StackRadar

CVE-2026-2303

Medium

Advisory

Published 10 Feb 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.002
14th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
581
of 17,781 indexed, latest versions
Container images
608
deployed by those charts
Fix available
2 of 2
affected packages

mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling

Carried by container images the latest versions of 581 of 17,781 indexed charts deploy, on 608 images.

Affected packageAffected versionsFixed inImages
go.mongodb.org/mongo-drivergolangv1.0.0, v1.0.3, v1.0.4, v1.1.0+54 more1.17.7605
go.mongodb.org/mongo-driver/v2golangv2.2.2, v2.3.0, v2.3.1, v2.4.02.4.212
OSV records
GHSA-cp6g-7hqx-qxhp
Also known as
GO-2026-5327

Charts affected

581 by stars
ChartLatestAffected imagesRadar Score
external-secretsexternal-secrets-operatorVerified publisher2.10.01 of 1See more

external-secrets external-secrets-operator 2.10.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/external-secrets:v2.10.0814117b0fd6d
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

77
artifact-hubartifact-hubVerified publisher1.23.02 of 7See more

artifact-hub artifact-hub 1.23.0

2 of the 7 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
aquasec/trivy:0.69.3bcc376de8d77
go.mongodb.org/mongo-driver@v1.17.6
1.17.7
artifacthub/scanner:v1.23.02d8365601f0e
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

10,755
mimir-distributedgrafana6.2.01 of 6See more

mimir-distributed grafana 6.2.0

1 of the 6 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2024-12-18T13-15-44Z1dce27c494a1
go.mongodb.org/mongo-driver@v1.17.1
1.17.7

Open the chart page →

4,517
openebsopenebsOfficialVerified publisher4.6.14 of 35See more

openebs openebs 4.6.1

4 of the 35 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/alloy:v1.8.17790f6f7fbd8
go.mongodb.org/mongo-driver@v1.17.1
1.17.7
grafana/loki:3.4.258a6c186ce78
go.mongodb.org/mongo-driver@v1.17.0
1.17.7
quay.io/minio/minio:RELEASE.2024-12-18T13-15-44Z1dce27c494a1
go.mongodb.org/mongo-driver@v1.17.1
1.17.7
quay.io/prometheus-operator/prometheus-config-reloader:v0.81.0959d47672fbf
go.mongodb.org/mongo-driver@v1.17.2
1.17.7

Open the chart page →

23,894
zabbixzabbix-communityVerified publisher7.1.01 of 5See more

zabbix zabbix-community 7.1.0

1 of the 5 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
zabbix/zabbix-agent2:ubuntu-7.0.237322a94c5d7a
go.mongodb.org/mongo-driver@v1.7.6
1.17.7

Open the chart page →

13,664
miniominio-official5.4.01 of 2See more

minio minio-official 5.4.0

1 of the 2 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2024-12-18T13-15-44Z1dce27c494a1
go.mongodb.org/mongo-driver@v1.17.1
1.17.7

Open the chart page →

2,483
linkerd-vizlinkerd2Verified publisher30.12.111 of 5See more

linkerd-viz linkerd2 30.12.11

1 of the 5 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
prom/prometheus:v2.48.0b440bc0e8aa5
go.mongodb.org/mongo-driver@v1.12.0
1.17.7

Open the chart page →

1,367
rocketchatrocketchat-server7.0.22 of 12See more

rocketchat rocketchat-server 7.0.2

2 of the 12 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:6.0.10-debian-11-r842319decb591
go.mongodb.org/mongo-driver@v1.10.3
1.17.7
bitnamilegacy/mongodb-exporter:0.39.0-debian-11-r106de7256c7adcd
go.mongodb.org/mongo-driver@v1.11.3
1.17.7

Open the chart page →

12,279
grafana-agentgrafana0.44.21 of 2See more

grafana-agent grafana 0.44.2

1 of the 2 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/agent:v0.44.23364714a2f64
go.mongodb.org/mongo-driver@v1.12.0
1.17.7

Open the chart page →

3,475
milvusmilvus4.0.311 of 5See more

milvus milvus 4.0.31

1 of the 5 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2023-03-20T20-16-18Z6d770d7f255c
go.mongodb.org/mongo-driver@v1.11.3
1.17.7

