CVE-2026-27136

Unscored

Advisory

Published 22 May 2026In the index since 5 Sept 2026

Severity: Unscored; worst across findings
CVSS: —; base score, highest
EPSS: 0.002; 13th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,997; of 17,781 indexed, latest versions
Container images: 3,655; deployed by those charts
Fix available: 1 of 1; affected package

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

Carried by container images the latest versions of 2,997 of 17,781 indexed charts deploy, on 3,655 images.

Affected package	Affected versions	Fixed in	Images
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+219 more	0.55.0	3,655

OSV records: GO-2026-5030

Charts affected

2,997 by stars

Chart

Latest

Affected images

Radar Score

ceph-csi-cephfsceph-csi

3.17.1

6 of 6 See more

ceph-csi-cephfs ceph-csi 3.17.1

6 of the 6 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.17.1	0b62db8afc9b	golang.org/x/net@v0.53.0	0.55.0
registry.k8s.io/sig-storage/csi-attacher :v4.11.0	b74b05b39501	golang.org/x/net@v0.47.0	0.55.0
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.16.0	ab482308a492	golang.org/x/net@v0.49.0	0.55.0
registry.k8s.io/sig-storage/csi-provisioner :v6.2.0	6be9f63ca4ca	golang.org/x/net@v0.51.0	0.55.0
registry.k8s.io/sig-storage/csi-resizer :v2.1.0	589e525cddef	golang.org/x/net@v0.48.0	0.55.0
registry.k8s.io/sig-storage/csi-snapshotter :v8.5.0	da081c27e8a6	golang.org/x/net@v0.49.0	0.55.0

Open the chart page →

4,061

ceph-csi-rbdceph-csi

3.17.1

6 of 6 See more

ceph-csi-rbd ceph-csi 3.17.1

6 of the 6 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.17.1	0b62db8afc9b	golang.org/x/net@v0.53.0	0.55.0
registry.k8s.io/sig-storage/csi-attacher :v4.11.0	b74b05b39501	golang.org/x/net@v0.47.0	0.55.0
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.16.0	ab482308a492	golang.org/x/net@v0.49.0	0.55.0
registry.k8s.io/sig-storage/csi-provisioner :v6.2.0	6be9f63ca4ca	golang.org/x/net@v0.51.0	0.55.0
registry.k8s.io/sig-storage/csi-resizer :v2.1.0	589e525cddef	golang.org/x/net@v0.48.0	0.55.0
registry.k8s.io/sig-storage/csi-snapshotter :v8.5.0	da081c27e8a6	golang.org/x/net@v0.49.0	0.55.0

Open the chart page →

4,061

chaos-meshchaos-mesh

2.8.4

4 of 4 See more

chaos-mesh chaos-mesh 2.8.4

4 of the 4 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
ghcr.io/chaos-mesh/chaos-coredns :v0.2.8	38bfdf5e3774	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e	0.55.0
ghcr.io/chaos-mesh/chaos-daemon :v2.8.4	0d28dbd95b03	golang.org/x/net@v0.52.0	0.55.0
ghcr.io/chaos-mesh/chaos-dashboard :v2.8.4	8a8ec8d4c9ea	golang.org/x/net@v0.52.0	0.55.0
ghcr.io/chaos-mesh/chaos-mesh :v2.8.4	9e48285bb44c	golang.org/x/net@v0.52.0	0.55.0

Open the chart page →

6,342

csi-driver-nfscsi-driver-nfs

4.13.4

4 of 6 See more

csi-driver-nfs csi-driver-nfs 4.13.4

4 of the 6 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.17.0	f9de845b1701	golang.org/x/net@v0.54.0	0.55.0
registry.k8s.io/sig-storage/csi-resizer :v2.2.0	a2d40c1c3ccb	golang.org/x/net@v0.49.0	0.55.0
registry.k8s.io/sig-storage/csi-snapshotter :v8.6.0	42af0929bcd6	golang.org/x/net@v0.54.0	0.55.0
registry.k8s.io/sig-storage/livenessprobe :v2.19.0	06da0d5b8908	golang.org/x/net@v0.54.0	0.55.0

