StackRadar

CVE-2026-17106

High

Advisory

Published 18 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.1
base score, highest
EPSS
0.003
25th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
38
of 17,781 indexed, latest versions
Container images
31
deployed by those charts
Fix available
1 of 1
affected package

moby/go-archive: Crafted tar archive can write outside the extraction directory

Carried by container images the latest versions of 38 of 17,781 indexed charts deploy, on 31 images.

Affected packageAffected versionsFixed inImages
github.com/moby/go-archivegolangv0.1.0, v0.2.0, v0.2.10.3.031
OSV records
GHSA-hfg8-hc9c-6c3h
Also known as
BIT-docker-cli-2026-17106, GO-2026-6253

Charts affected

38 by stars
ChartLatestAffected imagesRadar Score
falcofalcosecurity9.1.02 of 3See more

falco falcosecurity 9.1.0

2 of the 3 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
falcosecurity/falco-driver-loader:0.44.17df783d5269a
github.com/moby/go-archive@v0.1.0
0.3.0
falcosecurity/falcoctl:0.13.00eeb79adc580
github.com/moby/go-archive@v0.1.0
0.3.0

Open the chart page →

5,227
portainerportainer245.0.01 of 1See more

portainer portainer 245.0.0

1 of the 1 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
portainer/portainer-ce:2.45.0511f3f06c96f
github.com/moby/go-archive@v0.1.0
0.3.0

Open the chart page →

277
mesherymesheryOfficialVerified publisher1.0.691 of 1See more

meshery meshery 1.0.69

1 of the 1 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
meshery/meshery:stable-latest9b68e81d392e
github.com/moby/go-archive@v0.1.0
0.3.0

Open the chart page →

1,407
oktetooktetoOfficialVerified publisher0.0.0-2026-08-031 of 10See more

okteto okteto 0.0.0-2026-08-03

1 of the 10 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
ghcr.io/okteto/buildkit:0.0.0-2026-08-0314527ca5d2a9
github.com/moby/go-archive@v0.2.0
0.3.0

Open the chart page →

5,750
openbaoopenbaoVerified publisher0.29.41 of 2See more

openbao openbao 0.29.4

1 of the 2 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
quay.io/openbao/openbao:2.6.211fd73a2102c
github.com/moby/go-archive@v0.2.0
0.3.0

Open the chart page →

1,508
kubescape-operatorkubescape1.40.41 of 6See more

kubescape-operator kubescape 1.40.4

1 of the 6 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
quay.io/kubescape/kubescape:v4.0.1358651dce3376
github.com/moby/go-archive@v0.2.0
0.3.0

Open the chart page →

920
codefreshcodefresh-onpremOfficialVerified publisher2.12.131 of 42See more

codefresh codefresh-onprem 2.12.13

1 of the 42 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
quay.io/codefresh/dind:3.0.250885ab519dac
github.com/moby/go-archive@v0.2.1
0.3.0

Open the chart page →

14,956
nuclionuclio0.23.81 of 2See more

nuclio nuclio 0.23.8

1 of the 2 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
quay.io/nuclio/dashboard:1.17.8-amd64b5f5bd4efbee
github.com/moby/go-archive@v0.2.0
0.3.0

Open the chart page →

963
buildkitdwiremindVerified publisher0.33.01 of 1See more

buildkitd wiremind 0.33.0

1 of the 1 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
moby/buildkit:v0.32.2-rootless504731e577c2
github.com/moby/go-archive@v0.2.0
0.3.0

Open the chart page →

1,152
buildkit-fleetbuildkit-fleetVerified publisher0.1.21 of 1See more

buildkit-fleet buildkit-fleet 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
moby/buildkit:v0.33.0-rootless80b15f0735e8
github.com/moby/go-archive@v0.2.0
0.3.0

Open the chart page →

909
openbaogitlabVerified publisher0.18.11 of 1See more

openbao gitlab 0.18.1

1 of the 1 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao:v2.5.5-gitlab25b7636dfba3f
github.com/moby/go-archive@v0.1.0
0.3.0

Open the chart page →

1,769
lagoon-remotelagoon-chartsVerified publisher0.106.01 of 1See more

lagoon-remote lagoon-charts 0.106.0

1 of the 1 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
uselagoon/docker-host:v3.6.12c89ed939b8b
github.com/moby/go-archive@v0.1.0
0.3.0

Open the chart page →

2,113
opikopikOfficialVerified publisher2.2.591 of 13See more

opik opik 2.2.59

1 of the 13 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
ghcr.io/comet-ml/opik/opik-python-backend:2.2.59269d0e55ea97
github.com/moby/go-archive@v0.2.0
0.3.0

Open the chart page →

14,334
buildkit-serviceandrcunsVerified publisher1.8.01 of 1See more

buildkit-service andrcuns 1.8.0

1 of the 1 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
moby/buildkit:v0.31.0a095b3d11ce1
github.com/moby/go-archive@v0.2.0
0.3.0

