StackRadar

CVE-2026-27137

Unscored

Advisory

Published 6 Mar 2026In the index since 5 Sept 2026
Severity
Unscored
worst across findings
CVSS
base score, highest
EPSS
0.006
47th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
72
of 17,781 indexed, latest versions
Container images
67
deployed by those charts
Fix available
1 of 1
affected package

Incorrect enforcement of email constraints in crypto/x509

Carried by container images the latest versions of 72 of 17,781 indexed charts deploy, on 67 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.26.01.26.167
OSV records
GO-2026-4599
Also known as
BIT-golang-2026-27137

Charts affected

72 by stars
ChartLatestAffected imagesRadar Score
argo-cdargoOfficialVerified publisher10.9.01 of 3See more

argo-cd argo 10.9.0

1 of the 3 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.45.18499afd690c4
stdlib@go1.26.0
1.26.1

Open the chart page →

3,218
deschedulerdescheduler0.36.01 of 1See more

descheduler descheduler 0.36.0

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
registry.k8s.io/descheduler/descheduler:v0.36.07ca92c0a7b4f
stdlib@go1.26.0
1.26.1

Open the chart page →

569
argo-cdargo-cd-oci10.9.01 of 3See more

argo-cd argo-cd-oci 10.9.0

1 of the 3 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.45.18499afd690c4
stdlib@go1.26.0
1.26.1

Open the chart page →

3,218
kubeviewkubeviewVerified publisher2.0.61 of 1See more

kubeview kubeview 2.0.6

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/benc-uk/kubeview:latestb5b2b02e4c4e
stdlib@go1.26.0
1.26.1

Open the chart page →

794
hydraory0.64.01 of 2See more

hydra ory 0.64.0

1 of the 2 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
oryd/hydra:v26.2.0ff67c7fb5f95
stdlib@go1.26.0
1.26.1

Open the chart page →

1,156
kratosory0.64.01 of 1See more

kratos ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
oryd/kratos:v26.2.02a13bb8d362c
stdlib@go1.26.0
1.26.1

Open the chart page →

866
renterdartur9010Verified publisher1.4.41 of 2See more

renterd artur9010 1.4.4

1 of the 2 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/siafoundation/renterd:2.9.0e0334f124863
stdlib@go1.26.0
1.26.1

Open the chart page →

8,493
cloudflare-operatorcontainerooVerified publisher1.10.71 of 1See more

cloudflare-operator containeroo 1.10.7

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/containeroo/cloudflare-operator:v1.10.60eda6d237a84
stdlib@go1.26.0
1.26.1

Open the chart page →

222
gotifygotifyVerified publisher0.8.11 of 1See more

gotify gotify 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
gotify/server:2.9.1a3af47067ce6
stdlib@go1.26.0
1.26.1

Open the chart page →

568
korkorVerified publisher0.2.161 of 1See more

kor kor 0.2.16

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
yonahdissen/kor:latest1a85158c82bb
stdlib@go1.26.0
1.26.1

Open the chart page →

222
meshery-operatormesheryOfficialVerified publisher1.0.691 of 2See more

meshery-operator meshery 1.0.69

1 of the 2 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
alpine/k8s:1.35.6b7a12c5ddf26
stdlib@go1.26.0
1.26.1

Open the chart page →

2,415
ketoory0.64.01 of 1See more

keto ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
oryd/keto:v26.2.0bfdb8b9e283a
stdlib@go1.26.0
1.26.1

Open the chart page →

817
oathkeeperory0.64.01 of 1See more

oathkeeper ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
oryd/oathkeeper:v26.2.0467329abde34
stdlib@go1.26.0
1.26.1

Open the chart page →

769
rekorsigstoreVerified publisher1.8.52 of 9See more

rekor sigstore 1.8.5

2 of the 9 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/sigstore/scaffolding/trillian_log_serverdigest-pinned5a878e4e4f03
stdlib@go1.26.0
1.26.1
ghcr.io/sigstore/scaffolding/trillian_log_signerdigest-pinned28c5ff40963f
stdlib@go1.26.0
1.26.1