Open the chart page →

3,324

mariadb-operatormariadb-operator

26.6.0

1 of 1 See more

mariadb-operator mariadb-operator 26.6.0

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
ghcr.io/mariadb-operator/mariadb-operator :26.6.0	a5e17b48f08e	golang.org/x/net@v0.54.0	0.55.0

Open the chart page →

377

atlantisatlantis

6.15.0

1 of 1 See more

atlantis atlantis 6.15.0

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
ghcr.io/runatlantis/atlantis :v0.47.1	511231955463	golang.org/x/net@v0.23.0	0.55.0

Open the chart page →

1,891

grafana-agentgrafana

0.44.2

1 of 2 See more

grafana-agent grafana 0.44.2

1 of the 2 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
grafana/agent :v0.44.2	3364714a2f64	golang.org/x/net@v0.33.0	0.55.0

Open the chart page →

3,475

vclusterloft

0.0.0-ci.3

1 of 2 See more

vcluster loft 0.0.0-ci.3

1 of the 2 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
rancher/k3s :v1.26.0-k3s1	9380f5dbae9a	golang.org/x/net@v0.1.1-0.20221027164007-c63010009c80	0.55.0

Open the chart page →

2,453

milvusmilvus

4.0.31

4 of 5 See more

milvus milvus 4.0.31

4 of the 5 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
milvusdb/etcd :3.5.5-r2	102aac62827b	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2	0.55.0
milvusdb/milvus :v2.2.13	a3a55e1c1497	golang.org/x/net@v0.10.0	0.55.0
milvusdb/milvus-config-tool :v0.1.1	2212dfb61401	golang.org/x/net@v0.0.0-20220706163947-c90051bbdb60	0.55.0
minio/minio :RELEASE.2023-03-20T20-16-18Z	6d770d7f255c	golang.org/x/net@v0.8.0	0.55.0

Open the chart page →

32,259

cockroachdbcockroachdb

22.0.3

1 of 3 See more

cockroachdb cockroachdb 22.0.3

1 of the 3 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
cockroachdb/cockroach-self-signer-cert :1.10	07a49acec18d	golang.org/x/net@v0.38.0	0.55.0

Open the chart page →

744

clearmlallegroai

7.15.0

1 of 4 See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
bitnamilegacy/mongodb :6.0.10-debian-11-r8	42319decb591	golang.org/x/net@v0.14.0	0.55.0

Open the chart page →

10,622

semaphoresemaphoreui

16.2.2

1 of 1 See more

semaphore semaphoreui 16.2.2

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
semaphoreui/semaphore :v2.18.3	e9260bfa8255	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

2,221

signozsignoz

0.141.1

2 of 5 See more

signoz signoz 0.141.1

2 of the 5 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.21.2	cd9252644ce0	golang.org/x/net@v0.7.0	0.55.0
altinity/metrics-exporter :0.21.2	df3d57215356	golang.org/x/net@v0.7.0	0.55.0

Open the chart page →

7,568

community-operatormongodb-helm-charts

0.13.0

1 of 1 See more

community-operator mongodb-helm-charts 0.13.0

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
quay.io/mongodb/mongodb-kubernetes-operator :0.13.0	2dcc6393e6f7	golang.org/x/net@v0.39.0	0.55.0

Open the chart page →

1,127

prometheus-kafka-exporterprometheus-community

4.0.0

1 of 1 See more

prometheus-kafka-exporter prometheus-community 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
danielqsj/kafka-exporter :v1.9.0	4150e46b2e96	golang.org/x/net@v0.34.0	0.55.0

Open the chart page →

716

node-local-dnsdeliveryhero

2.9.2

1 of 1 See more

node-local-dns deliveryhero 2.9.2

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
registry.k8s.io/dns/k8s-dns-node-cache :1.26.7	8b9a78d101a1	golang.org/x/net@v0.46.0	0.55.0

