StackRadar

CVE-2026-2303

Medium

Advisory

Published 10 Feb 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.002
14th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
584
of 17,787 indexed, latest versions
Container images
610
deployed by those charts
Fix available
2 of 2
affected packages

mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling

Carried by container images the latest versions of 584 of 17,787 indexed charts deploy, on 610 images.

Affected packageAffected versionsFixed inImages
go.mongodb.org/mongo-drivergolangv1.0.0, v1.0.3, v1.0.4, v1.1.0+54 more1.17.7607
go.mongodb.org/mongo-driver/v2golangv2.2.2, v2.3.0, v2.3.1, v2.4.02.4.212
OSV records
GHSA-cp6g-7hqx-qxhp
Also known as
GO-2026-5327

Charts affected

584 by stars
ChartLatestAffected imagesRadar Score
devtron-enterpriseromholdings48.0.02 of 28See more

devtron-enterprise romholdings 48.0.0

2 of the 28 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
go.mongodb.org/mongo-driver@v1.11.3
1.17.7
quay.io/devtron/migrator:v4.16.2fbeaef7a8566
go.mongodb.org/mongo-driver@v1.7.5
1.17.7

Open the chart page →

66,542
devtron-operatorromholdings0.23.31 of 11See more

devtron-operator romholdings 0.23.3

1 of the 11 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/devtron/migrator:v4.16.2fbeaef7a8566
go.mongodb.org/mongo-driver@v1.7.5
1.17.7

Open the chart page →

31,447
kube-prometheus-stackromholdings19.3.02 of 6See more

kube-prometheus-stack romholdings 19.3.0

2 of the 6 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/grafana:8.2.500568d89c4f8
go.mongodb.org/mongo-driver@v1.5.2
1.17.7
quay.io/prometheus-operator/prometheus-operator:v0.50.0ab4f480f2cc6
go.mongodb.org/mongo-driver@v1.5.1
1.17.7

Open the chart page →

8,645
migrantromholdings0.0.31 of 1See more

migrant romholdings 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
migrate/migrate:latestcc4ad8e19d66
go.mongodb.org/mongo-driver@v1.7.5
1.17.7

Open the chart page →

734
your-spotifyrubxkubeVerified publisher1.0.11 of 3See more

your-spotify rubxkube 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:latestb0652af9c8d0
go.mongodb.org/mongo-driver@v1.17.3
1.17.7

Open the chart page →

4,966
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

5,833
grafanasb-helm-charts0.4.01 of 1See more

grafana sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/grafana:12.2.22ebef928d7e5
go.mongodb.org/mongo-driver@v1.17.3
1.17.7

Open the chart page →

1,796
harborsb-helm-charts0.3.01 of 2See more

harbor sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
goharbor/harbor-core:v2.11.1c017dd84ee96
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

1,680
lokisb-helm-charts0.4.01 of 1See more

loki sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/loki:3.6.192bd5700577b
go.mongodb.org/mongo-driver@v1.17.2
1.17.7

Open the chart page →

803
mimirsb-helm-charts0.3.01 of 1See more

mimir sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/mimir:2.15.085f55510e0d3
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

888
mongodbsb-helm-charts0.4.01 of 1See more

mongodb sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
library/mongo:7.0.140032d2ca20db
go.mongodb.org/mongo-driver@v1.16.0
1.17.7

Open the chart page →

4,095
opentelemetry-collectorsb-helm-charts0.3.01 of 1See more

opentelemetry-collector sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

1,721
promtailsb-helm-charts0.4.01 of 1See more

promtail sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/promtail:3.6.18dcfdf466da0
go.mongodb.org/mongo-driver@v1.17.2
1.17.7

Open the chart page →

2,241
temposb-helm-charts0.4.01 of 1See more

tempo sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/tempo:2.9.065a578975943
go.mongodb.org/mongo-driver@v1.15.0
1.17.7

Open the chart page →

923
thanos-compactorsb-helm-charts0.3.01 of 1See more

thanos-compactor sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

961
thanos-querysb-helm-charts0.3.01 of 1See more

thanos-query sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

961
thanos-query-frontendsb-helm-charts0.3.01 of 1See more

thanos-query-frontend sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

961
thanos-receivesb-helm-charts0.3.01 of 1See more

thanos-receive sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

961
thanos-rulersb-helm-charts0.3.01 of 1See more

thanos-ruler sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

961
thanos-sidecarsb-helm-charts0.3.01 of 1See more

thanos-sidecar sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

961
thanos-storesb-helm-charts0.3.01 of 1See more

thanos-store sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

961
icinga2-masterschmitzis0.2.01 of 6See more

icinga2-master schmitzis 0.2.0

1 of the 6 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/grafana:8.0.3696823fbc561
go.mongodb.org/mongo-driver@v1.5.1
1.17.7

Open the chart page →

3,731
centralbrainsciencemeshVerified publisher0.0.31 of 5See more

centralbrain sciencemesh 0.0.3

1 of the 5 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.22.1b899dbd1b901
go.mongodb.org/mongo-driver@v1.3.2
1.17.7

