CVE-2026-66035

High

Advisory

Published 24 Jul 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.7; base score, highest
EPSS: 0.005; 39th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 454; of 17,781 indexed, latest versions
Container images: 292; deployed by those charts
Fix available: 1 of 1; affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 454 of 17,781 indexed charts deploy, on 292 images.

Affected package	Affected versions	Fixed in	Images
libssh2deb	1.5.0-2ubuntu0.1, 1.8.0-2.1build1, 1.10.0-3, 1.11.0-4.1build2+9 more	1.11.0-4.1ubuntu0.24.04.4, 1.11.1-1+deb13u2, 1.11.1-1+e5, 1.11.1-1ubuntu0.26.04.4	292

OSV records: DEBIAN-CVE-2026-66035 UBUNTU-CVE-2026-66035 ECHO-a13b-3527-8590
Also known as: USN-8722-1

Charts affected

454 by stars

Chart

Latest

Affected images

Radar Score

Wordpresswordpress-mariadb

1.0.2

1 of 2 See more

Wordpress wordpress-mariadb 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-66035.

Container image	Digest	Package	Fixed in
library/wordpress :latest	5a93c470ae82	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2

Open the chart page →

5,560

nginx-chartxxoznge-nginx

0.1.0

1 of 1 See more

nginx-chart xxoznge-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-66035.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2

Open the chart page →

1,827

my-nginx-appyasser-nginx-app

0.1.0

1 of 1 See more

my-nginx-app yasser-nginx-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-66035.

Container image	Digest	Package	Fixed in
library/nginx :stable	d5792f71a949	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2

Open the chart page →

1,827

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-66035.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2

