StackRadar

CVE-2026-2303

Medium

Advisory

Published 10 Feb 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.002
14th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
581
of 17,781 indexed, latest versions
Container images
608
deployed by those charts
Fix available
2 of 2
affected packages

mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling

Carried by container images the latest versions of 581 of 17,781 indexed charts deploy, on 608 images.

Affected packageAffected versionsFixed inImages
go.mongodb.org/mongo-drivergolangv1.0.0, v1.0.3, v1.0.4, v1.1.0+54 more1.17.7605
go.mongodb.org/mongo-driver/v2golangv2.2.2, v2.3.0, v2.3.1, v2.4.02.4.212
OSV records
GHSA-cp6g-7hqx-qxhp
Also known as
GO-2026-5327

Charts affected

581 by stars
ChartLatestAffected imagesRadar Score
agentssynapse0.1.301 of 9See more

agents synapse 0.1.30

1 of the 9 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
jaegertracing/all-in-one:1.42.07d32a4eddec7
go.mongodb.org/mongo-driver@v1.10.0
1.17.7

Open the chart page →

7,244
lokit3n1.0.01 of 1See more

loki t3n 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/loki:1.5.0922b3f412fdd
go.mongodb.org/mongo-driver@v1.1.0
1.17.7

Open the chart page →

2,869
stateful-data-generatortalhajuikar-helm-charts0.1.21 of 2See more

stateful-data-generator talhajuikar-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
go.mongodb.org/mongo-driver@v1.16.0
1.17.7

Open the chart page →

4,860
pingmetektonops0.1.21 of 1See more

pingme tektonops 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
khaliq/pingme:v0.2.749f96888d2ab
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

1,253
temporaltemporal0.28.92 of 13See more

temporal temporal 0.28.9

2 of the 13 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/prometheus/alertmanager:v0.23.09ab73a421b65
go.mongodb.org/mongo-driver@v1.5.1
1.17.7
quay.io/prometheus/prometheus:v2.31.1a8779cfe553e
go.mongodb.org/mongo-driver@v1.5.1
1.17.7

Open the chart page →

21,005
vehicle-dashboardtest-vehi-dash0.1.01 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
library/mongo:5.0.217c81758cb295
go.mongodb.org/mongo-driver@v1.10.3
1.17.7

Open the chart page →

20,270
the0the0Verified publisher0.9.82 of 9See more

the0 the0 0.9.8

2 of the 9 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
go.mongodb.org/mongo-driver@v1.17.3
1.17.7
ghcr.io/alexanderwanyoike/the0/runtime:1.14.7459010a02aff
go.mongodb.org/mongo-driver@v1.17.3
1.17.7

Open the chart page →

7,248
monitoringthl-chartsVerified publisher0.1.14 of 10See more

monitoring thl-charts 0.1.1

4 of the 10 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/grafana:8.5.042d3e6bc1865
go.mongodb.org/mongo-driver@v1.7.0
1.17.7
grafana/loki:2.5.0f9ef133793af
go.mongodb.org/mongo-driver@v1.7.5
1.17.7
quay.io/prometheus/alertmanager:v0.23.09ab73a421b65
go.mongodb.org/mongo-driver@v1.5.1
1.17.7
quay.io/prometheus/prometheus:v2.34.0b37103e03399
go.mongodb.org/mongo-driver@v1.7.5
1.17.7

Open the chart page →

18,908
prometheustnh11.6.02 of 6See more

prometheus tnh 11.6.0

2 of the 6 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
prom/alertmanager:v0.20.07e4e9f7a0954
go.mongodb.org/mongo-driver@v1.0.3
1.17.7
prom/prometheus:v2.19.0bfad037f95e5
go.mongodb.org/mongo-driver@v1.3.2
1.17.7

Open the chart page →

8,484
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

2,477
tfy-agenttruefoundryVerified publisher0.2.1031 of 5See more

tfy-agent truefoundry 0.2.103

1 of the 5 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/external-secrets:v2.4.19440a40b3947
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