Open the chart page →

5,415
local-ailocalai3.4.21 of 1See more

local-ai localai 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
quay.io/go-skynet/local-ai:latestd78cd113b2bc
stdlib@go1.26.0
1.26.1

Open the chart page →

3,997
nri-memtierdnri-pluginsOfficialVerified publisher0.14.01 of 1See more

nri-memtierd nri-plugins 0.14.0

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/containers/nri-plugins/nri-memtierd:v0.14.09138314e12ba
stdlib@go1.26.0
1.26.1

Open the chart page →

269
haproxyhaproxytechVerified publisher1.30.11 of 1See more

haproxy haproxytech 1.30.1

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
haproxytech/haproxy-alpine:3.4.37a3ef2dd8b5b
stdlib@go1.26.0
1.26.1

Open the chart page →

817
headscaleheadscaleVerified publisher1.0.191 of 3See more

headscale headscale 1.0.19

1 of the 3 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
alpine/k8s:1.36.244ef4942e171
stdlib@go1.26.0
1.26.1

Open the chart page →

3,383
kubeservice-lxcfs-webhookkubservice-chartsVerified publisher1.6.01 of 6See more

kubeservice-lxcfs-webhook kubservice-charts 1.6.0

1 of the 6 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
dongjiang1989/lxcfs-webhook:latestc1f19557bdcb
stdlib@go1.26.0
1.26.1

Open the chart page →

11,582
kwokkwokOfficialVerified publisher0.3.01 of 1See more

kwok kwok 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
registry.k8s.io/kwok/kwok:v0.8.06d25aa8fbdfe
stdlib@go1.26.0
1.26.1

Open the chart page →

701
mortalgpumortalgpuOfficialVerified publisher1.3.71 of 1See more

mortalgpu mortalgpu 1.3.7

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
quay.io/maxiv/mortalgpu:1.3.7e1c5c194bbf0
stdlib@go1.26.0
1.26.1

Open the chart page →

372
backrestrobertobochetVerified publisher0.7.01 of 1See more

backrest robertobochet 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
garethgeorge/backrest:v1.14.1b85297975428
stdlib@go1.26.0
1.26.1

Open the chart page →

859
vaultvaultVerified publisher1.22.02 of 4See more

vault vault 1.22.0

2 of the 4 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
alpine/k8s:1.35.5d870622d0040
stdlib@go1.26.0
1.26.1
prom/statsd-exporter:v0.29.0632f70580492
stdlib@go1.26.0
1.26.1

Open the chart page →

4,243
argo-cdwenerme10.9.01 of 3See more

argo-cd wenerme 10.9.0

1 of the 3 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.45.18499afd690c4
stdlib@go1.26.0
1.26.1

Open the chart page →

3,218
clamav-restclamav-rest-apiVerified publisher0.1.01 of 1See more

clamav-rest clamav-rest-api 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ajilaag/clamav-rest:latestad689c7b75b1
stdlib@go1.26.0
1.26.1

Open the chart page →

515
dkim-managerdkim-managerVerified publisher0.2.01 of 1See more

dkim-manager dkim-manager 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/hsn723/dkim-manager:1.4.00312232b31a2
stdlib@go1.26.0
1.26.1

Open the chart page →

293
falco-operatorfalcosecurity0.3.11 of 1See more

falco-operator falcosecurity 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
falcosecurity/falco-operator:0.4.18a99fcc57a57
stdlib@go1.26.0
1.26.1

Open the chart page →

348
garage-uigarage-uiVerified publisher0.12.11 of 1See more

garage-ui garage-ui 0.12.1

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
noooste/garage-ui:v0.12.10b68a9237da6
stdlib@go1.26.0
1.26.1

Open the chart page →

763
gomenhashaigomenhashaiOfficialVerified publisher1.3.41 of 1See more

gomenhashai gomenhashai 1.3.4

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/gomenhashai/gomenhashai:v1.3.36f031172a5ec
stdlib@go1.26.0
1.26.1

