StackRadar

CVE-2026-32282

Medium

Advisory

Published 7 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.4
base score, highest
EPSS
0.002
6th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,119
of 17,926 indexed, latest versions
Container images
4,603
deployed by those charts
Fix available
1 of 2
affected packages

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

Carried by container images the latest versions of 4,119 of 17,926 indexed charts deploy, on 4,603 images.

Affected packageAffected versionsFixed inImages
golang-1.19deb1.19.8-2no fix listed1
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+180 more1.25.94,603
OSV records
DEBIAN-CVE-2026-32282GO-2026-4864
Also known as
BIT-golang-2026-32282

Charts affected

4,119 by stars
ChartLatestAffected imagesRadar Score
prometheusgrafana-uxadax26.0.16 of 6See more

prometheus grafana-uxadax 26.0.1

6 of the 6 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
prom/prometheus:v3.0.1565ee8650122
stdlib@go1.23.3
1.25.9
quay.io/prometheus-operator/prometheus-config-reloader:v0.78.2944b2c67345c
stdlib@go1.23.3
1.25.9
quay.io/prometheus/alertmanager:v0.27.0e13b6ed5cb92
stdlib@go1.21.7
1.25.9
quay.io/prometheus/node-exporter:v1.8.24032c6d5bfd7
stdlib@go1.22.5
1.25.9
quay.io/prometheus/pushgateway:v1.10.07a4d0696a24e
stdlib@go1.23.1
1.25.9
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.14.037d841299325
stdlib@go1.23.3
1.25.9

Open the chart page →

5,289
grafregistratiecomponentgrafregistratiecomponent1.0.01 of 3See more

grafregistratiecomponent grafregistratiecomponent 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/grafregistratiecomponent-php:latest35225eaa87ab
stdlib@go1.13.10
1.25.9

Open the chart page →

7,565
grapple-installergrapple-installer0.3.221 of 1See more

grapple-installer grapple-installer 0.3.22

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
grpl/grapple-cli:0.2.127c00aafee6629
stdlib@go1.18.10
1.25.9

Open the chart page →

89,461
grayloggraylogVerified publisher1.0.21 of 4See more

graylog graylog 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
library/mongo:85d7043a4ffe0
stdlib@go1.24.6
1.25.9

Open the chart page →

5,287
fasttrackmlgresearch0.1.01 of 1See more

fasttrackml gresearch 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
gresearch/fasttrackml:latest16d1228220fc
stdlib@go1.21.10
1.25.9

Open the chart page →

1,405
siembolgresearch0.1.61 of 4See more

siembol gresearch 0.1.6

1 of the 4 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
alpine/k8s:1.18.16a41efe02a041
stdlib@go1.15.2
1.25.9

Open the chart page →

14,390
act-runnergringolitoVerified publisher0.2.01 of 1See more

act-runner gringolito 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
gitea/act_runner:0.2.11-dind-rootless6120b1165f3a
stdlib@go1.22.7
1.25.9

Open the chart page →

2,634
loki-proxygroundcover0.1.11 of 1See more

loki-proxy groundcover 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
public.ecr.aws/groundcovercom/loki-proxy:0.1.1783d550ad813
stdlib@go1.17.13
1.25.9

Open the chart page →

2,185
routergroundcover1.12.3972See more

router groundcover 1.12.397

2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
public.ecr.aws/groundcovercom/postgres:18.1-20260208b7d7910c0bb0
stdlib@go1.25.7
1.25.9
quay.io/groundcover/tools:20260719b705e0cbe171
stdlib@go1.24.4
1.25.9

Open the chart page →

—
mysqlgroundhog2k3.1.41 of 1See more

mysql groundhog2k 3.1.4

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
library/mysql:9.7.230a0abfa7b50
stdlib@go1.24.6
1.25.9

Open the chart page →

477
tailscale-subnet-routergtaylor1.2.11 of 1See more

tailscale-subnet-router gtaylor 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/tailscale/tailscale:v1.34.1ce1862e6b3a5
stdlib@go1.19.2-ts3fd24dee31
1.25.9