Open the chart page →

9,754
seaweedfs-operatorseaweedfs-operatorVerified publisher1.5.81 of 3See more

seaweedfs-operator seaweedfs-operator 1.5.8

1 of the 3 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
ghcr.io/nnstd/seaweedfs-operator:1.43ebe2fd253f6
go.mongodb.org/mongo-driver@v1.17.4
1.17.7

Open the chart page →

2,092
seldon-core-analyticsseldon1.17.12 of 8See more

seldon-core-analytics seldon 1.17.1

2 of the 8 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
prom/alertmanager:v0.20.07e4e9f7a0954
go.mongodb.org/mongo-driver@v1.0.3
1.17.7
prom/prometheus:v2.18.15880ec936055
go.mongodb.org/mongo-driver@v1.3.2
1.17.7

Open the chart page →

10,733
miniosergiotocaliniVerified publisher1.0.01 of 1See more

minio sergiotocalini 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2023-07-21T21-12-44Z8e5e9490cd50
go.mongodb.org/mongo-driver@v1.12.0
1.17.7

Open the chart page →

4,203
ccx-monitoringseveralnines0.6.212 of 7See more

ccx-monitoring severalnines 0.6.21

2 of the 7 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/grafana:12.3.12175aaa91c96
go.mongodb.org/mongo-driver@v1.17.4
1.17.7
quay.io/prometheus/alertmanager:v0.26.0361db356b330
go.mongodb.org/mongo-driver@v1.11.3
1.17.7

Open the chart page →

7,709
shopwareshopware-storeVerified publisher2.1.11 of 5See more

shopware shopware-store 2.1.1

1 of the 5 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
percona/percona-xtradb-cluster-operator:1.14.03232ae01d0ff
go.mongodb.org/mongo-driver@v1.13.1
1.17.7

Open the chart page →

4,890
bffshortlink0.2.11 of 1See more

bff shortlink 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
registry.gitlab.com/shortlink-org/shortlink/bff:latestf2194e526915
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

1,691
linkshortlink0.7.31 of 1See more

link shortlink 0.7.3

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

1,675
alertmanagersignoz0.5.21 of 1See more

alertmanager signoz 0.5.2

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
signoz/alertmanager:0.5.07bc7de2e33c2
go.mongodb.org/mongo-driver@v1.5.1
1.17.7

Open the chart page →

2,181
counter-dhlsikademo0.3.01 of 3See more

counter-dhl sikademo 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
ondrejsika/counter:latestd95eaeee2172
go.mongodb.org/mongo-driver@v1.17.0
1.17.7

Open the chart page →

4,857
keydbsinextraVerified publisher0.31.01 of 1See more

keydb sinextra 0.31.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/keydb:6.3.376a19ddc3626
go.mongodb.org/mongo-driver@v1.5.1
1.17.7

Open the chart page →

2,165
mongosqldsinextraVerified publisher0.3.71 of 1See more

mongosqld sinextra 0.3.7

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/mongosqld:2.14.230b826375ed42
go.mongodb.org/mongo-driver@v1.5.1
1.17.7

Open the chart page →

2,599
mongosyncsinextraVerified publisher0.4.01 of 1See more

mongosync sinextra 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/mongosync:1.15.0fa99ed475f03
go.mongodb.org/mongo-driver/v2@v2.2.2
2.4.2

Open the chart page →

2,854
mimirskyloud-helm-chartsVerified publisher5.5.12 of 5See more

mimir skyloud-helm-charts 5.5.1

2 of the 5 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/mimir:r292-5f018727476e456c738
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
quay.io/minio/minio:RELEASE.2023-09-30T07-02-29Z6262bc9a2730
go.mongodb.org/mongo-driver@v1.12.1
1.17.7

Open the chart page →

10,650
skypilot-prometheus-serverskypilotVerified publisher0.11.12 of 3See more

skypilot-prometheus-server skypilot 0.11.1

2 of the 3 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/prometheus-operator/prometheus-config-reloader:v0.83.078aec597d87a
go.mongodb.org/mongo-driver@v1.17.3
1.17.7
quay.io/prometheus/prometheus:v3.4.19abc6cf6aea7
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

2,344
cost-analyzersoftonic2.5.52 of 6See more

cost-analyzer softonic 2.5.5

2 of the 6 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/grafana:11.5.28b37a2f028f1
go.mongodb.org/mongo-driver@v1.16.1
1.17.7
quay.io/prometheus/prometheus:v3.2.16927e0919a14
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

7,935
harborsoftonic1.13.04 of 8See more

harbor softonic 1.13.0

4 of the 8 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
goharbor/harbor-core:v2.9.06412d679fdc3
go.mongodb.org/mongo-driver@v1.7.5
1.17.7
goharbor/harbor-jobservice:v2.9.039435daedd0c
go.mongodb.org/mongo-driver@v1.7.5
1.17.7
goharbor/harbor-registryctl:v2.9.0cce272836449
go.mongodb.org/mongo-driver@v1.7.5
1.17.7
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
go.mongodb.org/mongo-driver@v1.11.3
1.17.7