Open the chart page →

32,259
mesherymesheryOfficialVerified publisher1.0.691 of 1See more

meshery meshery 1.0.69

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
meshery/meshery:stable-latest9b68e81d392e
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

1,407
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:6.0.10-debian-11-r842319decb591
go.mongodb.org/mongo-driver@v1.10.3
1.17.7

Open the chart page →

10,622
kubesharkkubeshark-helm-chartsOfficialVerified publisher53.4.01 of 3See more

kubeshark kubeshark-helm-charts 53.4.0

1 of the 3 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
kubeshark/hub:v53.46d3f22525a0e
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

825
pulsarapache4.7.02 of 10See more

pulsar apache 4.7.0

2 of the 10 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
go.mongodb.org/mongo-driver@v1.17.6
1.17.7
grafana/grafana:12.4.1e932bd6ed0e0
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

9,864
miniocloudpirates-minioVerified publisher0.13.41 of 1See more

minio cloudpirates-minio 0.13.4

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
cloudpirates/image-minio:RELEASE.2025-10-15T17-29-55Z-hardened8dc02a7e5093
go.mongodb.org/mongo-driver@v1.17.3
1.17.7

Open the chart page →

961
pyroscopegrafana2.3.12 of 3See more

pyroscope grafana 2.3.1

2 of the 3 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/alloy:v1.12.2f94b1c82957a
go.mongodb.org/mongo-driver@v1.17.4
go.mongodb.org/mongo-driver/v2@v2.3.0
1.17.7
2.4.2
quay.io/prometheus-operator/prometheus-config-reloader:v0.81.0959d47672fbf
go.mongodb.org/mongo-driver@v1.17.2
1.17.7

Open the chart page →

3,157
thanosthanos-communityOfficialVerified publisher0.43.01 of 1See more

thanos thanos-community 0.43.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.42.4b567818fe608
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

196
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/grafana:11.1.4886b56d5534e
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

16,251
kratosory0.64.01 of 1See more

kratos ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
oryd/kratos:v26.2.02a13bb8d362c
go.mongodb.org/mongo-driver@v1.17.4
1.17.7

Open the chart page →

866
argocdnicklasfrahm-argocdVerified publisher0.3.01 of 2See more

argocd nicklasfrahm-argocd 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
go.mongodb.org/mongo-driver@v1.17.1
1.17.7

Open the chart page →

5,240
linkerd-jaegerlinkerd2Verified publisher30.12.111 of 4See more

linkerd-jaeger linkerd2 30.12.11

1 of the 4 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
jaegertracing/all-in-one:1.3104d224a9999b
go.mongodb.org/mongo-driver@v1.7.5
1.17.7

Open the chart page →

4,405
glasskube-operatorglasskubeOfficialVerified publisher0.12.21 of 3See more

glasskube-operator glasskube 0.12.2

1 of the 3 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2023-09-30T07-02-29Z6262bc9a2730
go.mongodb.org/mongo-driver@v1.12.1
1.17.7

Open the chart page →

11,933
linkerd-vizlinkerd2-edgeVerified publisher30.14.11-edge1 of 5See more

linkerd-viz linkerd2-edge 30.14.11-edge

1 of the 5 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
prom/prometheus:v2.48.1a67e5e402ff5
go.mongodb.org/mongo-driver@v1.12.0
1.17.7

Open the chart page →

1,346
plane-cemakeplaneOfficialVerified publisher1.8.11 of 11See more

plane-ce makeplane 1.8.1

1 of the 11 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2025-09-07T16-13-09Z14cea493d9a3
go.mongodb.org/mongo-driver@v1.17.3
1.17.7

Open the chart page →

4,854
milvusmilvus-helm5.0.271 of 4See more

milvus milvus-helm 5.0.27

1 of the 4 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2024-12-18T13-15-44Z1dce27c494a1
go.mongodb.org/mongo-driver@v1.17.1
1.17.7

