CVE-2026-27139

Low

Advisory

Published 6 Mar 2026In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 2.5; base score, highest
EPSS: 0.002; 10th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 3,843; of 17,813 indexed, latest versions
Container images: 4,361; deployed by those charts
Fix available: 1 of 2; affected packages

FileInfo can escape from a Root in os

Carried by container images the latest versions of 3,843 of 17,813 indexed charts deploy, on 4,361 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+177 more	1.25.8	4,361
golang-1.19deb	1.19.8-2	no fix listed	1

OSV records: DEBIAN-CVE-2026-27139 GO-2026-4602
Also known as: BIT-golang-2026-27139

Charts affected

3,843 by stars

Chart

Latest

Affected images

Radar Score

vmot-container-kit

0.0.3

4 of 7 See more

vm ot-container-kit 0.0.3

4 of the 7 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
grafana/grafana :11.1.4	886b56d5534e	stdlib@go1.22.4	1.25.8
victoriametrics/operator :v0.47.2	71be93cfafb6	stdlib@go1.23.0	1.25.8
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	stdlib@go1.22.5	1.25.8
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.13.0	639a1e2da549	stdlib@go1.22.5	1.25.8

Open the chart page →

5,428

otel-add-onotel-add-on

0.1.4

1 of 1 See more

otel-add-on otel-add-on 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/kedify/otel-add-on :v0.1.4	a6f2155bd822	stdlib@go1.24.3	1.25.8

Open the chart page →

734

adotowan-charts

0.1.0

1 of 1 See more

adot owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-observability/aws-otel-collector :v0.43.3	8aa9ea5f67b8	stdlib@go1.24.3	1.25.8

Open the chart page →

1,033

httpbunowan-charts

0.1.0

1 of 1 See more

httpbun owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
sharat87/httpbun :latest	405332d9050a	stdlib@go1.25.1	1.25.8

Open the chart page →

314

minioowan-charts

0.1.2

1 of 2 See more

minio owan-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/georgmangold/console :v1.8.1	58f4f180aa6e	stdlib@go1.24.4	1.25.8

Open the chart page →

1,083

kubernetes-taggeroxyno-zeta

1.1.2

1 of 1 See more

kubernetes-tagger oxyno-zeta 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
oxynozeta/kubernetes-tagger :1.3.0	a153c386f5af	stdlib@go1.17	1.25.8

Open the chart page →

1,827

arpap2p-avs

0.1.3

1 of 2 See more

arpa p2p-avs 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/arpa-network/node-client :latest	657a2c9f6e6d	stdlib@go1.22.5	1.25.8

Open the chart page →

1,997

automatap2p-avs

0.1.0

1 of 2 See more

automata p2p-avs 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/automata-network/multi-prover-avs/operator :v0.6.0	752f1aa02438	stdlib@go1.22.1	1.25.8

Open the chart page →

3,695

avap2p-avs

0.1.0

1 of 1 See more

ava p2p-avs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
avaprotocol/ap-avs :1.2.0	c430ea5c37d6	stdlib@go1.22.5	1.25.8

Open the chart page →

3,362

eigendap2p-avs

0.1.1

2 of 3 See more

eigenda p2p-avs 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/layr-labs/eigenda/opr-node :0.8.4	6650119a385f	stdlib@go1.21.1	1.25.8
ghcr.io/layr-labs/eigenda/opr-nodeplugin :0.8.4	e459ad3ae758	stdlib@go1.21.1	1.25.8

Open the chart page →

2,336

predicatep2p-avs

0.1.4

1 of 1 See more

predicate p2p-avs 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/predicatelabs/operator :v1.0.5	b62113fe1b27	stdlib@go1.23.5	1.25.8

Open the chart page →

893

p4p4

0.1.0

3 of 7 See more

p4 p4 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
codeurjc/toposervice :v1.23	9fb4c11e6a49	stdlib@go1.18.10	1.25.8
library/mongo :5.0-focal	5e15a3f014ed	stdlib@go1.24.6	1.25.8
library/mysql :8	b3b90af2a655	stdlib@go1.24.6	1.25.8

Open the chart page →

27,879

myappp4-helm

0.1.0

1 of 6 See more

19,768

pacmanpacman-mh

0.1.28

1 of 2 See more

pacman pacman-mh 0.1.28

1 of the 2 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mongo :7.0.28-jammy	88785f6f665a	stdlib@go1.24.0	1.25.8

