StackRadar

CVE-2026-32282

Medium

Advisory

Published 7 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.4
base score, highest
EPSS
0.002
6th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,106
of 17,911 indexed, latest versions
Container images
4,610
deployed by those charts
Fix available
1 of 2
affected packages

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

Carried by container images the latest versions of 4,106 of 17,911 indexed charts deploy, on 4,610 images.

Affected packageAffected versionsFixed inImages
golang-1.19deb1.19.8-2no fix listed1
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+180 more1.25.94,610
OSV records
DEBIAN-CVE-2026-32282GO-2026-4864
Also known as
BIT-golang-2026-32282

Charts affected

4,106 by stars
ChartLatestAffected imagesRadar Score
writefreelynicholaswildeVerified publisher1.0.01 of 1See more

writefreely nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/nicholaswilde/writefreely:version-0.13.1c3c8481b7e56
stdlib@go1.15.12
1.25.9

Open the chart page →

8,223
node-exporternode-exporterVerified publisher0.1.101 of 1See more

node-exporter node-exporter 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
prom/node-exporter:v1.6.0d2e48098c364
stdlib@go1.20.4
1.25.9

Open the chart page →

1,224
helm-composenousefreakVerified publisher0.1.31 of 2See more

helm-compose nousefreak 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
library/mariadb:10.8.2-focal490f01279be1
stdlib@go1.16.7
1.25.9

Open the chart page →

13,958
nri-resource-policy-balloonsnri-pluginsOfficialVerified publisher0.14.01 of 1See more

nri-resource-policy-balloons nri-plugins 0.14.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/containers/nri-plugins/nri-resource-policy-balloons:v0.14.0a8c8297c7274
stdlib@go1.26.0
1.25.9

Open the chart page →

309
nri-resource-policy-topology-awarenri-pluginsOfficialVerified publisher0.14.01 of 1See more

nri-resource-policy-topology-aware nri-plugins 0.14.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/containers/nri-plugins/nri-resource-policy-topology-aware:v0.14.0e2443833726a
stdlib@go1.26.0
1.25.9

Open the chart page →

309
nutanix-csi-snapshotnutanix-helm-releasesOfficialVerified publisher8.3.01 of 1See more

nutanix-csi-snapshot nutanix-helm-releases 8.3.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/snapshot-controller:v8.3.012c2da094b02
stdlib@go1.24.2
1.25.9

Open the chart page →

427
octopuso7studios-octopus-helm-chartsOfficialVerified publisher1.2.34 of 5See more

octopus o7studios-octopus-helm-charts 1.2.3

4 of the 5 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
library/nats:2.11.9-alpine777787bbb4c7
stdlib@go1.24.7
1.25.9
natsio/nats-box:0.18.0abdc9f9f0120
stdlib@go1.24.3
1.25.9
natsio/nats-server-config-reloader:0.19.181edf32a3680
stdlib@go1.24.5
1.25.9
percona/percona-server-mongodb-operator:1.20.1d09453ce7886
stdlib@go1.24.3
1.25.9

Open the chart page →

6,323
oadaoadaVerified publisher5.0.61 of 11See more

oada oada 5.0.6

1 of the 11 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
groundnuty/k8s-wait-for:no-root-v2.0a26d3d3f6e1c
stdlib@go1.19.3
1.25.9

Open the chart page →

13,795
transfer.shobeoneVerified publisher1.0.51 of 1See more

transfer.sh obeone 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
dutchcoders/transfer.sh:v1.6.1-noroot8db9ade72a0d
stdlib@go1.20.11
1.25.9

Open the chart page →

1,177
oci-native-ingress-controlleroci-native-ingress-controller1.0.01 of 1See more

oci-native-ingress-controller oci-native-ingress-controller 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
amaanx86/oci-native-ingress-controller:masterd7206ac7a319
stdlib@go1.23.7
1.25.9

Open the chart page →

438
growthbookone-acre-fundVerified publisher0.3.01 of 3See more

growthbook one-acre-fund 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
jwilder/dockerize:latestf94fb59fb4f6
stdlib@go1.25.5
1.25.9

Open the chart page →

1,214
open5gs-webuiopen5gs-webuiVerified publisher2.3.11 of 2See more

open5gs-webui open5gs-webui 2.3.1

1 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:4.4.14fe2bd7b4036
stdlib@go1.15.1
1.25.9

