CVE-2026-27139

Low

Advisory

Published 6 Mar 2026In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 2.5; base score, highest
EPSS: 0.002; 10th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 3,843; of 17,813 indexed, latest versions
Container images: 4,361; deployed by those charts
Fix available: 1 of 2; affected packages

FileInfo can escape from a Root in os

Carried by container images the latest versions of 3,843 of 17,813 indexed charts deploy, on 4,361 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+177 more	1.25.8	4,361
golang-1.19deb	1.19.8-2	no fix listed	1

OSV records: DEBIAN-CVE-2026-27139 GO-2026-4602
Also known as: BIT-golang-2026-27139

Charts affected

3,843 by stars

Chart

Latest

Affected images

Radar Score

vmot-container-kit

0.0.3

4 of 7 See more

vm ot-container-kit 0.0.3

4 of the 7 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
grafana/grafana :11.1.4	886b56d5534e	stdlib@go1.22.4	1.25.8
victoriametrics/operator :v0.47.2	71be93cfafb6	stdlib@go1.23.0	1.25.8
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	stdlib@go1.22.5	1.25.8
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.13.0	639a1e2da549	stdlib@go1.22.5	1.25.8

Open the chart page →

5,428

otel-add-onotel-add-on

0.1.4

1 of 1 See more

otel-add-on otel-add-on 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/kedify/otel-add-on :v0.1.4	a6f2155bd822	stdlib@go1.24.3	1.25.8

Open the chart page →

734

adotowan-charts

0.1.0

1 of 1 See more

adot owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-observability/aws-otel-collector :v0.43.3	8aa9ea5f67b8	stdlib@go1.24.3	1.25.8

Open the chart page →

1,033

httpbunowan-charts

0.1.0

1 of 1 See more

httpbun owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
sharat87/httpbun :latest	405332d9050a	stdlib@go1.25.1	1.25.8

Open the chart page →

314

minioowan-charts

0.1.2

1 of 2 See more

minio owan-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/georgmangold/console :v1.8.1	58f4f180aa6e	stdlib@go1.24.4	1.25.8

Open the chart page →

1,083

kubernetes-taggeroxyno-zeta

1.1.2

1 of 1 See more

kubernetes-tagger oxyno-zeta 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
oxynozeta/kubernetes-tagger :1.3.0	a153c386f5af	stdlib@go1.17	1.25.8

Open the chart page →

1,827

arpap2p-avs

0.1.3

1 of 2 See more

arpa p2p-avs 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/arpa-network/node-client :latest	657a2c9f6e6d	stdlib@go1.22.5	1.25.8

Open the chart page →

1,997

automatap2p-avs

0.1.0

1 of 2 See more

automata p2p-avs 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/automata-network/multi-prover-avs/operator :v0.6.0	752f1aa02438	stdlib@go1.22.1	1.25.8

Open the chart page →

3,695

avap2p-avs

0.1.0

1 of 1 See more

ava p2p-avs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
avaprotocol/ap-avs :1.2.0	c430ea5c37d6	stdlib@go1.22.5	1.25.8

Open the chart page →

3,362

eigendap2p-avs

0.1.1

2 of 3 See more

eigenda p2p-avs 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/layr-labs/eigenda/opr-node :0.8.4	6650119a385f	stdlib@go1.21.1	1.25.8
ghcr.io/layr-labs/eigenda/opr-nodeplugin :0.8.4	e459ad3ae758	stdlib@go1.21.1	1.25.8

Open the chart page →

2,336

predicatep2p-avs

0.1.4

1 of 1 See more

predicate p2p-avs 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/predicatelabs/operator :v1.0.5	b62113fe1b27	stdlib@go1.23.5	1.25.8

Open the chart page →

893

p4p4

0.1.0

3 of 7 See more

p4 p4 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
codeurjc/toposervice :v1.23	9fb4c11e6a49	stdlib@go1.18.10	1.25.8
library/mongo :5.0-focal	5e15a3f014ed	stdlib@go1.24.6	1.25.8
library/mysql :8	b3b90af2a655	stdlib@go1.24.6	1.25.8

Open the chart page →

27,879

myappp4-helm

0.1.0

1 of 6 See more

19,768

pacmanpacman-mh

0.1.28

1 of 2 See more

pacman pacman-mh 0.1.28

1 of the 2 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mongo :7.0.28-jammy	88785f6f665a	stdlib@go1.24.0	1.25.8