681
tfy-lokitruefoundryVerified publisher0.1.62 of 2See more

tfy-loki truefoundry 0.1.6

2 of the 2 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/loki:2.9.1035b02acc6765
go.mongodb.org/mongo-driver@v1.11.2
1.17.7
grafana/promtail:2.9.1063a2e57a5b14
go.mongodb.org/mongo-driver@v1.11.2
1.17.7

Open the chart page →

2,813
truefoundry-monitoringtruefoundryVerified publisher0.1.62 of 8See more

truefoundry-monitoring truefoundry 0.1.6

2 of the 8 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/grafana:12.3.070d9599b186c
go.mongodb.org/mongo-driver@v1.17.4
1.17.7
quay.io/prometheus-operator/prometheus-operator:v0.88.0b4f51de53357
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

4,526
simple-mongodbtyk-helm0.1.11 of 1See more

simple-mongodb tyk-helm 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
go.mongodb.org/mongo-driver@v1.16.0
1.17.7

Open the chart page →

4,087
miniouninettsigma21.2.01 of 1See more

minio uninettsigma2 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
sigma2as/minio:20240306-3a2e4f5c284ead9ec3e
go.mongodb.org/mongo-driver@v1.10.2
1.17.7

Open the chart page →

4,960
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
go.mongodb.org/mongo-driver@v1.17.3
1.17.7

Open the chart page →

45,239
vals-operatorvals-operatorVerified publisher0.8.11 of 1See more

vals-operator vals-operator 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
ghcr.io/digitalis-io/vals-operator:v0.8.17c776499b8c9
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

696
twenty-crmvictorlane0.0.11 of 3See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
twentycrm/twenty-postgres-spilo:latest2f78405a78be
go.mongodb.org/mongo-driver@v1.5.1
1.17.7

Open the chart page →

13,459
ciliumvks-helm-chartsVerified publisher1.17.142 of 3See more

cilium vks-helm-charts 1.17.14

2 of the 3 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
quay.io/cilium/cilium:v1.17.14cdcfab5b4466
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
quay.io/cilium/operator-generic:v1.17.14773886ec9337
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

4,046
consulwarjiang1.3.01 of 2See more

consul warjiang 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
hashicorp/consul:1.17.0712fe02d2f84
go.mongodb.org/mongo-driver@v1.11.0
1.17.7

Open the chart page →

4,060
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
go.mongodb.org/mongo-driver@v1.16.0
1.17.7

Open the chart page →

28,605
athens-proxywenerme0.5.21 of 2See more

athens-proxy wenerme 0.5.2

1 of the 2 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
gomods/athens:v0.11.0efb811df7844
go.mongodb.org/mongo-driver@v1.0.0
1.17.7

Open the chart page →

4,984
external-secretswenerme2.10.01 of 1See more

external-secrets wenerme 2.10.0

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/external-secrets:v2.10.0814117b0fd6d
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

77
juicefs-csi-driverwenerme0.32.51 of 5See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.32.595008ba63318
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

9,117
mesherywenerme1.0.691 of 1See more

meshery wenerme 1.0.69

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
meshery/meshery:stable-latest9b68e81d392e
go.mongodb.org/mongo-driver@v1.17.6
1.17.7

Open the chart page →

1,407
minio-standalonewenerme1.0.21 of 1See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2022-01-04T07-41-07Z1484c87239ea
go.mongodb.org/mongo-driver@v1.4.6
1.17.7

Open the chart page →

6,138
temporalwenerme0.15.12 of 13See more

temporal wenerme 0.15.1

2 of the 13 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
prom/alertmanager:v0.20.07e4e9f7a0954
go.mongodb.org/mongo-driver@v1.0.3
1.17.7
prom/prometheus:v2.16.0e4ca62c0d62f
go.mongodb.org/mongo-driver@v1.0.3
1.17.7