Open the chart page →

1,685

rancherrancher-latest

2.15.1

2 of 2 See more

rancher rancher-latest 2.15.1

2 of the 2 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
rancher/rancher :v2.15.1	5f6c4dc52a05	golang.org/x/net@v0.52.0	0.55.0
rancher/shell :v0.8.1	f293af9c635f	golang.org/x/net@v0.49.0	0.55.0

Open the chart page →

1,456

sealed-secretsbitnami

2.5.19

1 of 1 See more

sealed-secrets bitnami 2.5.19

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
bitnami/sealed-secrets-controller :0.31.0-debian-12-r0	74eaff41382b	golang.org/x/net@v0.42.0	0.55.0

Open the chart page →

643

difydouban

0.10.0

2 of 6 See more

dify douban 0.10.0

2 of the 6 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
langgenius/dify-plugin-daemon :0.5.1-local	8269050f192e	golang.org/x/net@v0.42.0	0.55.0
langgenius/dify-sandbox :0.2.12	4e65e8a351a2	golang.org/x/net@v0.40.0	0.55.0

Open the chart page →

19,391

dragonflydragonfly

1.8.4

1 of 3 See more

dragonfly dragonfly 1.8.4

1 of the 3 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
dragonflyoss/scheduler :v2.5.2-rc.0	6d710dc2bae0	golang.org/x/net@v0.48.0	0.55.0

Open the chart page →

3,787

secrets-store-csi-driversecret-store-csi-driver

1.6.1

2 of 4 See more

secrets-store-csi-driver secret-store-csi-driver 1.6.1

2 of the 4 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.16.0	ab482308a492	golang.org/x/net@v0.49.0	0.55.0
registry.k8s.io/sig-storage/livenessprobe :v2.18.0	c4cc074199c0	golang.org/x/net@v0.49.0	0.55.0

Open the chart page →

1,766

stackgres-operatorstackgres-charts

1.19.1

1 of 2 See more

stackgres-operator stackgres-charts 1.19.1

1 of the 2 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
quay.io/ongres/kubectl :v1.25.16-build-6.53	04dada9e4503	golang.org/x/net@v0.17.0	0.55.0

Open the chart page →

2,119

opensearch-operatoropensearch-operator

3.0.2

1 of 1 See more

opensearch-operator opensearch-operator 3.0.2

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch-operator :3.0.0-alpha	f78bbdd1a386	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

603

pulsarapache

4.7.0

6 of 10 See more

pulsar apache 4.7.0

6 of the 10 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
alpine/k8s :1.32.12	048f8d9c8cc7	golang.org/x/net@v0.47.0	0.55.0
grafana/grafana :12.4.1	e932bd6ed0e0	golang.org/x/net@v0.49.0	0.55.0
rancher/kubectl :v1.25.0	85a0d1148784	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b	0.55.0
victoriametrics/operator :v0.68.3	f52e1bd679cb	golang.org/x/net@v0.49.0	0.55.0
quay.io/prometheus/node-exporter :v1.10.2	337ff1d356b6	golang.org/x/net@v0.44.0	0.55.0
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	golang.org/x/net@v0.48.0	0.55.0

Open the chart page →

9,864

miniocloudpirates-minio

0.13.4

1 of 1 See more

minio cloudpirates-minio 0.13.4

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
cloudpirates/image-minio :RELEASE.2025-10-15T17-29-55Z-hardened	8dc02a7e5093	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

961

vertical-pod-autoscalercowboysysop

11.1.1

4 of 4 See more

vertical-pod-autoscaler cowboysysop 11.1.1

4 of the 4 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
bitnamilegacy/kubectl :1.29.3	f5fc0d561d9e	golang.org/x/net@v0.19.0	0.55.0
registry.k8s.io/autoscaling/vpa-admission-controller :1.5.1	9928d59477fb	golang.org/x/net@v0.43.0	0.55.0
registry.k8s.io/autoscaling/vpa-recommender :1.5.1	e629c61b75eb	golang.org/x/net@v0.43.0	0.55.0
registry.k8s.io/autoscaling/vpa-updater :1.5.1	cba2aa4b3239	golang.org/x/net@v0.43.0	0.55.0

