StackRadarChart IndexLive demo

CVE-2025-24358

Medium

Advisory

Published 14 Apr 2025In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.0; base score, highest
EPSS: 0.004; 30th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 21; of 17,781 indexed, latest versions
Container images: 19; deployed by those charts
Fix available: 1 of 1; affected package

gorilla/csrf CSRF vulnerability due to broken Referer validation

Carried by container images the latest versions of 21 of 17,781 indexed charts deploy, on 19 images.

Affected package	Affected versions	Fixed in	Images
github.com/gorilla/csrfgolang	v1.6.2, v1.7.0, v1.7.1, v1.7.2+1 more	1.7.3	19

OSV records: GHSA-rq77-p4h8-4crw
Also known as: GO-2025-3607

Charts affected

21 by stars

Chart

Latest

Affected images

Radar Score

harborharbor

1 of 8 See more

harbor harbor 1.19.2

1 of the 8 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
goharbor/harbor-core :v2.15.2	d7b780d23721	github.com/gorilla/csrf@v1.7.2	1.7.3

Open the chart page →

1,650

headscalegabe565

1 of 2 See more

headscale gabe565 0.16.0

1 of the 2 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
ghcr.io/juanfont/headscale :v0.25.0	97febecbe6cb	github.com/gorilla/csrf@v1.7.3-0.20250123201450-9dd6af1f6d30	1.7.3

Open the chart page →

1,979

tailscale-relaymvisonneau

1 of 1 See more

tailscale-relay mvisonneau 0.2.7

1 of the 1 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
mvisonneau/tailscale :v1.68.1	fc45ad8abf10	github.com/gorilla/csrf@v1.7.2	1.7.3

Open the chart page →

1,356

headplanenbcloud

1 of 4 See more

headplane nbcloud 0.1.2

1 of the 4 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
headscale/headscale :0.25.1	a7a8ae9616bb	github.com/gorilla/csrf@v1.7.3-0.20250123201450-9dd6af1f6d30	1.7.3

Open the chart page →

7,949

beaconchain-explorerethereum-helm-charts

1 of 2 See more

beaconchain-explorer ethereum-helm-charts 0.1.6

1 of the 2 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
gobitfly/eth2-beaconchain-explorer :latest	1d08a7986348	github.com/gorilla/csrf@v1.7.0	1.7.3

Open the chart page →

3,048

artifact-hubsoftonic

1 of 8 See more

artifact-hub softonic 1.19.0

1 of the 8 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
artifacthub/hub :v1.19.0	111918d8c399	github.com/gorilla/csrf@v1.7.2	1.7.3

Open the chart page →

14,491

cortezacorteza

1 of 3 See more

corteza corteza 1.0.12

1 of the 3 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
cortezaproject/corteza :2024.9.4	cb9f200de5d2	github.com/gorilla/csrf@v1.7.1	1.7.3

Open the chart page →

8,368

corteza-all-in-onecorteza

1 of 2 See more

corteza-all-in-one corteza 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
cortezaproject/corteza :2024.9.0	8eb7a26605c9	github.com/gorilla/csrf@v1.7.1	1.7.3

Open the chart page →

4,644

admin-console-operatorepmdedp

1 of 2 See more

admin-console-operator epmdedp 2.14.0

1 of the 2 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
epamedp/edp-admin-console :2.14.0	616c678ba3e7	github.com/gorilla/csrf@v1.7.1	1.7.3

Open the chart page →

4,308

harborgpg-dev

1 of 8 See more

harbor gpg-dev 1.18.3

1 of the 8 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
goharbor/harbor-core :v2.14.3	a30e5a8be3d9	github.com/gorilla/csrf@v1.7.2	1.7.3

Open the chart page →

3,376

gophishhelmforge

1 of 1 See more

gophish helmforge 0.1.5

1 of the 1 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
gophish/gophish :0.12.1	8a57cd171999	github.com/gorilla/csrf@v1.6.2	1.7.3

Open the chart page →

2,819

harborhelm-harbor

1 of 8 See more

harbor helm-harbor 2.3.5

1 of the 8 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
goharbor/harbor-core :v2.15.2	d7b780d23721	github.com/gorilla/csrf@v1.7.2	1.7.3

Open the chart page →

1,650

sing-boxhuscker-charts

1 of 1 See more

sing-box huscker-charts 1.0.7

1 of the 1 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
ghcr.io/sagernet/sing-box :v1.12.0	3c1ee82d450d	github.com/gorilla/csrf@v1.7.3-0.20250123201450-9dd6af1f6d30	1.7.3

Open the chart page →

1,443

harborkubesphere

1 of 11 See more

harbor kubesphere 1.9.3

1 of the 11 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
goharbor/harbor-core :v2.5.3	86bf3031f4a7	github.com/gorilla/csrf@v1.6.2	1.7.3

