CVE-2026-27139

Low

Advisory

Published 6 Mar 2026In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 2.5; base score, highest
EPSS: 0.002; 10th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 3,843; of 17,813 indexed, latest versions
Container images: 4,361; deployed by those charts
Fix available: 1 of 2; affected packages

FileInfo can escape from a Root in os

Carried by container images the latest versions of 3,843 of 17,813 indexed charts deploy, on 4,361 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+177 more	1.25.8	4,361
golang-1.19deb	1.19.8-2	no fix listed	1

OSV records: DEBIAN-CVE-2026-27139 GO-2026-4602
Also known as: BIT-golang-2026-27139

Charts affected

3,843 by stars

Chart

Latest

Affected images

Radar Score

vmot-container-kit

0.0.3

4 of 7 See more

vm ot-container-kit 0.0.3

4 of the 7 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
grafana/grafana :11.1.4	886b56d5534e	stdlib@go1.22.4	1.25.8
victoriametrics/operator :v0.47.2	71be93cfafb6	stdlib@go1.23.0	1.25.8
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	stdlib@go1.22.5	1.25.8
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.13.0	639a1e2da549	stdlib@go1.22.5	1.25.8

Open the chart page →

5,428

otel-add-onotel-add-on

0.1.4

1 of 1 See more

otel-add-on otel-add-on 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/kedify/otel-add-on :v0.1.4	a6f2155bd822	stdlib@go1.24.3	1.25.8

Open the chart page →

734

adotowan-charts

0.1.0

1 of 1 See more

adot owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-observability/aws-otel-collector :v0.43.3	8aa9ea5f67b8	stdlib@go1.24.3	1.25.8

Open the chart page →

1,033

httpbunowan-charts

0.1.0

1 of 1 See more

httpbun owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
sharat87/httpbun :latest	405332d9050a	stdlib@go1.25.1	1.25.8

Open the chart page →

314

minioowan-charts

0.1.2

1 of 2 See more

minio owan-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/georgmangold/console :v1.8.1	58f4f180aa6e	stdlib@go1.24.4	1.25.8

Open the chart page →

1,083

kubernetes-taggeroxyno-zeta

1.1.2

1 of 1 See more

kubernetes-tagger oxyno-zeta 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
oxynozeta/kubernetes-tagger :1.3.0	a153c386f5af	stdlib@go1.17	1.25.8

Open the chart page →

1,827

arpap2p-avs

0.1.3

1 of 2 See more

arpa p2p-avs 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/arpa-network/node-client :latest	657a2c9f6e6d	stdlib@go1.22.5	1.25.8

Open the chart page →

1,997

automatap2p-avs

0.1.0

1 of 2 See more

automata p2p-avs 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/automata-network/multi-prover-avs/operator :v0.6.0	752f1aa02438	stdlib@go1.22.1	1.25.8

Open the chart page →

3,695

avap2p-avs

0.1.0

1 of 1 See more

ava p2p-avs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
avaprotocol/ap-avs :1.2.0	c430ea5c37d6	stdlib@go1.22.5	1.25.8

Open the chart page →

3,362

eigendap2p-avs

0.1.1

2 of 3 See more

eigenda p2p-avs 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/layr-labs/eigenda/opr-node :0.8.4	6650119a385f	stdlib@go1.21.1	1.25.8
ghcr.io/layr-labs/eigenda/opr-nodeplugin :0.8.4	e459ad3ae758	stdlib@go1.21.1	1.25.8

Open the chart page →

2,336

predicatep2p-avs

0.1.4

1 of 1 See more

predicate p2p-avs 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/predicatelabs/operator :v1.0.5	b62113fe1b27	stdlib@go1.23.5	1.25.8

Open the chart page →

893

p4p4

0.1.0

3 of 7 See more

p4 p4 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
codeurjc/toposervice :v1.23	9fb4c11e6a49	stdlib@go1.18.10	1.25.8
library/mongo :5.0-focal	5e15a3f014ed	stdlib@go1.24.6	1.25.8
library/mysql :8	b3b90af2a655	stdlib@go1.24.6	1.25.8

Open the chart page →

27,879

myappp4-helm

0.1.0

1 of 6 See more

19,768

pacmanpacman-mh

0.1.28

1 of 2 See more

pacman pacman-mh 0.1.28

1 of the 2 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mongo :7.0.28-jammy	88785f6f665a	stdlib@go1.24.0	1.25.8