Open the chart page →

7,672
kedasoftonic2.17.02 of 3See more

keda softonic 2.17.0

2 of the 3 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
ghcr.io/kedacore/keda:2.17.0112fc427d933
go.mongodb.org/mongo-driver@v1.17.3
1.17.7
ghcr.io/kedacore/keda-metrics-apiserver:2.17.0167fd532bd43
go.mongodb.org/mongo-driver@v1.17.3
1.17.7

Open the chart page →

2,583
kube-prometheus-stacksoftonic81.5.12 of 6See more

kube-prometheus-stack softonic 81.5.1

2 of the 6 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/grafana:12.3.2ba93c9d192e5
go.mongodb.org/mongo-driver@v1.17.4
1.17.7
quay.io/prometheus-operator/prometheus-operator:v0.88.1d3d65efa3bee
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

4,975
redis-high-availabilitysomeblackmagic1.3.101 of 3See more

redis-high-availability someblackmagic 1.3.10

1 of the 3 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
haproxytech/haproxy-alpine:2.9.57f3dc8c7e031
go.mongodb.org/mongo-driver@v1.13.1
1.17.7

Open the chart page →

3,148
servicexssl-hep1.8.51 of 16See more

servicex ssl-hep 1.8.5

1 of the 16 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2022.12.12-debian-11-r90f7c8ac484ac
go.mongodb.org/mongo-driver@v1.10.3
1.17.7

Open the chart page →

65,130
external-secretsstakaterVerified publisher0.3.12-40dbdfc1 of 1See more

external-secrets stakater 0.3.12-40dbdfc

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/external-secrets:v0.3.1156a1ea4490ba
go.mongodb.org/mongo-driver@v1.5.1
1.17.7

Open the chart page →

2,081
vaultstakaterVerified publisher0.8.41 of 2See more

vault stakater 0.8.4

1 of the 2 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
hashicorp/vault:1.8.4dfc3500beb0e
go.mongodb.org/mongo-driver@v1.4.6
1.17.7

Open the chart page →

5,864
stakefishstakefish0.1.03 of 8See more

stakefish stakefish 0.1.0

3 of the 8 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
prom/prometheus:v2.52.05c435642ca4d
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
quay.io/prometheus-operator/prometheus-config-reloader:v0.73.2706cde441321
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
quay.io/prometheus/alertmanager:v0.27.0e13b6ed5cb92
go.mongodb.org/mongo-driver@v1.13.1
1.17.7

Open the chart page →

18,426
cost-analyzerstatcan1.82.21 of 9See more

cost-analyzer statcan 1.82.2

1 of the 9 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
prom/prometheus:v2.22.2f7ffebdd428b
go.mongodb.org/mongo-driver@v1.3.2
1.17.7

Open the chart page →

16,508
static-src-people-detector-appstatic-src-people-detector-chartVerified publisher1.5.51 of 6See more

static-src-people-detector-app static-src-people-detector-chart 1.5.5

1 of the 6 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
library/mongo:4.4.18d23ec07162ca
go.mongodb.org/mongo-driver@v1.10.3
1.17.7

Open the chart page →

13,684
sn-platform-slimstreamnative1.11.442 of 6See more

sn-platform-slim streamnative 1.11.44

2 of the 6 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
streamnative/apache-pulsar-grafana-dashboard-k8s:0.1.20e6d7aa3ef32
go.mongodb.org/mongo-driver@v1.11.1
1.17.7
quay.io/prometheus/prometheus:v2.43.0f5c29683a301
go.mongodb.org/mongo-driver@v1.11.2
1.17.7

Open the chart page →

10,182
stunner-prometheusstunner0.2.11 of 4See more

stunner-prometheus stunner 0.2.1

1 of the 4 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/prometheus-operator/prometheus-operator:v0.77.2af92db7eac86
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

3,026

Container images carrying it

610 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/solo-io/discovery:0.0.0-fork5b62aaade3c9
go.mongodb.org/mongo-driver@v1.1.2
1.17.7
1
quay.io/thanos/thanos:v0.40.1aae7b2b030ed
go.mongodb.org/mongo-driver@v1.17.4
1.17.7
1
quay.io/thanos/thanos:v0.17.1e362f02ed304
go.mongodb.org/mongo-driver@v1.3.2
1.17.7
1
quay.io/thanos/thanos:v0.36.1e542959e1b36
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
go.mongodb.org/mongo-driver@v1.13.1
1.17.7
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
go.mongodb.org/mongo-driver@v1.13.1
1.17.7
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb:4.4.5cf72810d33f5
go.mongodb.org/mongo-driver@v1.4.2
1.17.7
1
registry.gitlab.com/shortlink-org/shortlink/bff:latestf2194e526915
go.mongodb.org/mongo-driver@v1.17.6
1.17.7
1
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
go.mongodb.org/mongo-driver@v1.17.6
1.17.7
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.