Open the chart page →

1,827

Container images carrying it

292 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
library/nginx :1.31 :1.31.5 :latest :trixie	05b8cb60c354	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	106
library/nginx :stable	d5792f71a949	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	23
jenkins/jenkins :2.568.3-jdk21 :2.568.3-lts-jdk21 :lts	c1e4c349365f	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	13
jellyfin/jellyfin :10.11 :10.11.11 :latest	aefb67e6a7ff	libssh2@1.11.1-1	1.11.1-1+deb13u2	7
library/phpmyadmin :5.2.3-apache :latest	3a8a8d6b5289	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	7
vaultwarden/server :1.37.2 :latest	094b5689ed81	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	7
ghcr.io/paperless-ngx/paperless-ngx :3.1.3	aa810a36942c	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	7
library/wordpress :7.1.0-apache :latest	5a93c470ae82	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	6
library/httpd :2.4 :2.4.68 :latest	979c38c2228d	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	5
ghcr.io/linuxserver/plex :latest	7f9a1d574958	libssh2@1.11.1-1ubuntu0.26.04.3	1.11.1-1ubuntu0.26.04.4	4
fluent/fluent-bit :5.1.2 :latest	d792375ca8e5	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	3
localstack/localstack-pro :latest	4aef81c53168	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	3
omecproject/cdn-video-repo :1.0.0 :remote-v3	d59ccb138ffb	libssh2@1.5.0-2ubuntu0.1	no fix listed	3
vaultwarden/server :1.37.1	ebdfe70701c6	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	3
quay.io/argoproj/argocd :v3.5.2	e2aadfae709d	libssh2@1.11.1-1ubuntu0.26.04.3	1.11.1-1ubuntu0.26.04.4	3
cagriekin/pg-ha :2.0.1-pg18	99e17aa165df	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	2
fireflyiii/core :version-6.5.9	fe4ecec4c2ba	libssh2@1.11.1-1	1.11.1-1+deb13u2	2
fireflyiii/data-importer :version-2.2.3	ab52bf932546	libssh2@1.11.1-1	1.11.1-1+deb13u2	2
gotenberg/gotenberg :8.36.0	87c16b9f3642	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	2
gotenberg/gotenberg :8 :8.37.0	f29984bd1e22	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	2
gotson/komga :1.26.3	6c2a967bbe9a	libssh2@1.11.1-1ubuntu0.26.04.3	1.11.1-1ubuntu0.26.04.4	2
graviteeio/apim-gateway :4.12.19-debian	05fd67a93056	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	2
graviteeio/apim-management-api :4.12.19-debian	27374522cd04	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	2
infisical/infisical :latest :v0.165.6	02082bf13163	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	2
jenkins/jenkins :2.541.3-jdk21	c4098086090c	libssh2@1.11.1-1	1.11.1-1+deb13u2	2
library/buildpack-deps :curl	04907bdd423b	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	2
library/nextcloud :34.0.3 :34.0.3-apache	b97df9e0e1ee	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	2
library/nginx :latest	6e23479198b9	libssh2@1.11.1-1	1.11.1-1+deb13u2	2
library/nginx :1.29.4	9dd288848f44	libssh2@1.11.1-1	1.11.1-1+deb13u2	2
library/redmine :6.1.3-trixie	f474a901faec	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	2
library/wordpress :6.8.3-apache :6.8-apache	30bff39330d1	libssh2@1.11.1-1	1.11.1-1+deb13u2	2
nacos/nacos-server :latest	1c191c30c8cd	libssh2@1.11.1-1ubuntu0.26.04.3	1.11.1-1ubuntu0.26.04.4	2
nginxinc/nginx-unprivileged :stable	cb92301e719d	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	2
polyaxon/polyaxon-agent :2.16.4	eca6952b20e6	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	2
polyaxon/polyaxon-cli :2.16.4	024ff3fa775e	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	2
ghcr.io/bryopsida/k8s-dev-pod :main	82d0b161161d	libssh2@1.11.0-4.1build2	1.11.0-4.1ubuntu0.24.04.4	2
aapjeisbaas/wp-frankenphp :v0.2.2	6b261abc7fb0	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
adamzammit/limesurvey :7.0.15	e75e2f455c8d	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
agentarea/agentarea-api :latest	9e15e16fa758	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1
aktosecurity/akto-threat-detection-backend :latest	15ebb75b94dc	libssh2@1.11.1-1ubuntu0.26.04.3	1.11.1-1ubuntu0.26.04.4	1
aktosecurity/akto-threat-detection-backend :1.15.7	a6c1b933517f	libssh2@1.11.1-1ubuntu0.26.04.3	1.11.1-1ubuntu0.26.04.4	1
aktosecurity/data-ingestion-service :1.4.9	46ed5bcb04b2	libssh2@1.11.1-1ubuntu0.26.04.2	1.11.1-1ubuntu0.26.04.4	1
aktosecurity/data-ingestion-service :1.5.3	5d4eab1c36b9	libssh2@1.11.1-1ubuntu0.26.04.2	1.11.1-1ubuntu0.26.04.4	1
aktosecurity/mini-runtime :1.72.15	498e3e35ecc2	libssh2@1.11.1-1ubuntu0.26.04.3	1.11.1-1ubuntu0.26.04.4	1
antrea/antrea-ui-frontend :v0.8.0	ee9686bcefb8	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
apache/camel-k :2.11.0	d173e7efe258	libssh2@1.11.1-1ubuntu0.26.04.3	1.11.1-1ubuntu0.26.04.4	1
apache/tika :latest-full	80072bb73dd3	libssh2@1.11.1-1ubuntu0.26.04.3	1.11.1-1ubuntu0.26.04.4	1
apecloud/aperag :v0.0.0-nightly	8ac9947a2c84	libssh2@1.11.1-1	1.11.1-1+deb13u2	1
arunvelsriram/utils :latest	655ad18fd8d6	libssh2@1.11.0-4.1build2	1.11.0-4.1ubuntu0.24.04.4	1
baserow/backend :2.3.3	7c00549b3a6f	libssh2@1.11.1-1+deb13u1	1.11.1-1+deb13u2	1