StackRadar

CVE-2026-26958

Medium

Advisory

Published 17 Feb 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.004
30th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
215
of 17,781 indexed, latest versions
Container images
198
deployed by those charts
Fix available
1 of 1
affected package

filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity

Carried by container images the latest versions of 215 of 17,781 indexed charts deploy, on 198 images.

Affected packageAffected versionsFixed inImages
filippo.io/edwards25519golangv1.0.0, v1.0.0-rc.1, v1.1.01.1.1198
OSV records
GHSA-fw7p-63qq-7hpr
Also known as
GO-2026-4503

Charts affected

215 by stars
ChartLatestAffected imagesRadar Score
ctlogsigstoreVerified publisher0.2.681 of 4See more

ctlog sigstore 0.2.68

1 of the 4 container images this version deploys carry CVE-2026-26958.

Container imageDigestPackageFixed in
ghcr.io/sigstore/scaffolding/ct_server:v0.7.3166664ba563e7
filippo.io/edwards25519@v1.1.0
1.1.1

Open the chart page →

2,728
trilliansigstoreVerified publisher0.3.171 of 5See more

trillian sigstore 0.3.17

1 of the 5 container images this version deploys carry CVE-2026-26958.

Container imageDigestPackageFixed in
ghcr.io/sigstore/scaffolding/createdbdigest-pinned3cee6c78973b
filippo.io/edwards25519@v1.1.0
1.1.1

Open the chart page →

2,808
tailscale-operatorskyloud-helm-chartsVerified publisher1.70.31 of 1See more

tailscale-operator skyloud-helm-charts 1.70.3

1 of the 1 container images this version deploys carry CVE-2026-26958.

Container imageDigestPackageFixed in
tailscale/k8s-operator:v1.70.08edd06cf5bac
filippo.io/edwards25519@v1.1.0
1.1.1

Open the chart page →

1,045
kedasoftonic2.17.02 of 3See more

keda softonic 2.17.0

2 of the 3 container images this version deploys carry CVE-2026-26958.

Container imageDigestPackageFixed in
ghcr.io/kedacore/keda:2.17.0112fc427d933
filippo.io/edwards25519@v1.1.0
1.1.1
ghcr.io/kedacore/keda-metrics-apiserver:2.17.0167fd532bd43
filippo.io/edwards25519@v1.1.0
1.1.1

Open the chart page →

2,583
retail-store-sample-catalog-chartstacksimplifyVerified publisher2.0.01 of 1See more

retail-store-sample-catalog-chart stacksimplify 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-26958.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-catalog:1.3.0b654b266fa32
filippo.io/edwards25519@v1.1.0
1.1.1

Open the chart page →

759
wonder-mesh-netstrrl-helm2026.629.01 of 3See more

wonder-mesh-net strrl-helm 2026.629.0

1 of the 3 container images this version deploys carry CVE-2026-26958.

Container imageDigestPackageFixed in
headscale/headscale:0.27.1cd37b3001857
filippo.io/edwards25519@v1.1.0
1.1.1

Open the chart page →

5,063
ping-exporterth-chartsVerified publisher0.1.11 of 1See more

ping-exporter th-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-26958.

Container imageDigestPackageFixed in
czerwonk/ping_exporter:v1.1.394f51e1ef1e2
filippo.io/edwards25519@v1.1.0
1.1.1

Open the chart page →

1,236
the0the0Verified publisher0.9.81 of 9See more

the0 the0 0.9.8

1 of the 9 container images this version deploys carry CVE-2026-26958.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
filippo.io/edwards25519@v1.1.0
1.1.1

Open the chart page →

7,248
tfy-cloudflaredtruefoundryVerified publisher0.5.01 of 2See more

tfy-cloudflared truefoundry 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-26958.

Container imageDigestPackageFixed in
public.ecr.aws/docker/library/caddy:2.6.387cbd356af2e
filippo.io/edwards25519@v1.0.0
1.1.1

Open the chart page →

2,015
opencloudunxwaresVerified publisher0.2.32 of 13See more

opencloud unxwares 0.2.3

2 of the 13 container images this version deploys carry CVE-2026-26958.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
filippo.io/edwards25519@v1.1.0
1.1.1
opencloudeu/opencloud-rolling:2.1.0f9634bb04905
filippo.io/edwards25519@v1.1.0
1.1.1

Open the chart page →

45,239
vals-operatorvals-operatorVerified publisher0.8.11 of 1See more

vals-operator vals-operator 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-26958.