Open the chart page →

3,627

pagespages

1.0.0

1 of 3 See more

20,285

pagespages10

1.0.0

1 of 3 See more

20,285

pagespages111

1.0.0

1 of 3 See more

20,285

pagespages2

1.0.0

1 of 3 See more

20,285

pagespages-alexchmielu

1.0.0

1 of 3 See more

pages pages-alexchmielu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-alps

1.0.0

1 of 3 See more

pages pages-alps 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-alstom

1.0.0

1 of 3 See more

pages pages-alstom 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-ambala

1.0.0

1 of 3 See more

pages pages-ambala 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-andromeda

1.0.0

1 of 3 See more

pages pages-andromeda 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespagesbadami

1.0.0

1 of 3 See more

pages pagesbadami 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-blackburn

1.0.0

1 of 3 See more

pages pages-blackburn 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-botes

1.0.0

1 of 3 See more

pages pages-botes 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-brian

1.0.0

1 of 3 See more

pages pages-brian 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-buckll

1.0.0

1 of 3 See more

pages pages-buckll 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-camden

1.0.0

1 of 3 See more

pages pages-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-camden771

1.0.0

1 of 3 See more

pages pages-camden771 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-draco

1.0.0

1 of 3 See more

pages pages-draco 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-ellora

1.0.0

1 of 3 See more

pages pages-ellora 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-finchley

1.0.0

1 of 3 See more

pages pages-finchley 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-fornax

1.0.0

1 of 3 See more

pages pages-fornax 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-harsh

1.0.0

1 of 3 See more

pages pages-harsh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespagesk

1.0.0

1 of 3 See more

20,285

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-mihai

1.0.0

1 of 3 See more

pages pages-mihai 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-nivesh

1.0.0

1 of 3 See more

pages pages-nivesh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespagessandeepgudu

1.0.0

1 of 3 See more

pages pagessandeepgudu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-shubhanker

1.0.0

1 of 3 See more

pages pages-shubhanker 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-ssharma0909

1.0.0

1 of 3 See more

pages pages-ssharma0909 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-sucharitha

1.0.0

1 of 3 See more

pages pages-sucharitha 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-sudhir

1.0.0

1 of 3 See more

pages pages-sudhir 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-sushi

1.0.0

1 of 3 See more

pages pages-sushi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-vasanth5814

1.0.0

1 of 3 See more

pages pages-vasanth5814 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

pagespages-vjp

1.0.0

1 of 3 See more

pages pages-vjp 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.8

Open the chart page →

20,285

paperclippaperclip-helm

0.1.0

1 of 3 See more

paperclip paperclip-helm 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
library/postgres :17-alpine	18cfe3ef5e68	stdlib@go1.24.6	1.25.8

Open the chart page →

494

paperclip-operatorpaperclip-operator

0.19.1

1 of 1 See more

paperclip-operator paperclip-operator 0.19.1

1 of the 1 container images this version deploys carry CVE-2026-27139.

Container image	Digest	Package	Fixed in
ghcr.io/paperclipinc/paperclip-operator :v0.19.1	0984b890eb38	stdlib@go1.25.0	1.25.8