Open the chart page →

22,665
wexa-studiowexa-studio1.2.02 of 15See more

wexa-studio wexa-studio 1.2.0

2 of the 15 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.40b01ed3924e6
go.mongodb.org/mongo-driver@v1.12.1
1.17.7
minio/minio:RELEASE.2024-01-16T16-07-38Z4c4a4876193f
go.mongodb.org/mongo-driver@v1.13.1
1.17.7

Open the chart page →

14,983
opentelemetry-collectorwikimedia0.62.71 of 1See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
go.mongodb.org/mongo-driver@v1.12.0
1.17.7

Open the chart page →

2,022
ygdrassil-monitoringygdrassilVerified publisher0.4.04 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

4 of the 10 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
grafana/grafana:11.5.15781759b3d27
go.mongodb.org/mongo-driver@v1.16.1
1.17.7
prom/alertmanager:v0.28.0d5155cfac40a
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
quay.io/prometheus-operator/prometheus-config-reloader:v0.79.2193280a33bc1
go.mongodb.org/mongo-driver@v1.17.1
1.17.7
quay.io/prometheus/prometheus:v3.1.06559acbd5d77
go.mongodb.org/mongo-driver@v1.14.0
1.17.7

Open the chart page →

9,381
zahori-consulzahoriVerified publisher1.0.11 of 2See more

zahori-consul zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-2303.

Container imageDigestPackageFixed in
hashicorp/consul:1.15.3ddff34041c5c
go.mongodb.org/mongo-driver@v1.11.0
1.17.7