Open the chart page →

6,927

difydify-helm

0.38.0

1 of 11 See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
langgenius/dify-sandbox :0.2.15	750e1111426e	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

22,002

pyroscopegrafana

2.3.1

2 of 3 See more

pyroscope grafana 2.3.1

2 of the 3 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
grafana/alloy :v1.12.2	f94b1c82957a	golang.org/x/net@v0.46.0	0.55.0
quay.io/prometheus-operator/prometheus-config-reloader :v0.81.0	959d47672fbf	golang.org/x/net@v0.37.0	0.55.0

Open the chart page →

3,157

botkubeinfracloudio

1.14.0

1 of 1 See more

botkube infracloudio 1.14.0

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
ghcr.io/kubeshop/botkube :v1.14.0	c6fe64c7bfcd	golang.org/x/net@v0.23.0	0.55.0

Open the chart page →

1,097

operatorminio-operator

7.1.1

1 of 1 See more

operator minio-operator 7.1.1

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
quay.io/minio/operator :v7.1.1	cd587f60c43d	golang.org/x/net@v0.38.0	0.55.0

Open the chart page →

874

ambassadordatawire

6.9.5

1 of 2 See more

ambassador datawire 6.9.5

1 of the 2 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
datawire/aes :1.14.4	8588eafe6862	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777	0.55.0

Open the chart page →

4,086

oktetookteto

0.0.0-2026-08-03

3 of 10 See more

okteto okteto 0.0.0-2026-08-03

3 of the 10 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
ghcr.io/okteto/backend :0.0.0-2026-08-03	244f87e8c52d	golang.org/x/net@v0.47.0	0.55.0
ghcr.io/okteto/buildkit :0.0.0-2026-08-03	14527ca5d2a9	golang.org/x/net@v0.35.0	0.55.0
ghcr.io/okteto/okteto :3.22.0-beta.1	e787b6bce27d	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

5,750

hydraory

0.64.0

1 of 2 See more

hydra ory 0.64.0

1 of the 2 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
oryd/hydra :v26.2.0	ff67c7fb5f95	golang.org/x/net@v0.48.0	0.55.0

Open the chart page →

1,156

prometheus-msteamsprometheus-msteams

1.3.6

1 of 1 See more

prometheus-msteams prometheus-msteams 1.3.6

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
quay.io/prometheusmsteams/prometheus-msteams :v1.5.3	a9f4d31ab811	golang.org/x/net@v0.7.0	0.55.0

Open the chart page →

941

proxmox-csi-pluginproxmox-csi

0.5.12

3 of 7 See more

proxmox-csi-plugin proxmox-csi 0.5.12

3 of the 7 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-attacher :v4.12.0	b9dc9a714a48	golang.org/x/net@v0.54.0	0.55.0
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.17.0	f9de845b1701	golang.org/x/net@v0.54.0	0.55.0
registry.k8s.io/sig-storage/livenessprobe :v2.19.0	06da0d5b8908	golang.org/x/net@v0.54.0	0.55.0

Open the chart page →

1,766

volsyncbackube-helm-charts

0.16.0

1 of 1 See more

volsync backube-helm-charts 0.16.0

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
quay.io/backube/volsync :0.16.0	0d03a6aad575	golang.org/x/net@v0.40.0	0.55.0

Open the chart page →

1,346

concourseconcourse

20.3.0

1 of 2 See more

concourse concourse 20.3.0

1 of the 2 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
concourse/concourse :8.3.0	40a143ce5873	golang.org/x/net@v0.50.0	0.55.0

Open the chart page →

2,022

san-iscsi-csienix

4.0.2

1 of 7 See more

san-iscsi-csi enix 4.0.2

1 of the 7 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
enix/san-iscsi-csi :v4.0.2	f963da81ecf7	golang.org/x/net@v0.0.0-20210610132358-84b48f89b13b	0.55.0