Open the chart page →

5,352
kruiseopenkruise1.9.12 of 2See more

kruise openkruise 1.9.1

2 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
openkruise/kruise-helm-hook:v0.1.0edc7cf9428fd
stdlib@go1.20.14
1.25.9
openkruise/kruise-manager:v1.9.1f81ae78a36a4
stdlib@go1.23.9
1.25.9

Open the chart page →

1,667
openrouter-botopenrouter-botVerified publisher0.2.01 of 1See more

openrouter-bot openrouter-bot 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
lifailon/openrouter-bot:latestea37e4b6b952
stdlib@go1.25.0
1.25.9

Open the chart page →

1,094
librechatopenshift1.9.01 of 3See more

librechat openshift 1.9.0

1 of the 3 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
library/mongo:8.0.20098862b1339f
stdlib@go1.25.7
1.25.9

Open the chart page →

6,146
openstack-kamaji-clusteropenstack-kamaji-clusterVerified publisher0.2.41 of 1See more

openstack-kamaji-cluster openstack-kamaji-cluster 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
registry.k8s.io/autoscaling/cluster-autoscaler:v1.34.07b172f42533c
stdlib@go1.24.7
1.25.9

Open the chart page →

768
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.12 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.1

2 of the 34 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
grafana/grafana:13.2.2-distroless69a5d2d957ca
stdlib@go1.25.7
1.25.9
library/postgres:18.4a02db8cac496
stdlib@go1.24.6
1.25.9

Open the chart page →

21,372
openvaultopenvaultVerified publisher0.8.11 of 2See more

openvault openvault 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
stdlib@go1.23.7
1.25.9

Open the chart page →

7,275
opikopikOfficialVerified publisher2.2.815 of 13See more

opik opik 2.2.81

5 of the 13 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
alpine/kubectl:1.35.0862d86046bbc
stdlib@go1.25.5
1.25.9
cloudpirates/image-minio:RELEASE.2025-10-15T17-29-55Z-hardened8dc02a7e5093
stdlib@go1.25.7
1.25.9
library/mysql:8.4.2ac80b6e09e5b
stdlib@go1.18.2
1.25.9
library/zookeeper:3.9.4dfa9ba46d14b
stdlib@go1.18.1
1.25.9
ghcr.io/comet-ml/opik/opik-python-backend:2.2.81b9663053315e
stdlib@go1.25.8
1.25.9

Open the chart page →

15,478
opsopsVerified publisher1.2.02 of 2See more

ops ops 1.2.0

2 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
shaowenchen/ops-controller-manager:latest35575d4f2bfe
stdlib@go1.24.13
1.25.9
shaowenchen/ops-server:latest6bac5cebd125
stdlib@go1.24.9
1.25.9

Open the chart page →

102,779
orbitalregorbitalregVerified publisher0.3.02 of 4See more

orbitalreg orbitalreg 0.3.0

2 of the 4 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
stdlib@go1.24.6
1.25.9
orbitalreg/orbitalreg-api:0.1.045f2620337af
stdlib@go1.22.12
1.25.9

Open the chart page →

2,295
kubernetes-dashboard-proxyosc0.7.23 of 4See more

kubernetes-dashboard-proxy osc 0.7.2

3 of the 4 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
kubernetesui/dashboard:v2.7.02e500d29e9d5
stdlib@go1.19
1.25.9
kubernetesui/metrics-scraper:v1.0.876049887f07a
stdlib@go1.18.2
1.25.9
quay.io/oauth2-proxy/oauth2-proxy:v7.1.3ecd26b74a01f
stdlib@go1.16
1.25.9

Open the chart page →

6,011
osc-bsu-csi-driverosc-bsu-csi-driverVerified publisher2.2.03 of 6See more

osc-bsu-csi-driver osc-bsu-csi-driver 2.2.0

3 of the 6 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.15.011f199f6bec4
stdlib@go1.24.6
1.25.9
registry.k8s.io/sig-storage/csi-provisioner:v6.1.1d992c36d4ddd
stdlib@go1.24.6
1.25.9
registry.k8s.io/sig-storage/livenessprobe:v2.16.088092d100909
stdlib@go1.24.2
1.25.9

Open the chart page →

2,413
hlf-caowkin2.1.02 of 2See more

hlf-ca owkin 2.1.0

2 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
hyperledger/fabric-ca:1.5.1c7f3422ec1d5
stdlib@go1.15.7
1.25.9
jwilder/dockerize:latestf94fb59fb4f6
stdlib@go1.25.5
1.25.9