Open the chart page →

3,627

pagespages

1.0.0

1 of 3 See more

20,285

pagespages10

1.0.0

1 of 3 See more

20,285

pagespages111

1.0.0

1 of 3 See more

20,285

pagespages2

1.0.0

1 of 3 See more

20,285

pagespages-alexchmielu

1.0.0

1 of 3 See more

pages pages-alexchmielu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-alps

1.0.0

1 of 3 See more

pages pages-alps 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-alstom

1.0.0

1 of 3 See more

pages pages-alstom 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-ambala

1.0.0

1 of 3 See more

pages pages-ambala 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-andromeda

1.0.0

1 of 3 See more

pages pages-andromeda 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespagesbadami

1.0.0

1 of 3 See more

pages pagesbadami 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-blackburn

1.0.0

1 of 3 See more

pages pages-blackburn 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-botes

1.0.0

1 of 3 See more

pages pages-botes 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-brian

1.0.0

1 of 3 See more

pages pages-brian 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-buckll

1.0.0

1 of 3 See more

pages pages-buckll 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-camden

1.0.0

1 of 3 See more

pages pages-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-camden771

1.0.0

1 of 3 See more

pages pages-camden771 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-draco

1.0.0

1 of 3 See more

pages pages-draco 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-ellora

1.0.0

1 of 3 See more

pages pages-ellora 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-finchley

1.0.0

1 of 3 See more

pages pages-finchley 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-fornax

1.0.0

1 of 3 See more

pages pages-fornax 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-harsh

1.0.0

1 of 3 See more

pages pages-harsh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespagesk

1.0.0

1 of 3 See more

20,285

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-mihai

1.0.0

1 of 3 See more

pages pages-mihai 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-nivesh

1.0.0

1 of 3 See more

pages pages-nivesh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespagessandeepgudu

1.0.0

1 of 3 See more

pages pagessandeepgudu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-shubhanker

1.0.0

1 of 3 See more

pages pages-shubhanker 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-ssharma0909

1.0.0

1 of 3 See more

pages pages-ssharma0909 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-sucharitha

1.0.0

1 of 3 See more

pages pages-sucharitha 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-sudhir

1.0.0

1 of 3 See more

pages pages-sudhir 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-sushi

1.0.0

1 of 3 See more

pages pages-sushi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-vasanth5814

1.0.0

1 of 3 See more

pages pages-vasanth5814 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-vjp

1.0.0

1 of 3 See more

pages pages-vjp 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

paperclippaperclip-helm

0.1.0

1 of 3 See more

paperclip paperclip-helm 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/postgres :17-alpine	18cfe3ef5e68	stdlib@go1.24.6	1.25.8

Open the chart page →

494

paperclip-operatorpaperclip-operator

0.19.1

1 of 1 See more

paperclip-operator paperclip-operator 0.19.1

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/paperclipinc/paperclip-operator :v0.19.1	0984b890eb38	stdlib@go1.25.0	1.25.8