Open the chart page →

10,670
codefreshcodefresh-onpremOfficialVerified publisher2.12.132 of 42See more

codefresh codefresh-onprem 2.12.13

2 of the 42 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
bitnamilegacy/consul:1.21.4-debian-12-r133ae872fc99d
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
bitnamilegacy/mongodb:7.0.14-debian-12-r321e8f8baa432
go.mongodb.org/mongo-driver@v1.16.0
1.17.7

Open the chart page →

14,956
loki-simple-scalablegrafana1.8.111 of 3See more

loki-simple-scalable grafana 1.8.11

1 of the 3 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/loki:2.6.11ee60f980950
go.mongodb.org/mongo-driver@v1.7.5
1.17.7

Open the chart page →

6,470
prometheus-operatorarldkaVerified publisher13.0.11 of 2See more

prometheus-operator arldka 13.0.1

1 of the 2 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/prometheus-operator/prometheus-operator:v0.73.204f2b98d71ef
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

2,107
budibasebudibase0.0.0-master1 of 7See more

budibase budibase 0.0.0-master

1 of the 7 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
go.mongodb.org/mongo-driver@v1.17.3
1.17.7

Open the chart page →

10,775
waypointhashicorpVerified publisher0.1.211 of 2See more

waypoint hashicorp 0.1.21

1 of the 2 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
hashicorp/waypoint:0.11.397d521a27498
go.mongodb.org/mongo-driver@v1.11.0
1.17.7

Open the chart page →

4,167
thanosstevehipwellVerified publisher1.24.11 of 1See more

thanos stevehipwell 1.24.1

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.42.4b567818fe608
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

196
devtron-operatordevtron0.23.31 of 11See more

devtron-operator devtron 0.23.3

1 of the 11 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/devtron/migrator:v4.16.2fbeaef7a8566
go.mongodb.org/mongo-driver@v1.7.5
1.17.7

Open the chart page →

32,902
ilumilumOfficialVerified publisher6.7.32 of 19See more

ilum ilum 6.7.3

2 of the 19 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2025.3.12-debian-12-r0ba9f3b4b0b00
go.mongodb.org/mongo-driver@v1.17.2
1.17.7
ilum/mongodb:6.0.542b6d774c37d
go.mongodb.org/mongo-driver@v1.10.3
1.17.7

Open the chart page →

23,228
temporallemontechVerified publisher0.37.02 of 13See more

temporal lemontech 0.37.0

2 of the 13 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/prometheus/alertmanager:v0.23.09ab73a421b65
go.mongodb.org/mongo-driver@v1.5.1
1.17.7
quay.io/prometheus/prometheus:v2.31.1a8779cfe553e
go.mongodb.org/mongo-driver@v1.5.1
1.17.7

Open the chart page →

14,893
litmuslitmuschaos3.30.01 of 6See more

litmus litmuschaos 3.30.0

1 of the 6 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:8.0.13-debian-12-r02579e968033e
go.mongodb.org/mongo-driver@v1.17.3
1.17.7

Open the chart page →

7,007
netris-controllernetrisai2.8.22 of 14See more

netris-controller netrisai 2.8.2

2 of the 14 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
haproxytech/haproxy-alpine:2.8.08951be4b4e1c
go.mongodb.org/mongo-driver@v1.11.7
1.17.7
netrisai/controller-telescope:4.6.0.00414d82948a8b2
go.mongodb.org/mongo-driver@v1.5.4
1.17.7

Open the chart page →

30,326
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
openmined/syft-seaweedfs:0.9.53a4144c0bb82
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

17,245
k8s-infrasignoz0.17.11 of 1See more

k8s-infra signoz 0.17.1

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.139.0faf125d656fa
go.mongodb.org/mongo-driver@v1.17.4
go.mongodb.org/mongo-driver/v2@v2.3.1
1.17.7
2.4.2

Open the chart page →

1,039
codercoderOfficialVerified publisher1.44.61 of 2See more

coder coder 1.44.6

1 of the 2 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
coderenvs/coder-service:1.44.61deffc4670e6
go.mongodb.org/mongo-driver@v1.8.3
1.17.7

Open the chart page →

6,849
cortexcortex3.3.81 of 4See more

cortex cortex 3.3.8

1 of the 4 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/cortexproject/cortex:v1.21.18577eb292a01
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

