StackRadar

CVE-2026-32282

Medium

Advisory

Published 7 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.4
base score, highest
EPSS
0.002
6th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,106
of 17,911 indexed, latest versions
Container images
4,610
deployed by those charts
Fix available
1 of 2
affected packages

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

Carried by container images the latest versions of 4,106 of 17,911 indexed charts deploy, on 4,610 images.

Affected packageAffected versionsFixed inImages
golang-1.19deb1.19.8-2no fix listed1
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+180 more1.25.94,610
OSV records
DEBIAN-CVE-2026-32282GO-2026-4864
Also known as
BIT-golang-2026-32282

Charts affected

4,106 by stars
ChartLatestAffected imagesRadar Score
kubeform-provider-azureappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-azure appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-azure:v0.0.1ac8459f70f85
stdlib@go1.20.5
1.25.9

Open the chart page →

2,730
kubeform-provider-gcpappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-gcp appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-gcp:v0.0.1af77073c184f
stdlib@go1.19.9
1.25.9

Open the chart page →

2,756
kubestashappscodeVerified publisher2026.7.102 of 2See more

kubestash appscode 2026.7.10

2 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/kubectl-nonroot:1.340b26892cec94
stdlib@go1.24.13
1.25.9
ghcr.io/kubestash/kubestash:v0.29.00686b2a40280
stdlib@go1.25.5
1.25.9

Open the chart page →

958
kubestash-certifiedappscodeVerified publisher2026.7.102 of 2See more

kubestash-certified appscode 2026.7.10

2 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/kubectl-nonroot:1.340b26892cec94
stdlib@go1.24.13
1.25.9
ghcr.io/kubestash/kubestash:v0.29.00686b2a40280
stdlib@go1.25.5
1.25.9

Open the chart page →

958
kubestash-operatorappscodeVerified publisher0.29.02 of 2See more

kubestash-operator appscode 0.29.0

2 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/kubectl-nonroot:1.340b26892cec94
stdlib@go1.24.13
1.25.9
ghcr.io/kubestash/kubestash:v0.29.00686b2a40280
stdlib@go1.25.5
1.25.9

Open the chart page →

958
kubevaultappscodeVerified publisher2026.8.71 of 2See more

kubevault appscode 2026.8.7

1 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/kubectl-nonroot:1.340b26892cec94
stdlib@go1.24.13
1.25.9

Open the chart page →

866
kubevault-webhook-serverappscodeVerified publisher0.25.01 of 2See more

kubevault-webhook-server appscode 0.25.0

1 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/kubectl-nonroot:1.340b26892cec94
stdlib@go1.24.13
1.25.9

Open the chart page →

866
kubevirt-infra-csi-driverappscodeVerified publisher0.1.02 of 6See more

kubevirt-infra-csi-driver appscode 0.1.0

2 of the 6 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
quay.io/kubevirt/kubevirt-csi-driver:latest7b31b21b3f1e
stdlib@go1.24.13
1.25.9
registry.k8s.io/sig-storage/csi-resizer:v1.13.12a0b297cc7c4
stdlib@go1.23.1
1.25.9

Open the chart page →

1,859
kubevirt-tenant-csi-driverappscodeVerified publisher0.1.02 of 4See more

kubevirt-tenant-csi-driver appscode 0.1.0

2 of the 4 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
quay.io/kubevirt/kubevirt-csi-driver:latest7b31b21b3f1e
stdlib@go1.24.13
1.25.9
registry.k8s.io/sig-storage/snapshot-controller:v6.3.1ce6ca3c0e30b
stdlib@go1.20.5
1.25.9

Open the chart page →

1,717
license-proxyserver-addon-managerappscodeVerified publisher2024.2.251 of 1See more

license-proxyserver-addon-manager appscode 2024.2.25

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/license-proxyserver:v0.0.8d6c2532ea386
stdlib@go1.22.1
1.25.9

Open the chart page →

1,397
managed-serviceaccountappscodeVerified publisher2024.2.251 of 1See more

managed-serviceaccount appscode 2024.2.25

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/kluster-manager/managed-serviceaccount:latest365183f83ac9
stdlib@go1.22.0
1.25.9

Open the chart page →

2,445
managed-serviceaccount-managerappscodeVerified publisher2026.2.161 of 1See more

managed-serviceaccount-manager appscode 2026.2.16

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/kluster-manager/managed-serviceaccount:v0.10.0fc256885915b
stdlib@go1.25.8
1.25.9