Container imageDigestPackageFixed in
ghcr.io/digitalis-io/vals-operator:v0.8.17c776499b8c9
filippo.io/edwards25519@v1.1.0
1.1.1

Open the chart page →

696
argo-eventswenerme2.4.271 of 1See more

argo-events wenerme 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-26958.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
filippo.io/edwards25519@v1.1.0
1.1.1

Open the chart page →

969
juicefs-csi-driverwenerme0.32.51 of 5See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-26958.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.32.595008ba63318
filippo.io/edwards25519@v1.1.0
1.1.1

Open the chart page →

9,117
wexa-studiowexa-studio1.2.02 of 15See more

wexa-studio wexa-studio 1.2.0

2 of the 15 container images this version deploys carry CVE-2026-26958.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
filippo.io/edwards25519@v1.1.0
1.1.1
temporalio/server:1.29.1c1e3326b2ce1
filippo.io/edwards25519@v1.1.0
1.1.1

Open the chart page →

14,983
prometheusalertygqygq2Verified publisher1.0.01 of 1See more

prometheusalert ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-26958.

Container imageDigestPackageFixed in
feiyu563/prometheus-alert:v4.9.1224cfa68cbd9
filippo.io/edwards25519@v1.1.0
1.1.1

Open the chart page →

1,611

Container images carrying it

198 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
minio/minio:latest:RELEASE.2025-09-07T16-13-09Z14cea493d9a3
filippo.io/edwards25519@v1.1.0
1.1.1
16
quay.io/minio/minio:RELEASE.2024-12-18T13-15-44Z1dce27c494a1
filippo.io/edwards25519@v1.1.0
1.1.1
8
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
filippo.io/edwards25519@v1.1.0
1.1.1
7
caddy/ingress:v0.2.118d1366fc0e9
filippo.io/edwards25519@v1.0.0
1.1.1
3
cloudpirates/image-minio:RELEASE.2025-10-15T17-29-55Z-hardened8dc02a7e5093
filippo.io/edwards25519@v1.1.0
1.1.1
3
vikunja/vikunja:0.24.6ed1f3ed467fe
filippo.io/edwards25519@v1.1.0
1.1.1
3
ghcr.io/sigstore/scaffolding/createdb3cee6c78973b
filippo.io/edwards25519@v1.1.0
1.1.1
3
ghcr.io/sigstore/scaffolding/ct_server:v0.7.3166664ba563e7
filippo.io/edwards25519@v1.1.0
1.1.1
3
alpine/k8s:1.32.12048f8d9c8cc7
filippo.io/edwards25519@v1.1.0
1.1.1
2
gotify/server:3.1.0be44495e4609
filippo.io/edwards25519@v1.1.0
1.1.1
2
grafana/alloy:v1.8.17790f6f7fbd8
filippo.io/edwards25519@v1.1.0
1.1.1
2
grafana/alloy:v1.12.2f94b1c82957a
filippo.io/edwards25519@v1.1.0
1.1.1
2
hoppscotch/hoppscotch:2024.8.2f1da831950b7
filippo.io/edwards25519@v1.0.0
1.1.1
2
mattermost/mattermost-team-edition:10.11.2b8bd1246cb3a
filippo.io/edwards25519@v1.1.0
1.1.1
2
opencloudeu/opencloud-rolling:2.1.0f9634bb04905
filippo.io/edwards25519@v1.1.0
1.1.1
2
oryd/kratos:v1.3.1fe2428f103a6
filippo.io/edwards25519@v1.1.0
1.1.1
2
ghcr.io/celestiaorg/celestia-node:v0.27.5-mocha4768ea1c5fd2
filippo.io/edwards25519@v1.1.0
1.1.1
2
ghcr.io/cosmos/gaia:v25.1.0f115777d1112
