1+e5, 1.11.1-1ubuntu0.26.04.4	292

OSV records: DEBIAN-CVE-2026-66035 UBUNTU-CVE-2026-66035 ECHO-a13b-3527-8590
Also known as: USN-8722-1

Charts affected

454 by stars

Chart

Latest

Affected images

Radar Score

Wordpresswordpress-mariadb

1.0.2

1 of 2 See more

Wordpress wordpress-mariadb 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-66035.

Container image	Digest	Package	Fixed in
library/wordpress :latest	5a93c470ae82	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2

Open the chart page →

5,560

nginx-chartxxoznge-nginx

0.1.0

1 of 1 See more

nginx-chart xxoznge-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-66035.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2

Open the chart page →

1,827

my-nginx-appyasser-nginx-app

0.1.0

1 of 1 See more

my-nginx-app yasser-nginx-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-66035.

Container image	Digest	Package	Fixed in
library/nginx :stable	d5792f71a949	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2

Open the chart page →

1,827

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-66035.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2

Open the chart page →

1,827

Container images carrying it

292 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
phpmyadmin/phpmyadmin :5.2.3	42a200db07b4	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
pockost/matomo :5.13.0	7f5d293cbe4e	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
polyaxon/polyaxon-api :2.16.4	2b55c3265a90	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
polyaxon/polyaxon-streams :2.16.4	c186bd9834c0	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
postgis/postgis :18-3.6	7e00e8c3539f	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
powerdns/pdns-recursor-54 :5.4.5	33aadc74a8d6	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
prefecthq/prefect :3.8.5-python3.11	0018d02259bc	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
pretix/standalone :2026.7.0	5df3b7aa852e	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
prodrigestivill/postgres-backup-local :latest	f70742ebe42b	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
qjoly/kubernetes-coffee-image :simple	ec94d3bdc035	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
reallibrephotos/librephotos-proxy :1.0.3	98a13dabbadc	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
redpandadata/redpanda :latest	468bd13a9f2b	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
roundcube/roundcubemail :1.6.16-apache-nonroot	17d9d9580962	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
scholtz2/algorand-participation-aramidmain-extended :4.4.1-stable	f12ce1cfb72e	libssh2@1.10.0-3	no fix listed	1
scholtz2/algorand-participation-mainnet-extended :4.4.1-stable	5aaa5d4ab8b8	libssh2@1.10.0-3	no fix listed	1
scholtz2/algorand-participation-voimain-extended :4.4.1-stable	64966de56d9f	libssh2@1.10.0-3	no fix listed	1
scholtz2/algorand-relay-mainnet :4.4.1-stable	e9af7d8ff6bb	libssh2@1.11.0-4.1build2	1.11.0-4.1ubuntu0.24.04.4	1
scholtz2/aramid-algo-follow-node :v4.3.0-stable	1ec63eca86b6	libssh2@1.11.0-4.1build2	1.11.0-4.1ubuntu0.24.04.4	1
scholtz2/aramid-algo-node :v4.4.1-stable	70263d8fab5b	libssh2@1.11.0-4.1build2	1.11.0-4.1ubuntu0.24.04.4	1
scholtz2/aramid-conduit :v1.9.0-stable	3a3b3d3277d2	libssh2@1.11.1-1ubuntu0.26.04.1	1.11.1-1ubuntu0.26.04.4	1
scholtz2/aramid-indexer :v3.9.0-stable	6770214bc881	libssh2@1.11.1-1ubuntu0.26.04.1	1.11.1-1ubuntu0.26.04.4	1
serversideup/php :8.5-fpm-nginx	8f8c2f010ac5	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
sissbruecker/linkding :1.46.2	0c0a9a04c7eb	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
softwaremill/bootzooka :latest	845b5e8f8056	libssh2@1.11.1-1build2	1.11.1-1ubuntu0.26.04.4	1
someblackmagic/k8s-testing-multitool :v0.1.0	6eca64b6b440	libssh2@1.8.0-2.1build1	no fix listed	1
sonroyaalmerol/docker-sogo :5.12.4	3f60f3abe990	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
sslhep/servicex_app :v1.8.5	1d12f943cec5	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
sslhep/servicex_code_gen_atlas_xaod :v1.8.5	e7aff7f97b89	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
sslhep/servicex_code_gen_func_adl_uproot :v1.8.5	b01b8ee966ed	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
sslhep/servicex_code_gen_python :v1.8.5	0e4175a4e1eb	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
sslhep/servicex_code_gen_raw_uproot :v1.8.5	671980005c57	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
sslhep/servicex_code_gen_topcp :v1.8.5	596db2abdd09	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
sslhep/servicex-did-finder-atlasopenmagic :v1.8.5	54aaf1721d03	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
sslhep/servicex-did-finder-cernopendata :v1.8.5	2cb88ceab5bb	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
sslhep/servicex-did-finder-xrootd :v1.8.5	c284442b44e3	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
stalwartlabs/stalwart :v0.16.14	25001929f36a	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
stalwartlabs/stalwart :v0.16.20	74ca4f7f6885	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
stalwartlabs/stalwart :v0.16.21	93c574e52249	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
supabase/logflare :latest	49bfe526f1b4	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
supabase/realtime :latest	d3aa0c86c7b3	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
tautulli/tautulli :latest	670e68dd9efc	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
tchiotludo/akhq :0.28.0	c2824dc2ae44	libssh2@1.11.1-1ubuntu0.26.04.3	1.11.1-1ubuntu0.26.04.4	1
thijsvanloef/palworld-server-docker :v2.7.1	401d3eb5c053	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
thijsvanloef/palworld-server-docker :v2.5.0	b4ac9ee22483	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
thingsboard/tbmq-integration-executor :2.4.0	b5a9c1addf80	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
thingsboard/tbmq-node :2.4.0	70661025dba5	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
timescale/timescaledb-ha :pg16	d7db8f1085a3	libssh2@1.10.0-3	no fix listed	1
timescale/timescaledb-ha :pg17.2-ts2.18.2	e8d0a9cc3db5	libssh2@1.10.0-3	no fix listed	1
tinymediamanager/tinymediamanager :5.3.2	2b34dc85099e	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
tombursch/kitchenowl-backend :v0.7.8	b48e4ab727cd	libssh2@1.11.1-1	1.11.1-1+deb13u2	1