Open the chart page →

971
marketplace-apiappscodeVerified publisher2026.9.111 of 1See more

marketplace-api appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1139076a89c36b
stdlib@go1.25.3
1.25.9

Open the chart page →

2,571
minioappscodeVerified publisher2026.9.111 of 1See more

minio appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2023-01-12T02-06-16Zfc6bedc99355
stdlib@go1.19.4
1.25.9

Open the chart page →

4,261
multicluster-controlplaneappscodeVerified publisher2025.4.301 of 1See more

multicluster-controlplane appscode 2025.4.30

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/kluster-manager/multicluster-controlplane:latest6de40f528be9
stdlib@go1.21.8
1.25.9

Open the chart page →

2,632
multicluster-ingress-readerappscodeVerified publisher2024.7.101 of 1See more

multicluster-ingress-reader appscode 2024.7.10

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/kubectl-nonroot:1.340b26892cec94
stdlib@go1.24.13
1.25.9

Open the chart page →

306
offline-license-serverappscodeVerified publisher2026.9.111 of 2See more

offline-license-server appscode 2026.9.11

1 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/offline-license-server:v0.0.76e4b66308d8f6
stdlib@go1.25.5
1.25.9

Open the chart page →

1,737
opentelemetry-kube-stackappscodeVerified publisher0.14.123 of 3See more

opentelemetry-kube-stack appscode 0.14.12

3 of the 3 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
rancher/kubectl:v1.34.1090bef429ed1
stdlib@go1.24.6
1.25.9
ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator:0.144.079b81912f1fb
stdlib@go1.25.6
1.25.9
quay.io/brancz/kube-rbac-proxy:v0.20.0147cb28fea35
stdlib@go1.25.1
1.25.9

Open the chart page →

1,904
opscenter-configappscodeVerified publisher2022.6.141 of 2See more

opscenter-config appscode 2022.6.14

1 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/panopticon:v0.0.62cdae231ed8a
stdlib@go1.19.4
1.25.9

Open the chart page →

1,815
opscenter-coreappscodeVerified publisher2022.6.144 of 4See more

opscenter-core appscode 2022.6.14

4 of the 4 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/grafana-tools:v0.0.1f60324bca644
stdlib@go1.19.4
1.25.9
ghcr.io/appscode/kube-ui-server:v0.0.1340775d6850b5
stdlib@go1.19.5
1.25.9
ghcr.io/appscode/license-proxyserver:v0.0.372a5c874d854
stdlib@go1.19.6
1.25.9
ghcr.io/appscode/supervisor:v0.0.21a58f56724da
stdlib@go1.19.4
1.25.9

Open the chart page →

7,755
panopticonappscodeVerified publisher2026.9.181 of 2See more

panopticon appscode 2026.9.18

1 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/kubectl-nonroot:1.340b26892cec94
stdlib@go1.24.13
1.25.9

Open the chart page →

433
platform-apiappscodeVerified publisher2026.9.112 of 3See more

platform-api appscode 2026.9.11

2 of the 3 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1139076a89c36b
stdlib@go1.25.3
1.25.9
ghcr.io/appscode/gotenberg:8.25f9104080d9a7
stdlib@go1.25.4
1.25.9

Open the chart page →

39,372
platform-linksappscodeVerified publisher2026.9.111 of 1See more

platform-links appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/fileserver:v0.0.2b1857871e06c
stdlib@go1.25.4
1.25.9

Open the chart page →

779
prom-proxyappscodeVerified publisher2023.3.231 of 1See more

prom-proxy appscode 2023.3.23

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2023.03.235f5a40fc1702
stdlib@go1.20.2
1.25.9

Open the chart page →

2,510
secrets-store-csi-driver-provider-virtual-secretsappscodeVerified publisher2026.8.141 of 1See more

secrets-store-csi-driver-provider-virtual-secrets appscode 2026.8.14

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/secrets-store-csi-driver-provider-virtual-secrets:v0.2.07afb394f9f97
stdlib@go1.24.1
1.25.9

Open the chart page →

572
service-backendappscodeVerified publisher2026.9.111 of 1See more

service-backend appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/service-provider:v0.0.2f6e481386d70
stdlib@go1.25.5
1.25.9

Open the chart page →

1,378
service-gatewayappscodeVerified publisher2026.9.111 of 3See more

service-gateway appscode 2026.9.11

1 of the 3 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/voyagermesh/echoserver:v20221109fa56a9251de6
stdlib@go1.19
1.25.9