Open the chart page →

3,425
hlf-ordowkin3.1.01 of 1See more

hlf-ord owkin 3.1.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
hyperledger/fabric-orderer:2.2.137294e05209b
stdlib@go1.14.4
1.25.9

Open the chart page →

3,357
hlf-peerowkin5.1.01 of 1See more

hlf-peer owkin 5.1.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
hyperledger/fabric-peer:2.2.1bf4995c86af6
stdlib@go1.14.4
1.25.9

Open the chart page →

3,682
prometheus-cachethqoxyno-zetaVerified publisher1.1.11 of 1See more

prometheus-cachethq oxyno-zeta 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
oxynozeta/prometheus-cachethq:1.1.131f11669d597
stdlib@go1.15.1
1.25.9

Open the chart page →

1,715
ngrok-operatorpaganuzzi0.0.21 of 1See more

ngrok-operator paganuzzi 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/paganuzzi/ngrokoperator:latest5a10cd095699
stdlib@go1.15.12
1.25.9

Open the chart page →

2,806
paperless-ngxpaperlessVerified publisher0.4.01 of 3See more

paperless-ngx paperless 0.4.0

1 of the 3 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngxdigest-pinnedaa810a36942c
stdlib@go1.24.4
1.25.9

Open the chart page →

9,309
pardus-nginx-nodeportpardus-charts0.5.01 of 1See more

pardus-nginx-nodeport pardus-charts 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
uderelier19/pardus-nginx:25-nodeport8ab640b44e3f
stdlib@go1.24.4
1.25.9

Open the chart page →

321
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
stdlib@go1.20.5
1.25.9

Open the chart page →

7,214
patch-operatorpatch-operator0.1.112 of 2See more

patch-operator patch-operator 0.1.11

2 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
quay.io/redhat-cop/kube-rbac-proxy:v0.11.0c68135620167
stdlib@go1.15.15
1.25.9
quay.io/redhat-cop/patch-operator:v0.1.11030ade9b9428
stdlib@go1.21.9
1.25.9

Open the chart page →

7,969
pbuf-registrypbuf-registry0.4.12 of 2See more

pbuf-registry pbuf-registry 0.4.1

2 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
library/postgres:18.1-alpine3.2144d837eb4c2e
stdlib@go1.24.6
1.25.9
ghcr.io/pbufio/registry:v0.4.177a36c035b4b
stdlib@go1.25.5
1.25.9

Open the chart page →

2,164
pdf-editor-helmpdf-editor-web1.0.02 of 4See more

pdf-editor-helm pdf-editor-web 1.0.0

2 of the 4 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
dipugodocker/pdf-editor:1.0-backend-rotate316e203b8bf5
stdlib@go1.18.7
1.25.9
dipugodocker/pdf-editor:1.0-backend-merge70b07544a604
stdlib@go1.18.7
1.25.9

Open the chart page →

4,242
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
stdlib@go1.24.4
1.25.9

Open the chart page →

7,668
pgbouncerpgbouncer-helm0.6.01 of 2See more

pgbouncer pgbouncer-helm 0.6.0

1 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
apache/airflow:airflow-pgbouncer-exporter-2025.03.05-0.18.0adf7260c2c5f
stdlib@go1.23.7
1.25.9

Open the chart page →

471
spirephilips-labsVerified publisher0.12.25 of 6See more

spire philips-labs 0.12.2

5 of the 6 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/spiffe/spiffe-csi-driver:0.2.34144101005b2
stdlib@go1.20.1
1.25.9
ghcr.io/spiffe/spire-agent:1.6.062517726d0c4
stdlib@go1.20.1
1.25.9
ghcr.io/spiffe/spire-controller-manager:0.2.25e90b2d092df
stdlib@go1.20.1
1.25.9
ghcr.io/spiffe/spire-server:1.6.0635b9024cad2
stdlib@go1.20.1
1.25.9
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.6.2a13bff2ed69a
stdlib@go1.19
1.25.9

Open the chart page →

7,276
chadbotphntom0.2.31 of 1See more

chadbot phntom 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
phntom/chadbot:0.2.397c28e4178ad
stdlib@go1.21.5
1.25.9

Open the chart page →

1,098
chartmuseumphntom4.0.201 of 1See more

chartmuseum phntom 4.0.20

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
phntom/chartmuseum:v0.16.053883b65d9b7
stdlib@go1.19.3
1.25.9