Open the chart page →

3,627

pagespages

1.0.0

1 of 3 See more

20,285

pagespages10

1.0.0

1 of 3 See more

20,285

pagespages111

1.0.0

1 of 3 See more

20,285

pagespages2

1.0.0

1 of 3 See more

20,285

pagespages-alexchmielu

1.0.0

1 of 3 See more

pages pages-alexchmielu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-alps

1.0.0

1 of 3 See more

pages pages-alps 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-alstom

1.0.0

1 of 3 See more

pages pages-alstom 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-ambala

1.0.0

1 of 3 See more

pages pages-ambala 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-andromeda

1.0.0

1 of 3 See more

pages pages-andromeda 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespagesbadami

1.0.0

1 of 3 See more

pages pagesbadami 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-blackburn

1.0.0

1 of 3 See more

pages pages-blackburn 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-botes

1.0.0

1 of 3 See more

pages pages-botes 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-brian

1.0.0

1 of 3 See more

pages pages-brian 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-buckll

1.0.0

1 of 3 See more

pages pages-buckll 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-camden

1.0.0

1 of 3 See more

pages pages-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-camden771

1.0.0

1 of 3 See more

pages pages-camden771 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-draco

1.0.0

1 of 3 See more

pages pages-draco 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-ellora

1.0.0

1 of 3 See more

pages pages-ellora 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-finchley

1.0.0

1 of 3 See more

pages pages-finchley 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-fornax

1.0.0

1 of 3 See more

pages pages-fornax 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-harsh

1.0.0

1 of 3 See more

pages pages-harsh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespagesk

1.0.0

1 of 3 See more

20,285

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-mihai

1.0.0

1 of 3 See more

pages pages-mihai 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-nivesh

1.0.0

1 of 3 See more

pages pages-nivesh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespagessandeepgudu

1.0.0

1 of 3 See more

pages pagessandeepgudu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-shubhanker

1.0.0

1 of 3 See more

pages pages-shubhanker 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-ssharma0909

1.0.0

1 of 3 See more

pages pages-ssharma0909 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-sucharitha

1.0.0

1 of 3 See more

pages pages-sucharitha 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-sudhir

1.0.0

1 of 3 See more

pages pages-sudhir 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-sushi

1.0.0

1 of 3 See more

pages pages-sushi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-vasanth5814

1.0.0

1 of 3 See more

pages pages-vasanth5814 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-vjp

1.0.0

1 of 3 See more

pages pages-vjp 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

paperclippaperclip-helm

0.1.0

1 of 3 See more

paperclip paperclip-helm 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/postgres :17-alpine	18cfe3ef5e68	stdlib@go1.24.6	1.25.8

Open the chart page →

494

paperclip-operatorpaperclip-operator

0.19.1

1 of 1 See more

paperclip-operator paperclip-operator 0.19.1

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/paperclipinc/paperclip-operator :v0.19.1	0984b890eb38	stdlib@go1.25.0	1.25.8

