Detections
Analytics

Chainguard: openstack-rally-2026.1: security update to 4.1.0-r5

high Tenable Self-Hosted Container Security Plugin ID 476709

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's
 ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when
 generating POSIX console scripts. When the path contains a space or produces a shebang longer than 127
 bytes, distlib emits a /bin/sh wrapper whose double-quoted interpreter path still expands command
 substitutions and backticks. An attacker who influences the environment destination can therefore execute
 commands with the user's privileges when the user later runs a generated launcher; environment creation
 and activation do not trigger the command. Existing launchers are not repaired by upgrading virtualenv
 alone and must be regenerated, while a later independent pip installation or upgrade can reintroduce an
 affected launcher because pip's vendored distlib is unchanged. The virtualenv fix is released in version
 21.14.9. (CVE-2026-113722)

Solution

Update the openstack-rally-2026.1 library and its related packages to version 4.1.0-r5 or later.

Plugin Details

Severity: High

ID: 476709

Version: Revision 1.1

Type: Local

Published: 10/22/2026

Updated: 10/22/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.6

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-113722

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/20/2026

Reference Information

CVE: CVE-2026-113722