Open the chart page →

2,946
phonebook-chartphonebook-chart0.1.01 of 3See more

phonebook-chart phonebook-chart 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
stdlib@go1.18.2
1.25.9

Open the chart page →

3,047
phpipamphpipam-helmVerified publisher1.0.121 of 3See more

phpipam phpipam-helm 1.0.12

1 of the 3 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
library/mysql:8.0.40d58ac93387f6
stdlib@go1.18.2
1.25.9

Open the chart page →

3,885
pipelinewise-operatorpipelinewise-operatorVerified publisher0.5.11 of 1See more

pipelinewise-operator pipelinewise-operator 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
dirathea/pipelinewise-operator:v0.5.08d4c9f773ae1
stdlib@go1.15.8
1.25.9

Open the chart page →

2,116
matomopockostVerified publisher1.3.01 of 3See more

matomo pockost 1.3.0

1 of the 3 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
library/mariadb:12.3.3dd9b303aed4f
stdlib@go1.24.6
1.25.9

Open the chart page →

5,610
podtracepodtraceOfficialVerified publisher0.14.81 of 2See more

podtrace podtrace 0.14.8

1 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
alpine/k8s:1.37.0b421c2e9419e
stdlib@go1.24.0
1.25.9

Open the chart page →

644
secrets-store-csi-driver-provider-awsportefaix-hub0.4.01 of 1See more

secrets-store-csi-driver-provider-aws portefaix-hub 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
public.ecr.aws/aws-secrets-manager/secrets-store-csi-driver-provider-aws:1.0.r2-2021.08.13.20.34-linux-amd6402aed3370fce
stdlib@go1.15.12
1.25.9

Open the chart page →

2,212
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
codercom/code-server:4.11.0-debian1e2cc688008e
stdlib@go1.14.4
1.25.9

Open the chart page →

33,319
postgres-backuppostgres-backup0.3.02 of 2See more

postgres-backup postgres-backup 0.3.0

2 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
library/postgres:14.13162a6ead070
stdlib@go1.16.7
1.25.9
nerzhul/mc-arm64:2020.10.034215df511f31
stdlib@go1.15.2
1.25.9

Open the chart page →

5,471
postgresqlpostgresqlVerified publisher0.3.172 of 2See more

postgresql postgresql 0.3.17

2 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
library/postgres:18.6-alpined3e1620b530c
stdlib@go1.24.6
1.25.9
pgautoupgrade/pgautoupgrade:18-alpine48b448825656
stdlib@go1.24.6
1.25.9

Open the chart page →

1,278
postgresqlpostgresql-helm0.1.21 of 1See more

postgresql postgresql-helm 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
library/postgres:16a3b7f434b2dc
stdlib@go1.24.6
1.25.9

Open the chart page →

1,316
rethinkdbpozetron1.1.91 of 1See more

rethinkdb pozetron 1.1.9

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
pozetroninc/rethinkdb-cluster:v2.4.16b06a098f994
stdlib@go1.16.9
1.25.9

Open the chart page →

2,908

Container images carrying it

4,610 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
stdlib@go1.23.4
1.25.9
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.9.0f9d65db8bda2
stdlib@go1.25.5
1.25.9
1
registry.k8s.io/sig-storage/nfsplugin:v4.11.0ce5b5ccd5eb0
stdlib@go1.23.6
1.25.9
1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.03ce0fdba4d8e
stdlib@go1.15
1.25.9
1
registry.k8s.io/sig-storage/objectstorage-sidecar:v0.2.2c7166a73a303
stdlib@go1.24.11
1.25.9
1
registry.k8s.io/sig-storage/snapshot-controller:v8.2.1472fa35a89da
stdlib@go1.23.6
1.25.9
1
registry.k8s.io/sig-storage/snapshot-controller:v4.2.195587f8777d7
stdlib@go1.16.2
1.25.9
1
registry.k8s.io/sig-storage/snapshot-controller:v6.2.198bab4eaf23c
stdlib@go1.19
1.25.9
1
registry.k8s.io/sig-storage/snapshot-controller:v6.3.1ce6ca3c0e30b
stdlib@go1.20.5
1.25.9
1
registry.k8s.io/sig-storage/volume-data-source-validator:v1.0.0d35884236461
stdlib@go1.17.3
1.25.9
1

syft 1.42.1 · advisories as of 27 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.