StackRadar

CVE-2026-2303

Medium

Advisory

Published 10 Feb 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.002
14th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
579
of 17,787 indexed, latest versions
Container images
607
deployed by those charts
Fix available
2 of 2
affected packages

mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling

Carried by container images the latest versions of 579 of 17,787 indexed charts deploy, on 607 images.

Affected packageAffected versionsFixed inImages
go.mongodb.org/mongo-drivergolangv1.0.0, v1.0.3, v1.0.4, v1.1.0+54 more1.17.7604
go.mongodb.org/mongo-driver/v2golangv2.2.2, v2.3.0, v2.3.1, v2.4.02.4.212
OSV records
GHSA-cp6g-7hqx-qxhp
Also known as
GO-2026-5327

Charts affected

579 by stars
ChartLatestAffected imagesRadar Score
lokit3n1.0.01 of 1See more

loki t3n 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/loki:1.5.0922b3f412fdd
go.mongodb.org/mongo-driver@v1.1.0
1.17.7

Open the chart page →

2,869
stateful-data-generatortalhajuikar-helm-charts0.1.21 of 2See more

stateful-data-generator talhajuikar-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
go.mongodb.org/mongo-driver@v1.16.0
1.17.7

Open the chart page →

4,860
pingmetektonops0.1.21 of 1See more

pingme tektonops 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
khaliq/pingme:v0.2.749f96888d2ab
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

1,253
temporaltemporal0.28.92 of 13See more

temporal temporal 0.28.9

2 of the 13 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/prometheus/alertmanager:v0.23.09ab73a421b65
go.mongodb.org/mongo-driver@v1.5.1
1.17.7
quay.io/prometheus/prometheus:v2.31.1a8779cfe553e
go.mongodb.org/mongo-driver@v1.5.1
1.17.7

Open the chart page →

21,005
vehicle-dashboardtest-vehi-dash0.1.01 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
library/mongo:5.0.217c81758cb295
go.mongodb.org/mongo-driver@v1.10.3
1.17.7

Open the chart page →

20,270
the0the0Verified publisher0.9.82 of 9See more

the0 the0 0.9.8

2 of the 9 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
go.mongodb.org/mongo-driver@v1.17.3
1.17.7
ghcr.io/alexanderwanyoike/the0/runtime:1.14.7459010a02aff
go.mongodb.org/mongo-driver@v1.17.3
1.17.7

Open the chart page →

7,248
monitoringthl-chartsVerified publisher0.1.14 of 10See more

monitoring thl-charts 0.1.1

4 of the 10 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/grafana:8.5.042d3e6bc1865
go.mongodb.org/mongo-driver@v1.7.0
1.17.7
grafana/loki:2.5.0f9ef133793af
go.mongodb.org/mongo-driver@v1.7.5
1.17.7
quay.io/prometheus/alertmanager:v0.23.09ab73a421b65
go.mongodb.org/mongo-driver@v1.5.1
1.17.7
quay.io/prometheus/prometheus:v2.34.0b37103e03399
go.mongodb.org/mongo-driver@v1.7.5
1.17.7

Open the chart page →

18,908
prometheustnh11.6.02 of 6See more

prometheus tnh 11.6.0

2 of the 6 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
prom/alertmanager:v0.20.07e4e9f7a0954
go.mongodb.org/mongo-driver@v1.0.3
1.17.7
prom/prometheus:v2.19.0bfad037f95e5
go.mongodb.org/mongo-driver@v1.3.2
1.17.7

Open the chart page →

8,484
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

2,477
tfy-agenttruefoundryVerified publisher0.2.1031 of 5See more

tfy-agent truefoundry 0.2.103

1 of the 5 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/external-secrets:v2.4.19440a40b3947
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

681
tfy-lokitruefoundryVerified publisher0.1.62 of 2See more

tfy-loki truefoundry 0.1.6

2 of the 2 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/loki:2.9.1035b02acc6765
go.mongodb.org/mongo-driver@v1.11.2
1.17.7
grafana/promtail:2.9.1063a2e57a5b14
go.mongodb.org/mongo-driver@v1.11.2
1.17.7

Open the chart page →

2,813
truefoundry-monitoringtruefoundryVerified publisher0.1.62 of 8See more

truefoundry-monitoring truefoundry 0.1.6

2 of the 8 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/grafana:12.3.070d9599b186c
go.mongodb.org/mongo-driver@v1.17.4
1.17.7
quay.io/prometheus-operator/prometheus-operator:v0.88.0b4f51de53357
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

4,526
simple-mongodbtyk-helm0.1.11 of 1See more

simple-mongodb tyk-helm 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
go.mongodb.org/mongo-driver@v1.16.0
1.17.7

