GHSA-6q48-6c7w-9gw2
CriticalAdvisory
Published 20 Oct 2026In the index since 21 Oct 2026
- Severity
- Critical
- worst across findings
- CVSS
- 9.1
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 1,303
- of 18,219 indexed, latest versions
- Container images
- 1,173
- deployed by those charts
- Fix available
- 1 of 1
- affected package
certifi bundles emSign root CAs with compromised intermediate CA keys
Carried by container images the latest versions of 1,303 of 18,219 indexed charts deploy, on 1,173 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| certifipypi | 2019.3.9, 2019.6.16, 2019.9.11, 2019.11.28+37 more | 2026.10.19 | 1,173 |
- OSV records
- GHSA-6q48-6c7w-9gw2
- Also known as
- PYSEC-2026-4320
- Trending
- Rank 2 in indexed charts, since 21 Oct 2026. See the ranking →
Charts affected
1,303 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| locusthelm-charts-nr | 0.32.4 | 1 of 1See more | 3,069 |
| mlflowhelm-charts-nr | 1.0.10 | 1 of 1See more | 5,106 |
| newrelic-controllerhelm-charts-nr | 1.2.0 | 1 of 1See more | 951 |
| postgres-controllerhelm-charts-nr | 1.4.0 | 1 of 1See more | 978 |
| supersethelm-charts-nr | 1.1.3 | 1 of 1See more | 2,920 |
| weblatehelm-charts-nr | 0.3.2 | 1 of 3See more | 11,000 |
| dbapphelmcourseVerified publisher | 0.3.3 | 1 of 2See more | 4,924 |
| mysqlhelmcourseVerified publisher | 0.2.4 | 1 of 1See more | 2,408 |
| chart-bookhelm-deploy-book | 0.1.0 | 1 of 3See more | 10,698 |
| appwritehelmforgeVerified publisher | 2.0.7 | 1 of 5See more | 4,422 |
| archiveboxhelmforgeVerified publisher | 1.1.15 | 1 of 1See more | 6,233 |
| changedetectionhelmforgeVerified publisher | 1.1.20 | 1 of 1See more | 2,534 |
| chiefonboardinghelmforgeVerified publisher | 1.1.17 | 1 of 3See more | 8,842 |
| ckanhelmforgeVerified publisher | 1.3.13 | 2 of 6See more | 11,620 |
| countlyhelmforgeVerified publisher | 1.2.10 | 1 of 3See more | 74,720 |
| discount-bandithelmforgeVerified publisher | 2.0.12 | 1 of 3See more | 36,744 |
| drupalhelmforgeVerified publisher | 1.2.18 | 1 of 2See more | 4,078 |
| fastmcp-serverhelmforgeVerified publisher | 1.7.5 | 1 of 1See more | 3,941 |
| ghosthelmforgeVerified publisher | 1.2.13 | 1 of 3See more | 2,861 |
| hermes-agenthelmforgeVerified publisher | 1.0.2 | 1 of 1See more | 7,193 |
| immichhelmforgeVerified publisher | 1.2.13 | 1 of 5See more | 12,994 |
| jupyterhubhelmforgeVerified publisher | 1.0.7 | 1 of 3See more | 6,193 |
| langflowhelmforgeVerified publisher | 2.0.4 | 1 of 1See more | 331 |
| mcp-serverhelmforgeVerified publisher | 1.0.0 | 1 of 1See more | 4,078 |
| medikeephelmforgeVerified publisher | 2.0.5 | 1 of 3See more | 6,443 |
| mysqlhelmforgeVerified publisher | 2.1.1 | 1 of 1See more | 824 |
| netboxhelmforgeVerified publisher | 2.0.5 | 1 of 4See more | 5,190 |
| olivetinhelmforgeVerified publisher | 1.2.3 | 1 of 2See more | 789 |
| openreplayhelmforgeVerified publisher | 1.1.1 | 2 of 24See more | 15,737 |
| paperless-ngxhelmforgeVerified publisher | 1.1.1 | 1 of 4See more | 7,978 |
| supersethelmforgeVerified publisher | 1.4.2 | 1 of 5See more | 6,746 |
| webodmhelmforgeVerified publisher | 1.1.2 | 1 of 4See more | 13,061 |
| openaevhelm-openbasVerified publisher | 2.0.15 | 1 of 7See more | 21,633 |
| openbashelm-openbasVerified publisher | 1.8.14 | 1 of 7See more | 26,468 |
| pageshelm-repo | 1.0.0 | 1 of 3See more | 21,723 |
| hetzner-s3-operatorhetzner-s3-operatorVerified publisher | 0.1.3 | 1 of 1See more | 851 |
| nominatimheywood8-helm-chartsVerified publisher | 3.10.8 | 1 of 3See more | 15,674 |
| changedetectionhomeenterpriseinc | 0.2.0 | 1 of 2See more | 2,361 |
| homeassistanthomeenterpriseinc | 0.3.0 | 1 of 1See more | 9,324 |
| home-ha-mockhome-ha-mockVerified publisher | 2.0.5 | 1 of 1See more | 3,359 |
| paperlesshomelabcihelmchartstestVerified publisher | 9.1.9 | 1 of 1See more | 18,793 |
| home-security-demohome-security-demoVerified publisher | 2.0.12 | 1 of 3See more | 3,441 |