Open the chart page →

4,154

headscalegabe565

0.16.0

1 of 2 See more

headscale gabe565 0.16.0

1 of the 2 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
ghcr.io/juanfont/headscale :v0.25.0	97febecbe6cb	golang.org/x/net@v0.34.0	0.55.0

Open the chart page →

1,979

oncallgrafana

1.16.5

7 of 12 See more

oncall grafana 1.16.5

7 of the 12 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
grafana/grafana :11.1.4	886b56d5534e	golang.org/x/net@v0.26.0	0.55.0
quay.io/jetstack/cert-manager-cainjector :v1.8.0	e7b6203ccb37	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7	0.55.0
quay.io/jetstack/cert-manager-controller :v1.8.0	e1642bf8e933	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7	0.55.0
quay.io/jetstack/cert-manager-ctl :v1.8.0	595c548dee6f	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7	0.55.0
quay.io/jetstack/cert-manager-webhook :v1.8.0	fd798a5a773e	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7	0.55.0
registry.k8s.io/ingress-nginx/controller :v1.2.1	5516d103a9c2	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f	0.55.0
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.1.1	64d8c73dca98	golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023	0.55.0

Open the chart page →

16,251

k8sgpt-operatork8sgpt

0.2.29

2 of 2 See more

k8sgpt-operator k8sgpt 0.2.29

2 of the 2 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
ghcr.io/k8sgpt-ai/k8sgpt-operator :v0.2.29	82d0adcce816	golang.org/x/net@v0.53.0	0.55.0
quay.io/brancz/kube-rbac-proxy :v0.19.1	9f21034731c7	golang.org/x/net@v0.39.0	0.55.0

Open the chart page →

966

openbaoopenbao

0.29.4

1 of 2 See more

openbao openbao 0.29.4

1 of the 2 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
hashicorp/vault-k8s :1.7.2	ae3d307658b7	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

1,508

kratosory

0.64.0

1 of 1 See more

kratos ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
oryd/kratos :v26.2.0	2a13bb8d362c	golang.org/x/net@v0.48.0	0.55.0

Open the chart page →

866

wazuhwazuh-helm-morgoved

2.0.7

1 of 5 See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
wazuh/wazuh-manager :4.14.3	f09282d281f6	golang.org/x/net@v0.0.0-20200202094626-16171245cfb2	0.55.0

Open the chart page →

11,384

aws-cloudwatch-metricsaws

0.0.11

1 of 1 See more

aws-cloudwatch-metrics aws 0.0.11

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
amazon/cloudwatch-agent :1.300032.2b361	73b79b02f03a	golang.org/x/net@v0.17.0	0.55.0

Open the chart page →

1,556

zabbixcetic

3.1.3

1 of 5 See more

zabbix cetic 3.1.3

1 of the 5 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
zabbix/zabbix-agent2 :ubuntu-6.0.8	e5b594057c9c	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110	0.55.0

Open the chart page →

33,725

csi-driver-smbcsi-driver-smb

1.20.3

3 of 6 See more

csi-driver-smb csi-driver-smb 1.20.3

3 of the 6 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.17.0	f9de845b1701	golang.org/x/net@v0.54.0	0.55.0
registry.k8s.io/sig-storage/csi-resizer :v2.2.0	a2d40c1c3ccb	golang.org/x/net@v0.49.0	0.55.0
registry.k8s.io/sig-storage/livenessprobe :v2.19.0	06da0d5b8908	golang.org/x/net@v0.54.0	0.55.0

Open the chart page →

2,945

emissary-ingressdatawire

7.1.8-ea

1 of 1 See more

emissary-ingress datawire 7.1.8-ea

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
datawire/emissary :2.0.2-ea	9716efbdd24b	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777	0.55.0