filippo.io/edwards25519@v1.1.0
1.1.1
2
ghcr.io/nucleuscloud/neosync/api:0.5.41e2abb798f29f
filippo.io/edwards25519@v1.1.0
1.1.1
2
ghcr.io/nucleuscloud/neosync/worker:0.5.4196f42450c5b1
filippo.io/edwards25519@v1.1.0
1.1.1
2
ghcr.io/sigstore/scaffolding/createcerts7f59f7c08d1a
filippo.io/edwards25519@v1.1.0
1.1.1
2
ghcr.io/stashed/stash-ui-server:v0.23.047cffbc65700
filippo.io/edwards25519@v1.1.0
1.1.1
2
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
filippo.io/edwards25519@v1.1.0
1.1.1
2
aboogie/login_test_backend:new9c41a4483ac8
filippo.io/edwards25519@v1.1.0
1.1.1
1
alpine/k8s:1.31.137a319b15cfc9
filippo.io/edwards25519@v1.1.0
1.1.1
1
apache/answer:2.0.2a0d71b0e30a5
filippo.io/edwards25519@v1.1.0
1.1.1
1
apache/doris:operator-latest3a4422656592
filippo.io/edwards25519@v1.1.0
1.1.1
1
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
filippo.io/edwards25519@v1.1.0
1.1.1
1
baserow/baserow:1.30.1df0c42eb67e8
filippo.io/edwards25519@v1.0.0
1.1.1
1
bitnamilegacy/minio:2024.8.3-debian-12-r15501c419f42e
filippo.io/edwards25519@v1.1.0
1.1.1
1
bitnamilegacy/minio:2025.7.23-debian-12-r56dabb4a2088c
filippo.io/edwards25519@v1.1.0
1.1.1
1
bitnamilegacy/minio:2025.7.23-debian-12-r08935e75fa5d1
filippo.io/edwards25519@v1.1.0
1.1.1
1
bitnamilegacy/minio:2024.7.4-debian-12-r0952f86d1116c
filippo.io/edwards25519@v1.1.0
1.1.1
1
bitnamilegacy/minio:2025.3.12-debian-12-r0ba9f3b4b0b00
filippo.io/edwards25519@v1.1.0
1.1.1
1
bitnamilegacy/minio:2024.12.18-debian-12-r1c0ede65eb88e
filippo.io/edwards25519@v1.1.0
1.1.1
1
bitnamilegacy/minio:2024.12.18-debian-12-r0cce234b4381a
filippo.io/edwards25519@v1.1.0
1.1.1
1
bitnamilegacy/minio:2025.4.22-debian-12-r1d7cd0e172c4c
filippo.io/edwards25519@v1.1.0
1.1.1
1
bitnamilegacy/seaweedfs:3.87.0-debian-12-r10cb31d0fc356
filippo.io/edwards25519@v1.1.0
1.1.1
1
burningalchemist/sql_exporter:0.16.0b8e4757c7def
filippo.io/edwards25519@v1.1.0
1.1.1
1
casbin/casdoor:3.62.17729da148c61
filippo.io/edwards25519@v1.1.0
1.1.1
1
casbin/casdoor:3.62.0e08231f16c00
filippo.io/edwards25519@v1.1.0
1.1.1
1
castopod/castopod:1.15.54e4f0440520f
filippo.io/edwards25519@v1.1.0
1.1.1
1
coordimap/coordimap-agent:latest7748fd0fae9f
filippo.io/edwards25519@v1.1.0
1.1.1
1
cybrarist/discount-bandit:v4.0.4e9e2447ac666
filippo.io/edwards25519@v1.1.0
1.1.1
1
czerwonk/ping_exporter:v1.1.394f51e1ef1e2
filippo.io/edwards25519@v1.1.0
1.1.1
1
dexidp/dex:v2.39.1-distroless43655afd1a8f
filippo.io/edwards25519@v1.1.0
1.1.1
1
dgraph/dgraph:v24.1.4b57fa31f9b7f
filippo.io/edwards25519@v1.1.0
1.1.1
1
emqx/ecp-emqx-agent-downloader:2.5.1a8431baa7950
filippo.io/edwards25519@v1.1.0
1.1.1
1
emqx/ecp-main:2.5.1fa876f71e5d6
filippo.io/edwards25519@v1.1.0
1.1.1
1
feiyu563/prometheus-alert:v4.9.1224cfa68cbd9
filippo.io/edwards25519@v1.1.0
1.1.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.