Open the chart page →

352

Container images carrying it

4,361 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
mvisonneau/tailscale :v1.68.1	fc45ad8abf10	stdlib@go1.22.4	1.25.8	1
mzinc/configmapsecret-controller :v0.5.1	eebbcbf2d1f7	stdlib@go1.16.1	1.25.8	1
mziyabo/fargate-eks-sidecar-injector :latest	3067dce17983	stdlib@go1.19.13	1.25.8	1
n8nio/n8n :1.86.0	8b39ed5a2de9	stdlib@go1.24.0	1.25.8	1
n8nio/n8n :1.115.1	ed16e560c40e	stdlib@go1.24.6	1.25.8	1
nacos/nacos-peer-finder-plugin :latest	a9c769301fa6	stdlib@go1.13.5	1.25.8	1
nadoo/glider :0.16	38aadefbd607	stdlib@go1.20.14	1.25.8	1
nathanfirmo/dbgate :latest	6b0487e6e987	stdlib@go1.24.5	1.25.8	1
natsio/nats-box :0.14.3	1cc420186664	stdlib@go1.22.1	1.25.8	1
natsio/nats-box :0.13.5	59cf2e949181	stdlib@go1.19.5	1.25.8	1
natsio/nats-box :0.18.0	abdc9f9f0120	stdlib@go1.24.3	1.25.8	1
natsio/nats-box :0.13.3	c507bd7e3831	stdlib@go1.19.4	1.25.8	1
natsio/nats-box :0.14.2	e808e0644ce1	stdlib@go1.21.5	1.25.8	1
natsio/nats-kafka :1.4.2	bb241956b0dc	stdlib@go1.20	1.25.8	1
natsio/nats-operator :0.8.3	1261dae38389	stdlib@go1.16.10	1.25.8	1
natsio/nats-server-config-reloader :0.14.1	0d50270fa374	stdlib@go1.20.5	1.25.8	1
natsio/nats-server-config-reloader :0.20.1	47094fcae2f4	stdlib@go1.24.8	1.25.8	1
natsio/nats-server-config-reloader :0.15.0	5b21830a9e9d	stdlib@go1.22.4	1.25.8	1
natsio/nats-server-config-reloader :0.8.0	6bdaceb63aa5	stdlib@go1.19.4	1.25.8	1
natsio/nats-server-config-reloader :0.19.1	81edf32a3680	stdlib@go1.24.5	1.25.8	1
natsio/nats-server-config-reloader :0.14.0	8c28b75bc416	stdlib@go1.20.5	1.25.8	1
natsio/nats-server-config-reloader :0.16.1	bf97e5e9b9d2	stdlib@go1.23.3	1.25.8	1
natsio/nats-server-config-reloader :0.11.0	c3a755eab2cc	stdlib@go1.20.5	1.25.8	1
natsio/prometheus-nats-exporter :0.18.0	02469dc907bc	stdlib@go1.24.6	1.25.8	1
natsio/prometheus-nats-exporter :0.13.0	2adf791d9f9f	stdlib@go1.21.3	1.25.8	1
natsio/prometheus-nats-exporter :0.16.0	54b0d7ff058e	stdlib@go1.23.4	1.25.8	1
natsio/prometheus-nats-exporter :0.10.1	bce728062c4f	stdlib@go1.19.3	1.25.8	1
ncabatoff/process-exporter	6f0549dc24e9	stdlib@go1.23.1	1.25.8	1
neo4j/helm-charts-reverse-proxy :2026.08.1	ea1b8444808d	stdlib@go1.24.13	1.25.8	1
neosmemo/memos :0.26.2	3eefcc231141	stdlib@go1.25.7	1.25.8	1
neosmemo/memos :0.24	c6defc2dfb98	stdlib@go1.24.3	1.25.8	1
neosu/kubebadges :v0.0.5	256530d8e5c6	stdlib@go1.21.3	1.25.8	1
nerzhul/mc-arm64 :2020.10.03	4215df511f31	stdlib@go1.15.2	1.25.8	1
netapp/controller :25.11.0-bxp-preview	06f6c9a0653f	stdlib@go1.24.9	1.25.8	1
netapp/trident-operator :21.10.0	49cfe552d9c2	stdlib@go1.16.9	1.25.8	1
netapp/trident-protect-connector :25.11.0-bxp-preview	ec22fc6e5c5a	stdlib@go1.24.9	1.25.8	1
netapp/trident-protect-utils :v1.0.0	58b9fac358bd	stdlib@go1.24.8	1.25.8	1
netbirdio/management :0.45.1	0c9994b393ea	stdlib@go1.23.9	1.25.8	1
netbirdio/management :0.60.2	52682e5f48f9	stdlib@go1.23.12	1.25.8	1
netbirdio/management :0.46.0	b0adc4ad4ec6	stdlib@go1.23.9	1.25.8	1
netbirdio/relay :0.45.1	872e3add0e1e	stdlib@go1.23.9	1.25.8	1
netbirdio/relay :0.60.2	a10762533793	stdlib@go1.23.12	1.25.8	1
netbirdio/relay :0.46.0	d32f82514a24	stdlib@go1.23.9	1.25.8	1
netbirdio/signal :0.45.1	46ce5a45538f	stdlib@go1.23.9	1.25.8	1
netbirdio/signal :0.60.2	67176bcbf6ab	stdlib@go1.23.12	1.25.8	1
netbirdio/signal :0.46.0	e8f392611152	stdlib@go1.23.9	1.25.8	1
netrisai/controller-grpc :4.6.0.007	53178bf173c2	stdlib@go1.25.6	1.25.8	1
netrisai/controller-telescope :4.6.0.004	14d82948a8b2	stdlib@go1.25.6	1.25.8	1
netrisai/controller-web-session-generator :0.2.0	a030a31289f4	stdlib@go1.14.15	1.25.8	1
netrisai/mariadb :10.11.4-debian-11-r46	0aa742a0b906	stdlib@go1.19.11	1.25.8	1