Open the chart page →

628
k8s-grafana-stackk8s-grafana-stackVerified publisher0.2.321 of 17See more

k8s-grafana-stack k8s-grafana-stack 0.2.32

1 of the 17 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v3.10.07571a304e67f
stdlib@go1.26.0
1.26.1

Open the chart page →

15,418
nri-resource-policy-balloonsnri-pluginsOfficialVerified publisher0.14.01 of 1See more

nri-resource-policy-balloons nri-plugins 0.14.0

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/containers/nri-plugins/nri-resource-policy-balloons:v0.14.0a8c8297c7274
stdlib@go1.26.0
1.26.1

Open the chart page →

279
nri-resource-policy-topology-awarenri-pluginsOfficialVerified publisher0.14.01 of 1See more

nri-resource-policy-topology-aware nri-plugins 0.14.0

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/containers/nri-plugins/nri-resource-policy-topology-aware:v0.14.0e2443833726a
stdlib@go1.26.0
1.26.1

Open the chart page →

279
podtracepodtraceOfficialVerified publisher0.14.81 of 2See more

podtrace podtrace 0.14.8

1 of the 2 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
alpine/k8s:1.37.0b421c2e9419e
stdlib@go1.26.0
1.26.1

Open the chart page →

589
scaffoldsigstoreVerified publisher0.6.1142 of 15See more

scaffold sigstore 0.6.114

2 of the 15 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/sigstore/scaffolding/trillian_log_serverdigest-pinned5a878e4e4f03
stdlib@go1.26.0
1.26.1
ghcr.io/sigstore/scaffolding/trillian_log_signerdigest-pinned28c5ff40963f
stdlib@go1.26.0
1.26.1

Open the chart page →

7,710
stornxstornxVerified publisher1.1.11 of 9See more

stornx stornx 1.1.1

1 of the 9 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v3.10.07571a304e67f
stdlib@go1.26.0
1.26.1

Open the chart page →

11,574
gotifyalexvanderberkelVerified publisher0.7.01 of 1See more

gotify alexvanderberkel 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
gotify/server:3.1.0be44495e4609
stdlib@go1.26.0
1.26.1

Open the chart page →

320
anchore-admission-controlleranchore-charts0.8.41 of 2See more

anchore-admission-controller anchore-charts 0.8.4

1 of the 2 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
anchore/kubernetes-admission-controller:v0.8.4077e2a227eea
stdlib@go1.26.0
1.26.1

Open the chart page →

7,852
butane-operatorbutane-operatorVerified publisher0.3.01 of 2See more

butane-operator butane-operator 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/naval-group/butane-operator:v0.1.1-rc285818b510780
stdlib@go1.26.0
1.26.1

Open the chart page →

1,396
caddycaddyVerified publisher0.0.41 of 1See more

caddy caddy 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
library/caddy:2.11.2-alpine834468128c76
stdlib@go1.26.0
1.26.1

Open the chart page →

1,677
monitoringcluster-deploy0.3.01 of 11See more

monitoring cluster-deploy 0.3.0

1 of the 11 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v3.10.07571a304e67f
stdlib@go1.26.0
1.26.1

Open the chart page →

8,183
cluster-network-policy-operatorcluster-network-policy-operatorVerified publisher1.1.01 of 1See more

cluster-network-policy-operator cluster-network-policy-operator 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/desuuuu/cluster-network-policy-operator:v1.1.0d943d13c5281
stdlib@go1.26.0
1.26.1

Open the chart page →

228
agent-forge-operatorcontainerooVerified publisher1.1.41 of 1See more

agent-forge-operator containeroo 1.1.4

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/containeroo/agent-forge-operator:v1.1.48f6d8acd134a
stdlib@go1.26.0
1.26.1

Open the chart page →

256
autovpacontainerooVerified publisher0.4.21 of 1See more

autovpa containeroo 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/containeroo/autovpa:v0.0.3425b801d8d1f7
stdlib@go1.26.0
1.26.1

Open the chart page →

298
cert-manager-webhook-bluecatcontainerooVerified publisher1.0.21 of 1See more

cert-manager-webhook-bluecat containeroo 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/containeroo/cert-manager-webhook-bluecat:latest96f82d5840d4
stdlib@go1.26.0
1.26.1