| paperlesshpVerified publisher | 0.1.2 | 1 of 5See more | 36,022 |
| httpbin2022httpbin2022Verified publisher | 0.1.1 | 1 of 1See more | 75,424 |
| activation-servicei4trustVerified publisher | 2.3.1 | 1 of 1See more | 2,167 |
| ibexaibexaVerified publisher | 3.11.1 | 1 of 10See more | 7,884 |
| monitoring-stackict-platformVerified publisher | 0.4.0 | 1 of 13See more | 15,026 |
| bluesky-pdsijmacd | 1.0.0 | 1 of 2See more | 10,494 |
| ikigaiikigai-chartVerified publisher | 0.0.9 | 1 of 58See more | 116,898 |
| ilum-apiilumVerified publisher | 6.7.3 | 1 of 1See more | 3,323 |
Container images carrying it
1,173 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 42135965c42d | certifi | 2026.10.19 | 1 |
| ghcr.io/ | cf9b41e17b93 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 22ae556e0de4 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 4a981156abee | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 186a24030e82 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 776a845d5089 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 78a82d810709 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | e636269c6390 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 84d09c6b75a7 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 7b9bba80f207 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 088412db1051 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 7962759d99d7 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | ab535d1fef5d | certifi | 2026.10.19 | 1 |
| ghcr.io/ | f104ee51e512 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 6acb4a5903eb | certifi | 2026.10.19 | 1 |
| ghcr.io/ | c4744059419a | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 7c5052aa4e3c | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 10f8d164109b | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 18fa568c0ceb | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 6989516e4943 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 46a71d75dfd3 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | ab9b4e8cc4ab | certifi | 2026.10.19 | 1 |
| ghcr.io/ | d6e901ad0ebd | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 06a16d4f279f | certifi | 2026.10.19 | 1 |
| ghcr.io/ | f77fa53b89cb | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 3fbe4c29d14c | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 39d48995a5bd | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 0e091dfce306 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 130241f28d01 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 26c51e44d932 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 9a5a3eb4a213 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | a1bc133af84e | certifi | 2026.10.19 | 1 |
| ghcr.io/ | ec6d67fbedfa | certifi | 2026.10.19 | 1 |
| ghcr.io/ | feffc0b8227d | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 17dc1cff22e9 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 80cb090162b4 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | cc4975f1a0be | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 067e54e2e107 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 10d271f08ab3 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | cd25a5cc3f1b | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 31030fd2f192 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 3009350bfc11 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 1ab8674e7cec | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 6d4106724d56 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 601082677a46 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 3cceb9462ae1 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | ec4b8534ded6 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | 1ca2e4c6a248 | certifi | 2026.10.19 | 1 |
| ghcr.io/ | e5571acd10ce | certifi | 2026.10.19 | 1 |
| ghcr.io/ | c2d6e775db5a | certifi | 2026.10.19 | 1 |