3,897
emqx-operatoremqx-operator2.3.21 of 2See more

emqx-operator emqx-operator 2.3.2

1 of the 2 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
alpine/k8s:1.31.49c4976d47656
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

4,531
oathkeeperory0.64.01 of 1See more

oathkeeper ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
oryd/oathkeeper:v26.2.0467329abde34
go.mongodb.org/mongo-driver@v1.17.4
1.17.7

Open the chart page →

769
pmmpercona1.9.11 of 1See more

pmm percona 1.9.1

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
percona/pmm-server:3.9.1003f9c25f842
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

790
thehivestrangebee-helmOfficialVerified publisher1.0.61 of 7See more

thehive strangebee-helm 1.0.6

1 of the 7 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2025-09-07T16-13-09Z14cea493d9a3
go.mongodb.org/mongo-driver@v1.17.3
1.17.7

Open the chart page →

16,210
kubedbappscodeVerified publisher2026.7.103 of 8See more

kubedb appscode 2026.7.10

3 of the 8 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
ghcr.io/kubedb/kubedb-autoscaler:v0.51.05d1182ac21f0
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
ghcr.io/kubedb/kubedb-ops-manager:v0.53.06d4c9fe66e4f
go.mongodb.org/mongo-driver@v1.17.6
1.17.7
ghcr.io/kubedb/kubedb-provisioner:v0.66.0824d6d78d451
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

4,016
baserowbaserow-chartVerified publisher1.0.561 of 6See more

baserow baserow-chart 1.0.56

1 of the 6 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2024.7.4-debian-12-r0952f86d1116c
go.mongodb.org/mongo-driver@v1.16.0
1.17.7

Open the chart page →

17,263
dolibarrcowboysysopVerified publisher9.0.31 of 3See more

dolibarr cowboysysop 9.0.3

1 of the 3 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
wait4x/wait4x:3.3.14dcd86307de1
go.mongodb.org/mongo-driver@v1.17.3
1.17.7

Open the chart page →

9,106
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2024.8.3-debian-12-r15501c419f42e
go.mongodb.org/mongo-driver@v1.16.0
1.17.7

Open the chart page →

27,267
k8s-image-swapperestahnVerified publisher1.11.01 of 2See more

k8s-image-swapper estahn 1.11.0

1 of the 2 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
ghcr.io/estahn/k8s-image-swapper:1.5.102f5be9cde5f9
go.mongodb.org/mongo-driver@v1.11.3
1.17.7

Open the chart page →

1,981
kubeflowkubeflow1.6.24 of 45See more

kubeflow kubeflow 1.6.2

4 of the 45 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
gcr.io/ml-pipeline/api-server:2.0.0-alpha.5dc6ca05bb94f
go.mongodb.org/mongo-driver@v1.8.2
1.17.7
gcr.io/ml-pipeline/cache-server:2.0.0-alpha.583e79c709df3
go.mongodb.org/mongo-driver@v1.8.2
1.17.7
gcr.io/ml-pipeline/persistenceagent:2.0.0-alpha.500db9796a37b
go.mongodb.org/mongo-driver@v1.8.2
1.17.7
gcr.io/ml-pipeline/scheduledworkflow:2.0.0-alpha.5795a0c8a0e13
go.mongodb.org/mongo-driver@v1.8.2
1.17.7

Open the chart page →

96,941

Container images carrying it

608 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/thanos/thanos:v0.17.1e362f02ed304
go.mongodb.org/mongo-driver@v1.3.2
1.17.7
1
quay.io/thanos/thanos:v0.36.1e542959e1b36
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
go.mongodb.org/mongo-driver@v1.13.1
1.17.7
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
go.mongodb.org/mongo-driver@v1.13.1
1.17.7
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb:4.4.5cf72810d33f5
go.mongodb.org/mongo-driver@v1.4.2
1.17.7
1
registry.gitlab.com/shortlink-org/shortlink/bff:latestf2194e526915
go.mongodb.org/mongo-driver@v1.17.6
1.17.7
1
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
go.mongodb.org/mongo-driver@v1.17.6
1.17.7
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.