Open the chart page →

4,918

hpe-csi-driverhpe-storage

3.3.0

3 of 14 See more

hpe-csi-driver hpe-storage 3.3.0

3 of the 14 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-attacher :v4.12.0	b9dc9a714a48	golang.org/x/net@v0.54.0	0.55.0
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.17.0	f9de845b1701	golang.org/x/net@v0.54.0	0.55.0
registry.k8s.io/sig-storage/csi-snapshotter :v8.6.0	42af0929bcd6	golang.org/x/net@v0.54.0	0.55.0

Open the chart page →

1,615

imgproxyimgproxy

1.1.0

1 of 1 See more

imgproxy imgproxy 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
ghcr.io/imgproxy/imgproxy :v3.30.0	74c1bee92e04	golang.org/x/net@v0.44.0	0.55.0

Open the chart page →

2,321

Container images carrying it

3,655 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
public.ecr.aws/eks-distro/kubernetes-csi/external-resizer :v1.7.0-eks-1-25-latest	e711da25e7a0	golang.org/x/net@v0.4.0	0.55.0	2
public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe :v2.9.0-eks-1-25-latest	8a305e162caa	golang.org/x/net@v0.7.0	0.55.0	2
public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar :v2.7.0-eks-1-25-latest	f4345e67df8f	golang.org/x/net@v0.7.0	0.55.0	2
public.ecr.aws/p3k6k6h3/mdai-event-hub :0.1.11	18cae836e9c7	golang.org/x/net@v0.52.0	0.55.0	2
public.ecr.aws/p3k6k6h3/mdai-gateway :0.1.10	0dfb323978f6	golang.org/x/net@v0.52.0	0.55.0	2
quay.io/argoproj/argocd :v2.14.11	5fc69e31c755	golang.org/x/net@v0.34.0	0.55.0	2
quay.io/argoproj/argo-events :v1.9.11	fa07b2c9ece6	golang.org/x/net@v0.47.0	0.55.0	2
quay.io/argoproj/argo-workflows-crdinstaller :v4.1.3	94a031823f2a	golang.org/x/net@v0.49.0	0.55.0	2
quay.io/brancz/kube-rbac-proxy :v0.20.0	147cb28fea35	golang.org/x/net@v0.44.0	0.55.0	2
quay.io/brancz/kube-rbac-proxy :v0.14.1	58d91a5faaf8	golang.org/x/net@v0.7.0	0.55.0	2
quay.io/brancz/kube-rbac-proxy :v0.13.1	738c854322f5	golang.org/x/net@v0.0.0-20221002022538-bcab6841153b	0.55.0	2
quay.io/brancz/kube-rbac-proxy :v0.18.1	e6a323504999	golang.org/x/net@v0.28.0	0.55.0	2
quay.io/cephcsi/cephcsi :v3.17.1	0b62db8afc9b	golang.org/x/net@v0.53.0	0.55.0	2
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f	0.55.0	2
quay.io/coreos/etcd :v3.5.6	28cb0630cb85	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2	0.55.0	2
quay.io/coreos/etcd :v3.6.12	702d7b4881c6	golang.org/x/net@v0.52.0	0.55.0	2
quay.io/dexidp/dex :v2.24.0	c9b7f6d0d953	golang.org/x/net@v0.0.0-20190813141303-74dc4d7220e7	0.55.0	2
quay.io/groundcover/grafana :9.3.1	8c65b333a3d3	golang.org/x/net@v0.1.0	0.55.0	2
quay.io/iver-wharf/wharf-api :v5.2.0	b736b345437d	golang.org/x/net@v0.0.0-20220325170049-de3da57026de	0.55.0	2
quay.io/iver-wharf/wharf-cmd :v0.8.2	e98d13459cdc	golang.org/x/net@v0.0.0-20220412020605-290c469a71a5	0.55.0	2
quay.io/iver-wharf/wharf-provider-azuredevops :v3.0.1	2fe7e4dcffdf	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4	0.55.0	2