Open the chart page →

17,798

0.0.0-ci.4-do-not-use

1 of 1 See more

devpod-pro loft 0.0.0-ci.4-do-not-use

1 of the 1 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/devpod-pro :0.0.0-ci.4-do-not-use	5dfa86b6451f	github.com/gorilla/csrf@v1.7.2	1.7.3

Open the chart page →

3,225

vcluster-control-planeloft

0.0.0-ci.4-do-not-use

1 of 1 See more

vcluster-control-plane loft 0.0.0-ci.4-do-not-use

1 of the 1 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/vcluster-control-plane :0.0.0-ci.4-do-not-use	45e744fc623f	github.com/gorilla/csrf@v1.7.2	1.7.3

Open the chart page →

3,225

harborsb-helm-charts

1 of 2 See more

harbor sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
goharbor/harbor-core :v2.11.1	c017dd84ee96	github.com/gorilla/csrf@v1.7.2	1.7.3

Open the chart page →

1,680

cortezasergiotocalini

1 of 1 See more

corteza sergiotocalini 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
cortezaproject/corteza :2024.9.6	0bcdcbcd3c63	github.com/gorilla/csrf@v1.7.1	1.7.3

Open the chart page →

3,286

tailscale-operatorskyloud-helm-charts

1 of 1 See more

tailscale-operator skyloud-helm-charts 1.70.3

1 of the 1 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
tailscale/k8s-operator :v1.70.0	8edd06cf5bac	github.com/gorilla/csrf@v1.7.2	1.7.3

Open the chart page →

1,045

harborsoftonic

1 of 8 See more

harbor softonic 1.13.0

1 of the 8 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
goharbor/harbor-core :v2.9.0	6412d679fdc3	github.com/gorilla/csrf@v1.6.2	1.7.3

Open the chart page →

7,672

harborwenerme

1 of 8 See more

harbor wenerme 1.19.2

1 of the 8 container images this version deploys carry CVE-2025-24358.

Container image	Digest	Package	Fixed in
goharbor/harbor-core :v2.15.2	d7b780d23721	github.com/gorilla/csrf@v1.7.2	1.7.3

Open the chart page →

1,650

Container images carrying it

19 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
goharbor/harbor-core :v2.15.2	d7b780d23721	github.com/gorilla/csrf@v1.7.2	1.7.3	3
artifacthub/hub :v1.19.0	111918d8c399	github.com/gorilla/csrf@v1.7.2	1.7.3	1
cortezaproject/corteza :2024.9.6	0bcdcbcd3c63	github.com/gorilla/csrf@v1.7.1	1.7.3	1
cortezaproject/corteza :2024.9.0	8eb7a26605c9	github.com/gorilla/csrf@v1.7.1	1.7.3	1
cortezaproject/corteza :2024.9.4	cb9f200de5d2	github.com/gorilla/csrf@v1.7.1	1.7.3	1
epamedp/edp-admin-console :2.14.0	616c678ba3e7	github.com/gorilla/csrf@v1.7.1	1.7.3	1
gobitfly/eth2-beaconchain-explorer :latest	1d08a7986348	github.com/gorilla/csrf@v1.7.0	1.7.3	1
goharbor/harbor-core :v2.9.0	6412d679fdc3	github.com/gorilla/csrf@v1.6.2	1.7.3	1
goharbor/harbor-core :v2.5.3	86bf3031f4a7	github.com/gorilla/csrf@v1.6.2	1.7.3	1
goharbor/harbor-core :v2.14.3	a30e5a8be3d9	github.com/gorilla/csrf@v1.7.2	1.7.3	1
goharbor/harbor-core :v2.11.1	c017dd84ee96	github.com/gorilla/csrf@v1.7.2	1.7.3	1
gophish/gophish :0.12.1	8a57cd171999	github.com/gorilla/csrf@v1.6.2	1.7.3	1
headscale/headscale :0.25.1	a7a8ae9616bb	github.com/gorilla/csrf@v1.7.3-0.20250123201450-9dd6af1f6d30	1.7.3	1
mvisonneau/tailscale :v1.68.1	fc45ad8abf10	github.com/gorilla/csrf@v1.7.2	1.7.3	1
tailscale/k8s-operator :v1.70.0	8edd06cf5bac	github.com/gorilla/csrf@v1.7.2	1.7.3	1
ghcr.io/juanfont/headscale :v0.25.0	97febecbe6cb	github.com/gorilla/csrf@v1.7.3-0.20250123201450-9dd6af1f6d30	1.7.3	1
ghcr.io/loft-sh/devpod-pro :0.0.0-ci.4-do-not-use	5dfa86b6451f	github.com/gorilla/csrf@v1.7.2	1.7.3	1
ghcr.io/loft-sh/vcluster-control-plane :0.0.0-ci.4-do-not-use	45e744fc623f	github.com/gorilla/csrf@v1.7.2	1.7.3	1
ghcr.io/sagernet/sing-box :v1.12.0	3c1ee82d450d	github.com/gorilla/csrf@v1.7.3-0.20250123201450-9dd6af1f6d30	1.7.3	1