Open the chart page →

352

Container images carrying it

4,361 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
mesosphere/kubectl :v1.35.0-alpine	ea01a9387771	stdlib@go1.25.5	1.25.8	2
minio/minio :RELEASE.2021-02-14T04-01-33Z	bd11edda91f3	stdlib@go1.15.7	1.25.8	2
moby/buildkit :v0.32.2-rootless	504731e577c2	stdlib@go1.25.7	1.25.8	2
natsio/nats-box :0.11.0	9fbf7bf684e4	stdlib@go1.18.1	1.25.8	2
natsio/nats-server-config-reloader :0.21.1	10ff229eaf52	stdlib@go1.25.5	1.25.8	2
natsio/nats-server-config-reloader :0.7.2	911ce7ed2f55	stdlib@go1.19	1.25.8	2
natsio/nats-server-config-reloader :0.10.1	e414cc7e6f59	stdlib@go1.19.4	1.25.8	2
natsio/prometheus-nats-exporter :0.10.0	16048afb67a5	stdlib@go1.19	1.25.8	2
natsio/prometheus-nats-exporter :0.17.3	26c826662ac8	stdlib@go1.24.2	1.25.8	2
natsio/prometheus-nats-exporter :0.11.0	31c02aac089a	stdlib@go1.20.3	1.25.8	2
netapp/trident-protect-utils :v2.0.0	cd0c18d8f9ec	stdlib@go1.24.12	1.25.8	2
oliver006/redis_exporter :v1.9.0	4af75e9f16f6	stdlib@go1.14.4	1.25.8	2
opencloudeu/opencloud-rolling :2.1.0	f9634bb04905	stdlib@go1.24.2	1.25.8	2
opendatacube/ows :latest	668cbb41473c	stdlib@go1.22.2	1.25.8	2
openebs/etcd :3.6.4-debian-12-r0	c86c06f1ce6a	stdlib@go1.24.5	1.25.8	2
openebs/provisioner-localpv :4.6.0	99f5116f5cb8	stdlib@go1.25.0	1.25.8	2
openkruise/kruise-helm-hook :v0.1.0	edc7cf9428fd	stdlib@go1.20.14	1.25.8	2
openpolicyagent/gatekeeper :v3.4.0-rc.1	825370bdb3c3	stdlib@go1.16.2	1.25.8	2
oryd/kratos :v1.0.0	d06fc5845f63	stdlib@go1.20.5	1.25.8	2
oryd/kratos :v1.3.1	fe2428f103a6	stdlib@go1.23.2	1.25.8	2
oryd/oathkeeper :v0.40.6	e8cb9b79a89c	stdlib@go1.20.5	1.25.8	2
osixia/openldap :1.4.0	ccd95cc6e61e	stdlib@go1.13.4	1.25.8	2
otel/opentelemetry-collector-contrib :0.96.0	7ef2a2ff46b9	stdlib@go1.21.7	1.25.8	2
otel/opentelemetry-collector-contrib :0.145.0	a7343f018690	stdlib@go1.25.7	1.25.8	2
otel/opentelemetry-collector-k8s :0.111.0	32b3c8296dcc	stdlib@go1.23.2	1.25.8	2
outlinewiki/outline :0.69.1	d060dcd8f9aa	stdlib@go1.19.4	1.25.8	2
passbolt/passbolt :3.4.0-ce-non-root	655547e17263	stdlib@go1.14.4	1.25.8	2
percona/everest-helmtools :0.0.1	904458d04a18	stdlib@go1.24.6	1.25.8	2
pgautoupgrade/pgautoupgrade :18-alpine	48b448825656	stdlib@go1.24.6	1.25.8	2
pgvector/pgvector :0.8.5-pg18-trixie	9d2e61c7352b	stdlib@go1.24.6	1.25.8	2
pgvector/pgvector :0.8.6-pg16-bookworm :pg16	ccc6e83d6e35	stdlib@go1.24.6	1.25.8	2
phntom/kochi :1.1.3	3b82358bd56e	stdlib@go1.15.5	1.25.8	2
place1/wg-access-server :v0.4.6	2b2f3ea80ed6	stdlib@go1.13.8	1.25.8	2
polyaxon/polyaxon-operator :2.17.0	7664c1cebb9d	stdlib@go1.24.13	1.25.8	2
postgis/postgis :15-3.3	a2fc46b52819	stdlib@go1.18.2	1.25.8	2
pottava/s3-proxy :2.0	20a0bcb15f76	stdlib@go1.13.7	1.25.8	2
prom/blackbox-exporter :v0.18.0	1ffc3f109eb3	stdlib@go1.15.2	1.25.8	2
prom/prometheus :v2.17.2	42d2395cd719	stdlib@go1.13.10	1.25.8	2
prom/prometheus :v2.52.0	5c435642ca4d	stdlib@go1.22.3	1.25.8	2
prom/prometheus :v2.37.9	8176adea328e	stdlib@go1.19.11	1.25.8	2
prom/prometheus :v2.48.1	a67e5e402ff5	stdlib@go1.21.5	1.25.8	2
prom/prometheus :v2.21.0	d43417c260e5	stdlib@go1.15.2	1.25.8	2
prom/prometheus :v2.16.0	e4ca62c0d62f	stdlib@go1.13.8	1.25.8	2
prom/pushgateway :v1.3.0	c0d39b8d4cfe	stdlib@go1.15.2	1.25.8	2
qingcloud/cloud-controller-manager :v1.4.12	10f66b5df886	stdlib@go1.18.2	1.25.8	2
qingcloud/hostnic-plus :v1.0.3	4cd5366a9f51	stdlib@go1.16.3	1.25.8	2
rajnandan1/kener :3.2.19	30407afca731	stdlib@go1.20.7	1.25.8	2
rancher/k3s :v1.26.0-k3s1	9380f5dbae9a	stdlib@go1.19.4	1.25.8	2
rancher/kine :v0.11.4	12889bbcd1e8	stdlib@go1.21.5	1.25.8	2
rancher/local-path-provisioner :v0.0.29	9bebefa0b908	stdlib@go1.22.5	1.25.8	2