StackRadar

CVE-2026-12681

Medium

Advisory

Published 12 Jun 2026In the index since 8 Sept 2026
Severity
Medium
worst across findings
CVSS
6.8
base score, highest
EPSS
0.002
9th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
3
of 17,781 indexed, latest versions
Container images
2
deployed by those charts
Fix available
1 of 1
affected package

Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()

Carried by container images the latest versions of 3 of 17,781 indexed charts deploy, on 2 images.

Affected packageAffected versionsFixed inImages
github.com/google/go-attestationgolangv0.5.1, v0.6.10.6.12
OSV records
GHSA-9r4w-jg96-92mvGO-2026-5298

Charts affected

3 by stars
ChartLatestAffected imagesRadar Score
tbotteleport-agent-kube18.11.01 of 1See more

tbot teleport-agent-kube 18.11.0

1 of the 1 container images this version deploys carry CVE-2026-12681.

Container imageDigestPackageFixed in
public.ecr.aws/gravitational/tbot-distroless:18.11.04ba5ace31fea
github.com/google/go-attestation@v0.6.1
no fix listed

Open the chart page →

449
continuum-proxyedgelesssysVerified publisher1.5.11 of 1See more

continuum-proxy edgelesssys 1.5.1

1 of the 1 container images this version deploys carry CVE-2026-12681.

Container imageDigestPackageFixed in
ghcr.io/edgelesssys/continuum/continuum-proxydigest-pinned24c76f294a80
github.com/google/go-attestation@v0.5.1
0.6.1

Open the chart page →

852
tbot-spiffe-daemon-setteleport-agent-kube18.11.01 of 1See more

tbot-spiffe-daemon-set teleport-agent-kube 18.11.0

1 of the 1 container images this version deploys carry CVE-2026-12681.

Container imageDigestPackageFixed in
public.ecr.aws/gravitational/tbot-distroless:18.11.04ba5ace31fea
github.com/google/go-attestation@v0.6.1
no fix listed

Open the chart page →

449

Container images carrying it

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
public.ecr.aws/gravitational/tbot-distroless:18.11.04ba5ace31fea
github.com/google/go-attestation@v0.6.1
no fix listed
2
ghcr.io/edgelesssys/continuum/continuum-proxy24c76f294a80
github.com/google/go-attestation@v0.5.1
0.6.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.