Open the chart page →

4,087
miniouninettsigma21.2.01 of 1See more

minio uninettsigma2 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
sigma2as/minio:20240306-3a2e4f5c284ead9ec3e
go.mongodb.org/mongo-driver@v1.10.2
1.17.7

Open the chart page →

4,960
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
go.mongodb.org/mongo-driver@v1.17.3
1.17.7

Open the chart page →

45,239
vals-operatorvals-operatorVerified publisher0.8.11 of 1See more

vals-operator vals-operator 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
ghcr.io/digitalis-io/vals-operator:v0.8.17c776499b8c9
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

696
twenty-crmvictorlane0.0.11 of 3See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
twentycrm/twenty-postgres-spilo:latest2f78405a78be
go.mongodb.org/mongo-driver@v1.5.1
1.17.7

Open the chart page →

13,459
ciliumvks-helm-chartsVerified publisher1.17.142 of 3See more

cilium vks-helm-charts 1.17.14

2 of the 3 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/cilium/cilium:v1.17.14cdcfab5b4466
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
quay.io/cilium/operator-generic:v1.17.14773886ec9337
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

4,046
consulwarjiang1.3.01 of 2See more

consul warjiang 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
hashicorp/consul:1.17.0712fe02d2f84
go.mongodb.org/mongo-driver@v1.11.0
1.17.7

Open the chart page →

4,060
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
go.mongodb.org/mongo-driver@v1.16.0
1.17.7

Open the chart page →

28,605
athens-proxywenerme0.5.21 of 2See more

athens-proxy wenerme 0.5.2

1 of the 2 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
gomods/athens:v0.11.0efb811df7844
go.mongodb.org/mongo-driver@v1.0.0
1.17.7

Open the chart page →

4,984
external-secretswenerme2.10.01 of 1See more

external-secrets wenerme 2.10.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/external-secrets:v2.10.0814117b0fd6d
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

77
juicefs-csi-driverwenerme0.32.51 of 5See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.32.595008ba63318
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

9,117
minio-standalonewenerme1.0.21 of 1See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2022-01-04T07-41-07Z1484c87239ea
go.mongodb.org/mongo-driver@v1.4.6
1.17.7

Open the chart page →

6,138
temporalwenerme0.15.12 of 13See more

temporal wenerme 0.15.1

2 of the 13 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
prom/alertmanager:v0.20.07e4e9f7a0954
go.mongodb.org/mongo-driver@v1.0.3
1.17.7
prom/prometheus:v2.16.0e4ca62c0d62f
go.mongodb.org/mongo-driver@v1.0.3
1.17.7

Open the chart page →

22,665
wexa-studiowexa-studio1.2.02 of 15See more

wexa-studio wexa-studio 1.2.0

2 of the 15 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.40b01ed3924e6
go.mongodb.org/mongo-driver@v1.12.1
1.17.7
minio/minio:RELEASE.2024-01-16T16-07-38Z4c4a4876193f
go.mongodb.org/mongo-driver@v1.13.1
1.17.7

Open the chart page →

14,983
opentelemetry-collectorwikimedia0.62.71 of 1See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
go.mongodb.org/mongo-driver@v1.12.0
1.17.7

Open the chart page →

2,022
ygdrassil-monitoringygdrassilVerified publisher0.4.04 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

4 of the 10 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/grafana:11.5.15781759b3d27
go.mongodb.org/mongo-driver@v1.16.1
1.17.7
prom/alertmanager:v0.28.0d5155cfac40a
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
quay.io/prometheus-operator/prometheus-config-reloader:v0.79.2193280a33bc1
go.mongodb.org/mongo-driver@v1.17.1
1.17.7
quay.io/prometheus/prometheus:v3.1.06559acbd5d77
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

9,381
zahori-consulzahoriVerified publisher1.0.11 of 2See more

zahori-consul zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
hashicorp/consul:1.15.3ddff34041c5c
go.mongodb.org/mongo-driver@v1.11.0
1.17.7

Open the chart page →

5,033

Container images carrying it

607 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/thanos/thanos:v0.36.1e542959e1b36
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
go.mongodb.org/mongo-driver@v1.13.1
1.17.7
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
go.mongodb.org/mongo-driver@v1.13.1
1.17.7
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb:4.4.5cf72810d33f5
go.mongodb.org/mongo-driver@v1.4.2
1.17.7
1
registry.gitlab.com/shortlink-org/shortlink/bff:latestf2194e526915
go.mongodb.org/mongo-driver@v1.17.6
1.17.7
1
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
go.mongodb.org/mongo-driver@v1.17.6
1.17.7
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.