Open the chart page →

1,285
appwriteappwrite-helmVerified publisher1.3.21 of 8See more

appwrite appwrite-helm 1.3.2

1 of the 8 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
appwrite/appwrite:1.9.01aaa70127114
github.com/moby/go-archive@v0.1.0
0.3.0

Open the chart page →

9,847
buildkitbuildkit0.1.01 of 1See more

buildkit buildkit 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
moby/buildkit:master-rootless07115a67cd22
github.com/moby/go-archive@v0.2.0
0.3.0

Open the chart page →

620
buildkit-privilegedbuildkit-privileged0.1.01 of 1See more

buildkit-privileged buildkit-privileged 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
moby/buildkit:masterbc964521ee58
github.com/moby/go-archive@v0.2.0
0.3.0

Open the chart page →

403
caninecanine0.1.101 of 7See more

canine canine 0.1.10

1 of the 7 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
ghcr.io/caninehq/canine:latesta058034ca006
github.com/moby/go-archive@v0.1.0
0.3.0

Open the chart page →

14,130
ocs-operatorcloud-native-toolkit0.2.41 of 1See more

ocs-operator cloud-native-toolkit 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/moby/go-archive@v0.1.0
0.3.0

Open the chart page →

369
refarch-infraconfigcloud-native-toolkit0.2.21 of 1See more

refarch-infraconfig cloud-native-toolkit 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/moby/go-archive@v0.1.0
0.3.0

Open the chart page →

369
pulsarcloudve0.2.01 of 2See more

pulsar cloudve 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
library/docker:dind5efed980cba3
github.com/moby/go-archive@v0.2.0
0.3.0

Open the chart page →

6,162
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
library/docker:dind5efed980cba3
github.com/moby/go-archive@v0.2.0
0.3.0

Open the chart page →

14,559
csghubcsghubVerified publisher2.4.31 of 34See more

csghub csghub 2.4.3

1 of the 34 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
opencsghq/csghub-server:v2.4.0-ee302c9d45d8a8
github.com/moby/go-archive@v0.1.0
0.3.0

Open the chart page →

58,897
custom-rhcl-consolecustom-rhcl-consoleVerified publisher0.1.21 of 3See more

custom-rhcl-console custom-rhcl-console 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/moby/go-archive@v0.1.0
0.3.0

Open the chart page →

1,885
panda-pulsegeneral-helm-chartsVerified publisher1.0.51 of 1See more

panda-pulse general-helm-charts 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
ethpandaops/panda-pulse:latest7b14deeb416a
github.com/moby/go-archive@v0.2.0
0.3.0

Open the chart page →

703
appwritehelmforgeVerified publisher1.3.41 of 5See more

appwrite helmforge 1.3.4

1 of the 5 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
appwrite/appwrite:1.9.6adc7d0e7ec23
github.com/moby/go-archive@v0.1.0
0.3.0

Open the chart page →

6,952
dockerdkarljorgensen0.1.01 of 1See more

dockerd karljorgensen 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
library/docker:28.5.2-dind2a232a42256f
github.com/moby/go-archive@v0.1.0
0.3.0

Open the chart page →

2,034
kestra-starterkestraOfficialVerified publisher2.0.11 of 5See more

kestra-starter kestra 2.0.1

1 of the 5 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
library/docker:dind-rootlesse17fa54c2ffd
github.com/moby/go-archive@v0.2.0
0.3.0

Open the chart page →

5,455
lagoon-docker-hostlagoon-chartsVerified publisher0.7.01 of 1See more

lagoon-docker-host lagoon-charts 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
uselagoon/docker-host:v3.6.12c89ed939b8b
github.com/moby/go-archive@v0.1.0
0.3.0

Open the chart page →

2,113
pro-builderopenfaas0.6.132 of 2See more

pro-builder openfaas 0.6.13

2 of the 2 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
moby/buildkit:v0.32.2-rootless504731e577c2
github.com/moby/go-archive@v0.2.0
0.3.0
ghcr.io/openfaasltd/pro-builder:0.6.06c17297f9098
github.com/moby/go-archive@v0.2.0
0.3.0

Open the chart page →

2,726
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.02 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

2 of the 40 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
gcr.io/kaniko-project/executor:latest4e7a52dd1f14
github.com/moby/go-archive@v0.1.0
0.3.0
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
github.com/moby/go-archive@v0.2.0
0.3.0

Open the chart page →

71,208
pet-battle-infrapetbattle1.0.321 of 2See more

pet-battle-infra petbattle 1.0.32

1 of the 2 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/moby/go-archive@v0.1.0
0.3.0

Open the chart page →

15,466
pet-battle-tournamentpetbattle1.0.401 of 3See more

pet-battle-tournament petbattle 1.0.40

1 of the 3 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/moby/go-archive@v0.1.0
0.3.0

Open the chart page →

15,466
gitops-operatorredhat-cop0.10.61 of 1See more

gitops-operator redhat-cop 0.10.6

1 of the 1 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/moby/go-archive@v0.1.0
0.3.0