Open the chart page →

352

Container images carrying it

4,361 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
rclone/rclone :1.68	74c51b8817e5	stdlib@go1.23.3	1.25.8	2
ribbybibby/ssl-exporter :2.4.2	718abe7f5e79	stdlib@go1.18.3	1.25.8	2
rookout/controller :latest	4451a6f6b8ec	stdlib@go1.20.5	1.25.8	2
rookout/data-on-prem :latest	51c0fce64467	stdlib@go1.20.5	1.25.8	2
rss3/op-batcher :a77d1f52fc3492bf21915bdff8ee8e0b5bd2cb8a	dae8a5bdd7a6	stdlib@go1.21.3	1.25.8	2
rss3/op-proposer :a77d1f52fc3492bf21915bdff8ee8e0b5bd2cb8a	a4059dd32c48	stdlib@go1.21.3	1.25.8	2
scaleway/cert-manager-webhook-scaleway :v0.0.1	dcc14608d000	stdlib@go1.15.2	1.25.8	2
squareup/ghostunnel :v1.5.2	70f4cf270425	stdlib@go1.13.4	1.25.8	2
starrocks/operator :v1.11.7	8c20435a7579	stdlib@go1.22.12	1.25.8	2
statping/statping :v0.90.74	e874da513a5c	stdlib@go1.14.13	1.25.8	2
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	stdlib@go1.20.4	1.25.8	2
taigaio/taiga-back :latest	4beed8f62c9f	stdlib@go1.24.4	1.25.8	2
taigaio/taiga-protected :latest	fd4568a97a59	stdlib@go1.24.4	1.25.8	2
temporalio/admin-tools :1.15.1	35034611d981	stdlib@go1.17.6	1.25.8	2
temporalio/server :1.22.4	c0a44c26397b	stdlib@go1.20.11	1.25.8	2
temporalio/server :1.15.1	e26758f5a1bf	stdlib@go1.17.6	1.25.8	2
temporalio/ui :2.16.2	af9c9349708f	stdlib@go1.20.5	1.25.8	2
thanosio/thanos :v0.41.0	cf3e9b292e43	stdlib@go1.25.7	1.25.8	2
thesisrobot/loop :v0.11.1-beta	89ae07e787ca	stdlib@go1.13.12	1.25.8	2
thesisrobot/pool :v0.3.3-alpha	2d1c388a4bda	stdlib@go1.14.12	1.25.8	2
thomasnyambati/aws-service-events-exporter :1.0.0	1e18a0944ceb	stdlib@go1.15.6	1.25.8	2
thomasnyambati/labelsmanager-controller :1.0.0	148ae3f99fea	stdlib@go1.13.15	1.25.8	2
thomseddon/traefik-forward-auth :2.2.0	e875194d67e2	stdlib@go1.13.12	1.25.8	2
thoughtmachine/aws-service-quotas-exporter :v1.3.2	c6065ba55c72	stdlib@go1.19.4	1.25.8	2
timescale/timescaledb :latest-pg15	6343bdc87ca1	stdlib@go1.24.6	1.25.8	2
tkpd/gripmock :1.10.1	74441dadcfbd	stdlib@go1.14.6	1.25.8	2
ubercadence/server :0.23.2	2ac5491d13bb	stdlib@go1.13.6	1.25.8	2
uffizzi/controller :latest	0344805f267b	stdlib@go1.20.14	1.25.8	2
uselagoon/docker-host :v3.6.1	2c89ed939b8b	stdlib@go1.24.3	1.25.8	2
victoriametrics/vmalert :v1.95.1	a83e5db0897a	stdlib@go1.21.4	1.25.8	2
voltha/voltha-ofagent-go :2.1.6	8feb9ef89e97	stdlib@go1.16.3	1.25.8	2
voltha/voltha-openolt-adapter :4.5.16	d6d79c08350a	stdlib@go1.23.1	1.25.8	2
voltha/voltha-openonu-adapter-go :2.12.25	d8f2eb5f2a7e	stdlib@go1.23.1	1.25.8	2
voltha/voltha-rw-core :3.4.8	7a325316fe59	stdlib@go1.16.3	1.25.8	2
weblate/weblate :4.2.2-1	69c160d37a3c	stdlib@go1.13.5	1.25.8	2
wener/frpc :v0.37.0	cc9fd4da44c0	stdlib@go1.17.3	1.25.8	2
wener/frps :v0.37.0	5c92cc9e8597	stdlib@go1.17.3	1.25.8	2
wolveix/satisfactory-server :latest :v1.9.10	e103700ae6ae	stdlib@go1.18.1	1.25.8	2
xelalex/dregsy :0.4.3	574054e1c417	stdlib@go1.18.3	1.25.8	2
yzhou442/equiz :latest	a3f7ca69e28d	stdlib@go1.16.7	1.25.8	2
zhenghaoz/gorse-master :0.4.12	033046b432ec	stdlib@go1.20.1	1.25.8	2
zhenghaoz/gorse-server :0.4.12	39c565685b01	stdlib@go1.20.1	1.25.8	2
zhenghaoz/gorse-worker :0.4.12	f7739f64c9b0	stdlib@go1.20.1	1.25.8	2
gcr.io/k8s-staging-sig-storage/csi-provisioner :v3.2.1	4ad5fcdbe7e9	stdlib@go1.18	1.25.8	2
gcr.io/k8s-staging-sig-storage/nfs-provisioner :v3.0.0	2de1d15fc1f2	stdlib@go1.15	1.25.8	2
gcr.io/knative-releases/knative.dev/net-istio/cmd/controller	0d5f740b4224	stdlib@go1.24.6	1.25.8	2
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook	697668be7893	stdlib@go1.24.6	1.25.8	2
gcr.io/knative-releases/knative.dev/serving/cmd/activator	031408ec516f	stdlib@go1.24.3	1.25.8	2
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler	3502bb5aa60f	stdlib@go1.24.3	1.25.8	2
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler-hpa	7405faeb7636	stdlib@go1.24.3	1.25.8	2