Open the chart page →

433
kube-ephemeral-container-exportercontainerooVerified publisher0.2.31 of 1See more

kube-ephemeral-container-exporter containeroo 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/containeroo/kube-ephemeral-container-exporter:v0.0.14b238f3c58d83
stdlib@go1.26.0
1.26.1

Open the chart page →

298
csghubcsghubVerified publisher2.4.31 of 34See more

csghub csghub 2.4.3

1 of the 34 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
opencsghq/csghub-server:v2.4.0-ee302c9d45d8a8
stdlib@go1.26.0
1.26.1

Open the chart page →

58,897
syncoor-serverethereum-helm-chartsVerified publisher0.0.11 of 1See more

syncoor-server ethereum-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/ethpandaops/syncoor:master233aa9808fc7
stdlib@go1.26.0
1.26.1

Open the chart page →

952
extractedprismextractedprismVerified publisher0.2.01 of 1See more

extractedprism extractedprism 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
ghcr.io/lexfrei/extractedprism:v0.3.0d10417753727
stdlib@go1.26.0
1.26.1

Open the chart page →

286
kubebenchfairwinds-incubator1.0.51 of 2See more

kubebench fairwinds-incubator 1.0.5

1 of the 2 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
aquasec/kube-bench:v0.15.07a8fa32dce21
stdlib@go1.26.0
1.26.1

Open the chart page →

1,187
kube-prometheus-stackgpg-dev84.0.01 of 6See more

kube-prometheus-stack gpg-dev 84.0.0

1 of the 6 container images this version deploys carry CVE-2026-27137.

Container imageDigestPackageFixed in
grafana/grafana:13.0.10f86bada30d6
stdlib@go1.26.0
1.26.1

Open the chart page →

4,288

Container images carrying it

67 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/hsn723/dkim-manager:1.4.00312232b31a2
stdlib@go1.26.0
1.26.1
1
ghcr.io/lexfrei/extractedprism:v0.3.0d10417753727
stdlib@go1.26.0
1.26.1
1
ghcr.io/mattn/picoclaw:latest517556c8b144
stdlib@go1.26.0
1.26.1
1
ghcr.io/mondu-ai/gar-credential-provider:latest25090d37afa9
stdlib@go1.26.0
1.26.1
1
ghcr.io/naval-group/butane-operator:v0.1.1-rc285818b510780
stdlib@go1.26.0
1.26.1
1
ghcr.io/pocket-id/pocket-id:v2.7.045bdeaf3fcd6
stdlib@go1.26.0
1.26.1
1
ghcr.io/shopware/shopware-operator:1.8.187db0eda7a03
stdlib@go1.26.0
1.26.1
1
ghcr.io/siafoundation/renterd:2.9.0e0334f124863
stdlib@go1.26.0
1.26.1
1
ghcr.io/sigstore/sigstore-probers/prober:v1.0.1d1e914e6d6b9
stdlib@go1.26.0
1.26.1
1
ghcr.io/skyhook-io/skyhook-connector:v2.3.23deb8e4b1aaa
stdlib@go1.26.0
1.26.1
1
ghcr.io/spiffe/spire-identity-exchange-server:v0.5.0239bc70c1988
stdlib@go1.26.0
1.26.1
1
ghcr.io/traefik/hub-manager:v0.45.1d1cff2560c67
stdlib@go1.26.0
1.26.1
1
quay.io/go-skynet/local-ai:latestd78cd113b2bc
stdlib@go1.26.0
1.26.1
1
quay.io/maxiv/mortalgpu:1.3.7e1c5c194bbf0
stdlib@go1.26.0
1.26.1
1
quay.io/nmstate/kubernetes-nmstate-operator:v0.87.04dce694f01ea
stdlib@go1.26.0
1.26.1
1
registry.k8s.io/descheduler/descheduler:v0.36.07ca92c0a7b4f
stdlib@go1.26.0
1.26.1
1
registry.k8s.io/kwok/kwok:v0.8.06d25aa8fbdfe
stdlib@go1.26.0
1.26.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.