GHSA-6q48-6c7w-9gw2
CriticalAdvisory
Published 20 Oct 2026In the index since 21 Oct 2026
- Severity
- Critical
- worst across findings
- CVSS
- 9.1
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 1,311
- of 18,219 indexed, latest versions
- Container images
- 1,178
- deployed by those charts
- Fix available
- 1 of 1
- affected package
certifi bundles emSign root CAs with compromised intermediate CA keys
Carried by container images the latest versions of 1,311 of 18,219 indexed charts deploy, on 1,178 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| certifipypi | 2019.3.9, 2019.6.16, 2019.9.11, 2019.11.28+37 more | 2026.10.19 | 1,178 |
- OSV records
- GHSA-6q48-6c7w-9gw2
- Also known as
- PYSEC-2026-4320
- Trending
- Rank 2 in indexed charts, since 21 Oct 2026. See the ranking →
Charts affected
1,311 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| helixhelix | 1.4.3 | 1 of 2See more | 6,279 |
| pageshelm-chart-repos-camden | 1.0.0 | 1 of 3See more | 21,723 |
| esphomehelm-chart-roeiVerified publisher | 2025.3.0 | 1 of 1See more | 6,613 |
| home-assistanthelm-chart-roeiVerified publisher | 2025.3.0 | 1 of 1See more | 6,238 |
| kube-downscalerhelm-charts-nr | 0.7.6 | 1 of 1See more | 4,662 |
| locusthelm-charts-nr | 0.32.4 | 1 of 1See more | 3,069 |
| mlflowhelm-charts-nr | 1.0.10 | 1 of 1See more | 5,106 |
| newrelic-controllerhelm-charts-nr | 1.2.0 | 1 of 1See more | 951 |
| postgres-controllerhelm-charts-nr | 1.4.0 | 1 of 1See more | 978 |
| supersethelm-charts-nr | 1.1.3 | 1 of 1See more | 2,920 |
| weblatehelm-charts-nr | 0.3.2 | 1 of 3See more | 11,000 |
| dbapphelmcourseVerified publisher | 0.3.3 | 1 of 2See more | 4,924 |
| mysqlhelmcourseVerified publisher | 0.2.4 | 1 of 1See more | 2,408 |
| chart-bookhelm-deploy-book | 0.1.0 | 1 of 3See more | 10,698 |
| appwritehelmforgeVerified publisher | 2.0.7 | 1 of 5See more | 4,422 |
| archiveboxhelmforgeVerified publisher | 1.1.15 | 1 of 1See more | 6,233 |
| changedetectionhelmforgeVerified publisher | 1.1.20 | 1 of 1See more | 2,534 |
| chiefonboardinghelmforgeVerified publisher | 1.1.17 | 1 of 3See more | 8,842 |
| ckanhelmforgeVerified publisher | 1.3.13 | 2 of 6See more | 11,620 |
| countlyhelmforgeVerified publisher | 1.2.10 | 1 of 3See more | 74,720 |
| discount-bandithelmforgeVerified publisher | 2.0.12 | 1 of 3See more | 36,744 |
| drupalhelmforgeVerified publisher | 1.2.18 | 1 of 2See more | 4,078 |
| fastmcp-serverhelmforgeVerified publisher | 1.7.5 | 1 of 1See more | 3,941 |
| ghosthelmforgeVerified publisher | 1.2.13 | 1 of 3See more | 2,861 |
| hermes-agenthelmforgeVerified publisher | 1.0.2 | 1 of 1See more | 7,193 |
| immichhelmforgeVerified publisher | 1.2.13 | 1 of 5See more | 12,994 |
| jupyterhubhelmforgeVerified publisher | 1.0.7 | 1 of 3See more | 6,193 |
| langflowhelmforgeVerified publisher | 2.0.4 | 1 of 1See more | 331 |
| mcp-serverhelmforgeVerified publisher | 1.0.0 | 1 of 1See more | 4,078 |
| medikeephelmforgeVerified publisher | 2.0.5 | 1 of 3See more | 6,443 |
| mysqlhelmforgeVerified publisher | 2.1.1 | 1 of 1See more | 824 |
| netboxhelmforgeVerified publisher | 2.0.5 | 1 of 4See more | 5,190 |
| olivetinhelmforgeVerified publisher | 1.2.3 | 1 of 2See more | 789 |
| openreplayhelmforgeVerified publisher | 1.1.1 | 2 of 24See more | 15,737 |
| paperless-ngxhelmforgeVerified publisher | 1.1.1 | 1 of 4See more | 7,978 |
| supersethelmforgeVerified publisher | 1.4.2 | 1 of 5See more | 6,746 |
| webodmhelmforgeVerified publisher | 1.1.2 | 1 of 4See more | 13,061 |
| openaevhelm-openbasVerified publisher | 2.0.15 | 1 of 7See more | 21,633 |
| openbashelm-openbasVerified publisher | 1.8.14 | 1 of 7See more | 26,468 |
| pageshelm-repo | 1.0.0 | 1 of 3See more | 21,723 |