Open the chart page →

2,256
service-presetsappscodeVerified publisher2024.2.111 of 1See more

service-presets appscode 2024.2.11

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/voyagermesh/echoserver:v20221109-7ee2f3efa56a9251de6
stdlib@go1.19
1.25.9

Open the chart page →

825
service-providerappscodeVerified publisher2026.9.112 of 2See more

service-provider appscode 2026.9.11

2 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/kube-rbac-proxy:v0.18.27de54b6dedc8
stdlib@go1.23.3
1.25.9
ghcr.io/appscode/service-provider:v0.0.2f6e481386d70
stdlib@go1.25.5
1.25.9

Open the chart page →

2,287
service-vaultappscodeVerified publisher2026.9.111 of 2See more

service-vault appscode 2026.9.11

1 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/kubectl-nonroot:1.340b26892cec94
stdlib@go1.24.13
1.25.9

Open the chart page →

866
stash-communityappscodeVerified publisher0.42.04 of 4See more

stash-community appscode 0.42.0

4 of the 4 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
prom/pushgateway:v1.4.2a684e7c830a4
stdlib@go1.16.9
1.25.9
ghcr.io/appscode/kubectl-nonroot:1.3183d43cc41590
stdlib@go1.24.9
1.25.9
ghcr.io/stashed/stash:v0.42.03a98245a7667
stdlib@go1.25.3
1.25.9
ghcr.io/stashed/stash-crd-installer:v0.42.076f0a650e44b
stdlib@go1.25.3
1.25.9

Open the chart page →

3,669
stash-opscenterappscodeVerified publisher2025.10.171 of 1See more

stash-opscenter appscode 2025.10.17

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/stashed/stash-ui-server:v0.23.047cffbc65700
stdlib@go1.25.3
1.25.9

Open the chart page →

686
stash-ui-serverappscodeVerified publisher0.23.01 of 1See more

stash-ui-server appscode 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/stashed/stash-ui-server:v0.23.047cffbc65700
stdlib@go1.25.3
1.25.9

Open the chart page →

686
statefulsetappscodeVerified publisher0.0.12 of 3See more

statefulset appscode 0.0.1

2 of the 3 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/kube-rbac-proxy:v0.11.00df4ae70e3bd
stdlib@go1.15.14
1.25.9
ghcr.io/appscode/kubectl-nonroot:v1.248ee5bdd68977
stdlib@go1.20.7
1.25.9

Open the chart page →

2,739
taskqueueappscodeVerified publisher2026.2.161 of 1See more

taskqueue appscode 2026.2.16

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/taskqueue:v0.0.36877c958a3c6
stdlib@go1.25.5
1.25.9

Open the chart page →

1,132
tricksterappscodeVerified publisher2026.1.151 of 1See more

trickster appscode 2026.1.15

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/appscode/trickster:v2.0.0cdbbed831f28
stdlib@go1.25.5
1.25.9

Open the chart page →

1,254
voyagerappscodeVerified publisher2026.3.231 of 1See more

voyager appscode 2026.3.23

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/voyagermesh/voyager:v17.5.04964ceaf9d35
stdlib@go1.25.8
1.25.9

Open the chart page →

742
haproxyappuio2.7.21 of 1See more

haproxy appuio 2.7.2

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/vshn/haproxy-with-mysql:1.0.0a3c27ee3fb2f
stdlib@go1.21.1
1.25.9

Open the chart page →

5,873
stardog-userrole-operatorappuio0.4.01 of 1See more

stardog-userrole-operator appuio 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/vshn/stardog-userrole-operator:v0.3.04774237c9e86
stdlib@go1.22.2
1.25.9

Open the chart page →

1,212
chart-app-vidapp-vid-chartVerified publisher0.0.71 of 2See more

chart-app-vid app-vid-chart 0.0.7

1 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
library/mongo:latest5d7043a4ffe0
stdlib@go1.24.6
1.25.9

Open the chart page →

8,591
appwriteappwrite-helmVerified publisher1.3.24 of 8See more

appwrite appwrite-helm 1.3.2

4 of the 8 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
appwrite/appwrite:1.9.01aaa70127114
stdlib@go1.25.7
1.25.9
bitnamilegacy/mariadb:10.6.12-debian-11-r1315edb5643b73
stdlib@go1.19.7
1.25.9
bitnamilegacy/redis:7.0.10-debian-11-r059293f5206b7
stdlib@go1.19.7
1.25.9
openruntimes/executor:0.11.42228f186dcbb
stdlib@go1.21.10
1.25.9