quay.io/iver-wharf/wharf-provider-github :v3.0.1	77a22cb45c2a	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4	0.55.0	2
quay.io/iver-wharf/wharf-provider-gitlab :v2.0.1	d7079e0890da	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4	0.55.0	2
quay.io/jcmoraisjr/haproxy-ingress :v0.16.1	6fd744191ef6	golang.org/x/net@v0.47.0	0.55.0	2
quay.io/jetstack/cert-manager-cainjector :v1.11.0	5c3eb25b0854	golang.org/x/net@v0.5.0	0.55.0	2
quay.io/jetstack/cert-manager-cainjector :v1.13.2	858fee0c4af0	golang.org/x/net@v0.17.0	0.55.0	2
quay.io/jetstack/cert-manager-cainjector :v1.14.3	9395dec77fcf	golang.org/x/net@v0.19.0	0.55.0	2
quay.io/jetstack/cert-manager-cainjector :v1.15.3	e0ce8ae280c8	golang.org/x/net@v0.26.0	0.55.0	2
quay.io/jetstack/cert-manager-cainjector :v1.17.2	ec56edb1161d	golang.org/x/net@v0.38.0	0.55.0	2
quay.io/jetstack/cert-manager-controller :v1.17.2	2c314feeb5e8	golang.org/x/net@v0.38.0	0.55.0	2
quay.io/jetstack/cert-manager-controller :v1.14.3	64adcb95ce09	golang.org/x/net@v0.19.0	0.55.0	2
quay.io/jetstack/cert-manager-controller :v1.13.2	9c67cf8c92d8	golang.org/x/net@v0.17.0	0.55.0	2
quay.io/jetstack/cert-manager-controller :v1.11.0	d429b6d696e0	golang.org/x/net@v0.5.0	0.55.0	2
quay.io/jetstack/cert-manager-controller :v1.15.3	eee34b3de2dd	golang.org/x/net@v0.26.0	0.55.0	2
quay.io/jetstack/cert-manager-ctl :v1.11.0	74611761f052	golang.org/x/net@v0.5.0	0.55.0	2
quay.io/jetstack/cert-manager-startupapicheck :v1.15.3	4cbc1b022a23	golang.org/x/net@v0.26.0	0.55.0	2
quay.io/jetstack/cert-manager-startupapicheck :v1.14.3	df8677135139	golang.org/x/net@v0.19.0	0.55.0	2
quay.io/jetstack/cert-manager-startupapicheck :v1.17.2	e18989b4f912	golang.org/x/net@v0.38.0	0.55.0	2
quay.io/jetstack/cert-manager-webhook :v1.13.2	0a9470447ebf	golang.org/x/net@v0.17.0	0.55.0	2
quay.io/jetstack/cert-manager-webhook :v1.17.2	37b16a9dff00	golang.org/x/net@v0.38.0	0.55.0	2
quay.io/jetstack/cert-manager-webhook :v1.11.0	6730d96fc382	golang.org/x/net@v0.5.0	0.55.0	2
quay.io/jetstack/cert-manager-webhook :v1.14.3	d8ad5515f44f	golang.org/x/net@v0.19.0	0.55.0	2
quay.io/jetstack/cert-manager-webhook :v1.15.3	fdcb9ac4963f	golang.org/x/net@v0.26.0	0.55.0	2
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	golang.org/x/net@v0.0.0-20200707034311-ab3426394381	0.55.0	2
quay.io/kubevirt/kubevirt-cloud-controller-manager :v0.6.0	37ad4c475941	golang.org/x/net@v0.49.0	0.55.0	2
quay.io/kubevirt/kubevirt-csi-driver :latest	7b31b21b3f1e	golang.org/x/net@v0.49.0	0.55.0	2
quay.io/metallb/controller :v0.16.1	f51ab515de9c	golang.org/x/net@v0.53.0	0.55.0	2
quay.io/metallb/frr-k8s :v0.0.25	1cb06fb2d553	golang.org/x/net@v0.39.0	0.55.0	2
quay.io/metallb/speaker :v0.13.10	00406ccb1fa0	golang.org/x/net@v0.8.0	0.55.0	2
quay.io/metallb/speaker :v0.16.1	16561e96531e	golang.org/x/net@v0.53.0	0.55.0	2