| hetzner-s3-operatorhetzner-s3-operatorVerified publisher | 0.1.3 | 1 of 1See more | 851 |
| nominatimheywood8-helm-chartsVerified publisher | 3.10.8 | 1 of 3See more | 15,674 |
| changedetectionhomeenterpriseinc | 0.2.0 | 1 of 2See more | 2,361 |
| homeassistanthomeenterpriseinc | 0.3.0 | 1 of 1See more | 9,324 |
| home-ha-mockhome-ha-mockVerified publisher | 2.0.5 | 1 of 1See more | 3,359 |
| paperlesshomelabcihelmchartstestVerified publisher | 9.1.9 | 1 of 1See more | 18,793 |
| home-security-demohome-security-demoVerified publisher | 2.0.12 | 1 of 3See more | 3,441 |
| paperlesshpVerified publisher | 0.1.2 | 1 of 5See more | 36,022 |
| httpbin2022httpbin2022Verified publisher | 0.1.1 | 1 of 1See more | 75,424 |
| activation-servicei4trustVerified publisher | 2.3.1 | 1 of 1See more | 2,167 |
Container images carrying it
1,178 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| thijsvanloef/ | 401d3eb5c053 | certifi | 2026.10.19 | 1 |
| thijsvanloef/ | b4ac9ee22483 | certifi | 2026.10.19 | 1 |
| thongngo3301/ | a341af5976e3 | certifi | 2026.10.19 | 1 |
| timescale/ | 9c6c86701e9b | certifi | 2026.10.19 | 1 |
| timescale/ | a8e3322e1cf9 | certifi | 2026.10.19 | 1 |
| timescale/ | cdb9ae118899 | certifi | 2026.10.19 | 1 |
| timescale/ | e8d0a9cc3db5 | certifi | 2026.10.19 | 1 |
| timescale/ | ed719c0cd19d | certifi | 2026.10.19 | 1 |
| tinymediamanager/ | 48c15784a127 | certifi | 2026.10.19 | 1 |
| tock/ | abf7880e0449 | certifi | 2026.10.19 | 1 |
| tombursch/ | 4a7ed693531b | certifi | 2026.10.19 | 1 |
| tomsajan/ | fb61907707b8 | certifi | 2026.10.19 | 1 |
| tomsquest/ | 4759cc353a1d | certifi | 2026.10.19 | 1 |
| tomsquest/ | a594c624c5a6 | certifi | 2026.10.19 | 1 |
| toniblyx/ | 9dbcc3c9abd7 | certifi | 2026.10.19 | 1 |
| trackerforce/ | 410e58e54e09 | certifi | 2026.10.19 | 1 |
| treskon/ | 694c098bcb52 | certifi | 2026.10.19 | 1 |
| treskon/ | a475d80e4ecf | certifi | 2026.10.19 | 1 |
| truebyteinnovationllp/ | 6bf978b96279 | certifi | 2026.10.19 | 1 |
| tussanakorndev/ | 216fdadadf9a | certifi | 2026.10.19 | 1 |
| twentycrm/ | 2f78405a78be | certifi | 2026.10.19 | 1 |
| tykling/ | cd6d650c01c1 | certifi | 2026.10.19 | 1 |
| ubcctlt/ | cbbbbc8ae16b | certifi | 2026.10.19 | 1 |
| upstreamyard/ | 9f673183cfc0 | certifi | 2026.10.19 | 1 |
| vabene1111/ | 0f8d061895e9 | certifi | 2026.10.19 | 1 |
| vabene1111/ | ec4e9e2905b0 | certifi | 2026.10.19 | 1 |
| viadee/ | 2e27e3b3ee56 | certifi | 2026.10.19 | 1 |
| voltha/ | 655c3048a602 | certifi | 2026.10.19 | 1 |
| voska/ | 7142a431e2c5 | certifi | 2026.10.19 | 1 |
| wallarm/ | 6fd795878804 | certifi | 2026.10.19 | 1 |
| wallarm/ | 097cadc42336 | certifi | 2026.10.19 | 1 |
| wallarm/ | aecd88b24c51 | certifi | 2026.10.19 | 1 |
| wazuh/ | 1da5c38c6a78 | certifi | 2026.10.19 | 1 |
| wazuh/ | 21994f40e0da | certifi | 2026.10.19 | 1 |
| wazuh/ | 5a065930682d | certifi | 2026.10.19 | 1 |
| wazuh/ | f09282d281f6 | certifi | 2026.10.19 | 1 |
| weblate/ | 82848df56ecd | certifi | 2026.10.19 | 1 |
| wger/ | 1c5789b93bfe | certifi | 2026.10.19 | 1 |
| wiktorn/ | 9bb5f4a9b54c | certifi | 2026.10.19 | 1 |
| witcherek7/ | 42a744f29ac0 | certifi | 2026.10.19 | 1 |
| ybucci/ | cc22a16fac81 | certifi | 2026.10.19 | 1 |
| ybucci/ | f1fcc7c8d9fd | certifi | 2026.10.19 | 1 |
| yetiplatform/ | 8673609841e3 | certifi | 2026.10.19 | 1 |
| yetiplatform/ | 9bcbe2650a14 | certifi | 2026.10.19 | 1 |
| ygqygq2/ | 54f30def1558 | certifi | 2026.10.19 | 1 |
| youssef11gaber10/ | 96bce8b8b5a7 | certifi | 2026.10.19 | 1 |
| zenmldocker/ | d0e11680b5b4 | certifi | 2026.10.19 | 1 |
| zenmldocker/ | 6a03880ace49 | certifi | 2026.10.19 | 1 |
| zepai/ | 6ab0ee79926b | certifi | 2026.10.19 | 1 |
| zohardocker12/ | b86d60dbb68d | certifi | 2026.10.19 | 1 |