Open the chart page →

10,028
harbor-scanner-trivyaqua-helm0.17.01 of 1See more

harbor-scanner-trivy aqua-helm 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.20.07ea4aa3d2eb6
stdlib@go1.16.4
1.25.9

Open the chart page →

5,219
arcadearcadeVerified publisher1.10.11 of 10See more

arcade arcade 1.10.1

1 of the 10 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
library/postgres:17-alpine18cfe3ef5e68
stdlib@go1.24.6
1.25.9

Open the chart page →

1,024
argocd-bitbucket-proxyargocd-bitbucket-proxy1.1.11 of 1See more

argocd-bitbucket-proxy argocd-bitbucket-proxy 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/salemgolemugoo/argocd-bitbucket-proxy:latesta72df069095b
stdlib@go1.26.1
1.25.9

Open the chart page →

190
argocdargo-helm-charts1.0.03 of 3See more

argocd argo-helm-charts 1.0.0

3 of the 3 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.42.18186d6dd81f4
stdlib@go1.23.4
1.25.9
public.ecr.aws/docker/library/redis:7.2.8-alpinec88ea2979a49
stdlib@go1.18.2
1.25.9
quay.io/argoproj/argocd:v2.14.115fc69e31c755
stdlib@go1.22.2
1.25.9

Open the chart page →

7,923
argo-workflowsargo-helm-charts1.0.02 of 2See more

argo-workflows argo-helm-charts 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
quay.io/argoproj/argocli:v3.7.16efd1cb89dc1
stdlib@go1.24.6
1.25.9
quay.io/argoproj/workflow-controller:v3.7.166388d1b2f08
stdlib@go1.24.6
1.25.9

Open the chart page →

1,862
clickhouseargonaut-charts0.6.82 of 3See more

clickhouse argonaut-charts 0.6.8

2 of the 3 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.16.1db7dde971407
stdlib@go1.13.15
1.25.9
altinity/metrics-exporter:0.16.185b4fdbae053
stdlib@go1.13.15
1.25.9

Open the chart page →

8,737
istio-discoveryargonaut-charts0.3.31 of 1See more

istio-discovery argonaut-charts 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
istio/pilot:1.10.0294ca55bd1cc
stdlib@go1.16.4
1.25.9

Open the chart page →

77,972
istio-ingressargonaut-charts0.3.31 of 1See more

istio-ingress argonaut-charts 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
istio/proxyv2:1.10.088c6c693e67a
stdlib@go1.16.4
1.25.9

Open the chart page →

77,918
argonix-apiargonix0.4.22 of 4See more

argonix-api argonix 0.4.2

2 of the 4 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/argonix-io/argonix-api:1.0.0f64dfe735284
stdlib@go1.22.7
1.25.9
ghcr.io/argonix-io/argonix-api-frontend:1.0.0be5223552fb0
stdlib@go1.23.12
1.25.9

Open the chart page →

5,092

Container images carrying it

4,610 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
stdlib@go1.23.4
1.25.9
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.9.0f9d65db8bda2
stdlib@go1.25.5
1.25.9
1
registry.k8s.io/sig-storage/nfsplugin:v4.11.0ce5b5ccd5eb0
stdlib@go1.23.6
1.25.9
1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.03ce0fdba4d8e
stdlib@go1.15
1.25.9
1
registry.k8s.io/sig-storage/objectstorage-sidecar:v0.2.2c7166a73a303
stdlib@go1.24.11
1.25.9
1
registry.k8s.io/sig-storage/snapshot-controller:v8.2.1472fa35a89da
stdlib@go1.23.6
1.25.9
1
registry.k8s.io/sig-storage/snapshot-controller:v4.2.195587f8777d7
stdlib@go1.16.2
1.25.9
1
registry.k8s.io/sig-storage/snapshot-controller:v6.2.198bab4eaf23c
stdlib@go1.19
1.25.9
1
registry.k8s.io/sig-storage/snapshot-controller:v6.3.1ce6ca3c0e30b
stdlib@go1.20.5
1.25.9
1
registry.k8s.io/sig-storage/volume-data-source-validator:v1.0.0d35884236461
stdlib@go1.17.3
1.25.9
1

syft 1.42.1 · advisories as of 27 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.