Open the chart page →

5,033

Container images carrying it

608 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
free5gc/chf:v3.4.3e2a4dd98a4ed
go.mongodb.org/mongo-driver@v1.11.3
1.17.7
2
free5gc/nrf:v3.4.399e46b860efb
go.mongodb.org/mongo-driver@v1.8.4
1.17.7
2
free5gc/pcf:v3.4.3f712e8ecd927
go.mongodb.org/mongo-driver@v1.8.4
1.17.7
2
free5gc/udr:v3.4.3c0783bcdcbdc
go.mongodb.org/mongo-driver@v1.8.4
1.17.7
2
free5gc/webui:v3.4.39adeb18492cb
go.mongodb.org/mongo-driver@v1.11.3
1.17.7
2
governify/dashboard:lateste83a17ba5038
go.mongodb.org/mongo-driver@v1.5.2
1.17.7
2
grafana/alloy:v1.8.17790f6f7fbd8
go.mongodb.org/mongo-driver@v1.17.1
1.17.7
2
grafana/alloy:v1.12.2f94b1c82957a
go.mongodb.org/mongo-driver@v1.17.4
go.mongodb.org/mongo-driver/v2@v2.3.0
1.17.7
2.4.2
2
grafana/grafana:9.2.4057896e23443
go.mongodb.org/mongo-driver@v1.10.0
1.17.7
2
grafana/grafana:11.1.0079600c9517b
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
2
grafana/grafana:12.3.12175aaa91c96
go.mongodb.org/mongo-driver@v1.17.4
1.17.7
2
grafana/grafana:8.5.042d3e6bc1865
go.mongodb.org/mongo-driver@v1.7.0
1.17.7
2
grafana/grafana:11.1.4886b56d5534e
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
2
grafana/grafana:12.3.39e1e77ade304
go.mongodb.org/mongo-driver@v1.17.4
1.17.7
2
grafana/grafana:11.4.0d8ea37798ccc
go.mongodb.org/mongo-driver@v1.16.1
1.17.7
2
grafana/grafana:12.4.1e932bd6ed0e0
go.mongodb.org/mongo-driver@v1.17.6
1.17.7
2
grafana/loki:1.5.0922b3f412fdd
go.mongodb.org/mongo-driver@v1.1.0
1.17.7
2
grafana/loki:3.1.0d947e68a84d9
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
2
grafana/loki:2.5.0f9ef133793af
go.mongodb.org/mongo-driver@v1.7.5
1.17.7
2
grafana/tempo:2.5.0f0200a9bff6d
go.mongodb.org/mongo-driver@v1.15.0
1.17.7
2
hashicorp/consul:1.14.2e38576edcdfd
go.mongodb.org/mongo-driver@v1.10.0
1.17.7
2
hashicorp/vault:1.8.34db614d40d0e
go.mongodb.org/mongo-driver@v1.4.6
1.17.7
2
hashicorp/vault:1.15.26b4e5dadf082
go.mongodb.org/mongo-driver@v1.12.1
1.17.7
2
hashicorp/vault:1.12.18de4d5f31b38
go.mongodb.org/mongo-driver@v1.7.3
1.17.7
2
ilum/mongodb:6.0.542b6d774c37d
go.mongodb.org/mongo-driver@v1.10.3
1.17.7
2
jaegertracing/all-in-one:1.3104d224a9999b
go.mongodb.org/mongo-driver@v1.7.5
1.17.7
2
meshery/meshery:stable-latest9b68e81d392e
go.mongodb.org/mongo-driver@v1.17.6
1.17.7
2
openpolicyagent/gatekeeper:v3.4.0-rc.1825370bdb3c3
go.mongodb.org/mongo-driver@v1.4.6
1.17.7
2
oryd/kratos:v1.0.0d06fc5845f63
go.mongodb.org/mongo-driver@v1.10.3
1.17.7
2
oryd/kratos:v1.3.1fe2428f103a6
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
2
oryd/oathkeeper:v0.40.6e8cb9b79a89c
go.mongodb.org/mongo-driver@v1.10.3
1.17.7
2
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
2
polyaxon/polyaxon-operator:2.16.42716f552b301
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
2
prom/prometheus:v2.17.242d2395cd719
go.mongodb.org/mongo-driver@v1.0.3
1.17.7
2
prom/prometheus:v2.52.05c435642ca4d
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
2
prom/prometheus:v2.37.98176adea328e
go.mongodb.org/mongo-driver@v1.8.3
1.17.7
2
prom/prometheus:v2.48.1a67e5e402ff5
go.mongodb.org/mongo-driver@v1.12.0
1.17.7
2
prom/prometheus:v2.21.0d43417c260e5
go.mongodb.org/mongo-driver@v1.3.2
1.17.7
2
streamnative/apache-pulsar-grafana-dashboard-k8s:0.1.20e6d7aa3ef32
go.mongodb.org/mongo-driver@v1.11.1
1.17.7
2
thanosio/thanos:v0.41.0cf3e9b292e43
go.mongodb.org/mongo-driver@v1.17.4
1.17.7
2
zhenghaoz/gorse-master:0.4.12033046b432ec
go.mongodb.org/mongo-driver@v1.10.3
1.17.7
2
zhenghaoz/gorse-server:0.4.1239c565685b01
go.mongodb.org/mongo-driver@v1.10.3
1.17.7
2
zhenghaoz/gorse-worker:0.4.12f7739f64c9b0
go.mongodb.org/mongo-driver@v1.10.3
1.17.7
2
ghcr.io/buoyantio/prometheus:v2.55.12659f4c2ebb7
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
2
ghcr.io/juniorjpdj/containers/openssl-kubectl:1.36.1-r358afba209ea0
go.mongodb.org/mongo-driver@v1.14.0
1.17.7
2
ghcr.io/nucleuscloud/neosync/api:0.5.41e2abb798f29f
go.mongodb.org/mongo-driver@v1.17.3
1.17.7
2
ghcr.io/nucleuscloud/neosync/worker:0.5.4196f42450c5b1
go.mongodb.org/mongo-driver@v1.17.3
1.17.7
2
quay.io/argoproj/argocd:v2.14.115fc69e31c755
go.mongodb.org/mongo-driver@v1.17.1
1.17.7
2
quay.io/groundcover/grafana:9.3.18c65b333a3d3
go.mongodb.org/mongo-driver@v1.10.0
1.17.7
2
quay.io/minio/minio:RELEASE.2023-09-30T07-02-29Z6262bc9a2730
go.mongodb.org/mongo-driver@v1.12.1
1.17.7
2

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.