CVE-2026-66035

High

Advisory

Published 24 Jul 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.7; base score, highest
EPSS: 0.005; 39th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 454; of 17,781 indexed, latest versions
Container images: 292; deployed by those charts
Fix available: 1 of 1; affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 454 of 17,781 indexed charts deploy, on 292 images.

Affected package	Affected versions	Fixed in	Images
libssh2deb	1.5.0-2ubuntu0.1, 1.8.0-2.1build1, 1.10.0-3, 1.11.0-4.1build2+9 more	1.11.0-4.1ubuntu0.24.04.4, 1.11.1-1+deb13u2, 1.11.1-1+e5, 1.11.1-1ubuntu0.26.04.4	292

OSV records: DEBIAN-CVE-2026-66035 UBUNTU-CVE-2026-66035 ECHO-a13b-3527-8590
Also known as: USN-8722-1

Charts affected

454 by stars

Chart

Latest

Affected images

Radar Score

Wordpresswordpress-mariadb

1.0.2

1 of 2 See more

Wordpress wordpress-mariadb 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-66035.

Container image	Digest	Package	Fixed in
library/wordpress :latest	5a93c470ae82	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2

Open the chart page →

5,560

nginx-chartxxoznge-nginx

0.1.0

1 of 1 See more

nginx-chart xxoznge-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-66035.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2

Open the chart page →

1,827

my-nginx-appyasser-nginx-app

0.1.0

1 of 1 See more

my-nginx-app yasser-nginx-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-66035.

Container image	Digest	Package	Fixed in
library/nginx :stable	d5792f71a949	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2

Open the chart page →

1,827

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-66035.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2

Open the chart page →

1,827

Container images carrying it

292 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
treskon/portrait :DEV-latest	88e813f22347	libssh2@1.11.1-1ubuntu0.26.04.3	1.11.1-1ubuntu0.26.04.4	1
vaultwarden/server :1.35.4	43498a94b22f	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
vaultwarden/server :1.35.7	9a8eec71f4a5	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
wallarm/aih-scanner :2.7.11	f1cb26db1f5b	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
wallarm/gateway-controller :0.4.0	9c6ed23e2f0e	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
ybucci/traefik-external-dns-controller :2.2.0	8d27ad8b5f73	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
yetiplatform/yeti :2.9.0	9bcbe2650a14	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
yetiplatform/yeti :latest	9c3006cedcca	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
yetiplatform/yeti-frontend :latest	709064278c7e	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
yetiplatform/yeti-frontend :2.9.0	873ef15d267b	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
zabbix/zabbix-server-mysql :ubuntu-6.4-latest	55d074b6b031	libssh2@1.11.0-4.1build2	1.11.0-4.1ubuntu0.24.04.4	1
zabbix/zabbix-server-pgsql :ubuntu-7.0.23	7e8c8e059533	libssh2@1.11.0-4.1build2	1.11.0-4.1ubuntu0.24.04.4	1
ghcr.io/aeharding/voyager :latest	779759172676	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
ghcr.io/analogj/scrutiny :v0.9.2-web	71be54e99608	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
ghcr.io/appscode/gotenberg :8.25	f9104080d9a7	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
ghcr.io/cjmalloy/jasper-ui :v1.3.623	246dc2160efe	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
ghcr.io/cohdi/composable-dra-driver :v0.2.2	8c05f7366981	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
ghcr.io/cosmo-tech/cosmotech-copilot-api :latest	a2be95de450c	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
ghcr.io/dakera-ai/dakera :0.11.101	af610992a416	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
ghcr.io/damap-org/damap-frontend :5.0.1	609f48af4efc	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
ghcr.io/dani-garcia/vaultwarden :1.35.2	d89a6d21e361	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
ghcr.io/dask/dask-kubernetes-operator :2026.3.0	3225d2bc6b3c	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
ghcr.io/deltabadger/deltabadger :2.23.3	bffe3c22fabc	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
ghcr.io/developmentseed/titiler :latest	0f31f8b0441b	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
ghcr.io/deven96/ahnlich-db :latest	45d8b5aab491	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
ghcr.io/dfir-iris/iriswebapp_app :v2.4.26	e59ebde55709	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
ghcr.io/ding113/claude-code-hub :latest	87f9e8a92bd7	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
ghcr.io/ente/web :5ab0c5b4c7a89c4e470ef6f793600da33cebf35d	3f4864eb7f11	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
ghcr.io/esphome/esphome :latest	000c5ee5ee96	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
ghcr.io/feresberbeche/alertigate :1.2.1	628d49e0e01b	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
ghcr.io/fluent/fluentd-aggregator-docker-image :2.1.0	ad25916eebbb	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
ghcr.io/getsentry/snuba :26.7.2	10f8d164109b	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
ghcr.io/goauthentik/server :2026.2.1	46a71d75dfd3	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
ghcr.io/goauthentik/server :2026.5.6	ed120caf710c	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
ghcr.io/goauthentik/server :2026.8.2	ff8489a5af4f	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
ghcr.io/htunn/ansible-inspec :0.2.12	cd25a5cc3f1b	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
ghcr.io/immich-app/immich-server :v3.2.0	ae13784ffcfc	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
ghcr.io/immich-app/immich-server :v3.1.0	b434cb9287ee	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
ghcr.io/immich-app/immich-server :v2.3.1	f8d06a32b1b2	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
ghcr.io/jellyfin/jellyfin :10.11.11	45f648c382a0	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
ghcr.io/k8s-at-home/xteve :v2.2.0.200	292b3614670f	libssh2@1.8.0-2.1build1	no fix listed	1
ghcr.io/kubelauncher/kubectl	7280594a2f18	libssh2@1.11.1-1ubuntu0.26.04.3	1.11.1-1ubuntu0.26.04.4	1
ghcr.io/kubelauncher/mongodb	9bc37ed78a8b	libssh2@1.11.1-1ubuntu0.26.04.3	1.11.1-1ubuntu0.26.04.4	1
ghcr.io/kubiyabot/agent-manager :v0.4.13	757bdd779345	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
ghcr.io/libretime/icecast :latest	3c98b92e9535	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
ghcr.io/lloesche/valheim-server :latest	20fde516ce31	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
ghcr.io/matter-js/matterjs-server :1.4.0	54232d0d3e7d	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
ghcr.io/mcwarman/backstage-sample-app/app :main	fae3c1f04311	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
ghcr.io/mealie-recipes/mealie :v3.24.0	0b08ac3a9f0a	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
ghcr.io/mealie-recipes/mealie :v3.25.1	6066c29eca95	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1