Open the chart page →

369
ploigosredhat-cop0.0.91 of 2See more

ploigos redhat-cop 0.0.9

1 of the 2 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/moby/go-archive@v0.1.0
0.3.0

Open the chart page →

11,437
spindlerubxkubeVerified publisher0.1.11 of 2See more

spindle rubxkube 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
library/docker:29.7.2-dind3ef33f2e220b
github.com/moby/go-archive@v0.2.1
0.3.0

Open the chart page →

1,438
buildkitsomaz94Verified publisher0.1.41 of 1See more

buildkit somaz94 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
moby/buildkit:v0.33.06c2fa84a6b61
github.com/moby/go-archive@v0.2.0
0.3.0

Open the chart page →

722
mesherywenerme1.0.691 of 1See more

meshery wenerme 1.0.69

1 of the 1 container images this version deploys carry CVE-2026-17106.

Container imageDigestPackageFixed in
meshery/meshery:stable-latest9b68e81d392e
github.com/moby/go-archive@v0.1.0
0.3.0

Open the chart page →

1,407

Container images carrying it

31 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/moby/go-archive@v0.1.0
0.3.0
7
library/docker:dind5efed980cba3
github.com/moby/go-archive@v0.2.0
0.3.0
2
meshery/meshery:stable-latest9b68e81d392e
github.com/moby/go-archive@v0.1.0
0.3.0
2
moby/buildkit:v0.32.2-rootless504731e577c2
github.com/moby/go-archive@v0.2.0
0.3.0
2
uselagoon/docker-host:v3.6.12c89ed939b8b
github.com/moby/go-archive@v0.1.0
0.3.0
2
appwrite/appwrite:1.9.01aaa70127114
github.com/moby/go-archive@v0.1.0
0.3.0
1
appwrite/appwrite:1.9.6adc7d0e7ec23
github.com/moby/go-archive@v0.1.0
0.3.0
1
ethpandaops/panda-pulse:latest7b14deeb416a
github.com/moby/go-archive@v0.2.0
0.3.0
1
falcosecurity/falcoctl:0.13.00eeb79adc580
github.com/moby/go-archive@v0.1.0
0.3.0
1
falcosecurity/falco-driver-loader:0.44.17df783d5269a
github.com/moby/go-archive@v0.1.0
0.3.0
1
library/docker:28.5.2-dind2a232a42256f
github.com/moby/go-archive@v0.1.0
0.3.0
1
library/docker:29.7.2-dind3ef33f2e220b
github.com/moby/go-archive@v0.2.1
0.3.0
1
library/docker:dind-rootlesse17fa54c2ffd
github.com/moby/go-archive@v0.2.0
0.3.0
1
moby/buildkit:master-rootless07115a67cd22
github.com/moby/go-archive@v0.2.0
0.3.0
1
moby/buildkit:v0.33.06c2fa84a6b61
github.com/moby/go-archive@v0.2.0
0.3.0
1
moby/buildkit:v0.33.0-rootless80b15f0735e8
github.com/moby/go-archive@v0.2.0
0.3.0
1
moby/buildkit:v0.31.0a095b3d11ce1
github.com/moby/go-archive@v0.2.0
0.3.0
1
moby/buildkit:masterbc964521ee58
github.com/moby/go-archive@v0.2.0
0.3.0
1
opencsghq/csghub-server:v2.4.0-ee302c9d45d8a8
github.com/moby/go-archive@v0.1.0
0.3.0
1
portainer/portainer-ce:2.45.0511f3f06c96f
github.com/moby/go-archive@v0.1.0
0.3.0
1
gcr.io/kaniko-project/executor:latest4e7a52dd1f14
github.com/moby/go-archive@v0.1.0
0.3.0
1
ghcr.io/caninehq/canine:latesta058034ca006
github.com/moby/go-archive@v0.1.0
0.3.0
1
ghcr.io/comet-ml/opik/opik-python-backend:2.2.59269d0e55ea97
github.com/moby/go-archive@v0.2.0
0.3.0
1
ghcr.io/okteto/buildkit:0.0.0-2026-08-0314527ca5d2a9
github.com/moby/go-archive@v0.2.0
0.3.0
1
ghcr.io/openfaasltd/pro-builder:0.6.06c17297f9098
github.com/moby/go-archive@v0.2.0
0.3.0
1
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
github.com/moby/go-archive@v0.2.0
0.3.0
1
quay.io/codefresh/dind:3.0.250885ab519dac
github.com/moby/go-archive@v0.2.1
0.3.0
1
quay.io/kubescape/kubescape:v4.0.1358651dce3376
github.com/moby/go-archive@v0.2.0
0.3.0
1
quay.io/nuclio/dashboard:1.17.8-amd64b5f5bd4efbee
github.com/moby/go-archive@v0.2.0
0.3.0
1
quay.io/openbao/openbao:2.6.211fd73a2102c
github.com/moby/go-archive@v0.2.0
0.3.0
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao:v2.5.5-gitlab25b7636dfba3f
github.com/moby/go-archive@v0.1.0
0.3.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.