Open the chart page →

1,831
minifluxhajowielandVerified publisher1.0.01 of 1See more

miniflux hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/miniflux/miniflux:2.2.83a11ac10969e
stdlib@go1.24.2
1.25.9

Open the chart page →

1,290
hakoniwahakoniwa0.1.01 of 1See more

hakoniwa hakoniwa 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/aplulu/hakoniwa:0.1.0accf0b921388
stdlib@go1.25.5
1.25.9

Open the chart page →

343
docker-authhalkeye0.1.11 of 1See more

docker-auth halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
cesanta/docker_auth:1.6.04d16885f3d4c
stdlib@go1.13.7
1.25.9

Open the chart page →

2,380
matrix-media-repohalkeye1.0.51 of 1See more

matrix-media-repo halkeye 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
turt2live/matrix-media-repo:v1.2.8bfbd459f89a5
stdlib@go1.16.3
1.25.9

Open the chart page →

4,511
mautrix-signalhalkeye0.3.01 of 2See more

mautrix-signal halkeye 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
signald/signald:0.23.2edbff058278c
stdlib@go1.18.10
1.25.9

Open the chart page →

1,509
whoamihalkeye1.0.11 of 1See more

whoami halkeye 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
containous/whoami:v1.5.07d6a3c8f9147
stdlib@go1.14
1.25.9

Open the chart page →

1,281
hcp-terraform-operatorhashicorpVerified publisher2.12.11 of 2See more

hcp-terraform-operator hashicorp 2.12.1

1 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
quay.io/brancz/kube-rbac-proxy:v0.20.1f5fbfec6a2b2
stdlib@go1.25.4
1.25.9

Open the chart page →

691
hatchet-apihatchetOfficialVerified publisher0.19.01 of 4See more

hatchet-api hatchet 0.19.0

1 of the 4 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
library/postgres:latest4ef4dbc939d6
stdlib@go1.24.6
1.25.9

Open the chart page →

1,822
hatchet-hahatchetOfficialVerified publisher0.19.01 of 8See more

hatchet-ha hatchet 0.19.0

1 of the 8 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
library/postgres:latest4ef4dbc939d6
stdlib@go1.24.6
1.25.9

Open the chart page →

8,028
hatchet-stackhatchetOfficialVerified publisher0.19.01 of 8See more

hatchet-stack hatchet 0.19.0

1 of the 8 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
library/postgres:latest4ef4dbc939d6
stdlib@go1.24.6
1.25.9

Open the chart page →

8,028
hawk-envoy-pluginhawk0.1.02 of 4See more

hawk-envoy-plugin hawk 0.1.0

2 of the 4 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/privacyengineering/collector-go:main7217f1a4fa28
stdlib@go1.17.13
1.25.9
ghcr.io/privacyengineering/consumer:main73f59c032812
stdlib@go1.17.13
1.25.9

Open the chart page →

70,828
cert-manager-webhook-arvanhbahadorzadeh0.1.11 of 1See more

cert-manager-webhook-arvan hbahadorzadeh 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
hbahadorzadeh/cert-manager-webhook-arvan:latestbf9756b3bc47
stdlib@go1.15.6
1.25.9

Open the chart page →

3,030
kubernetes-event-exporterhbahadorzadeh0.1.01 of 1See more

kubernetes-event-exporter hbahadorzadeh 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
opsgenie/kubernetes-event-exporter:0.9ecb246e4d260
stdlib@go1.14.7
1.25.9

Open the chart page →

2,636
hdx-oss-v2hdx-oss-v20.8.41 of 5See more

hdx-oss-v2 hdx-oss-v2 0.8.4

1 of the 5 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
library/mongo:5.0.14-focal50cae5081ab4
stdlib@go1.17.10
1.25.9

Open the chart page →

6,914
headcniheadcni1.0.101 of 1See more

headcni headcni 1.0.10

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
binrc/headcni:1.0.10e199c334b957
stdlib@go1.22.10
1.25.9

Open the chart page →

727
heliconehelicone0.1.422 of 14See more

helicone helicone 0.1.42

2 of the 14 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:23.4.2.11dc5658853ce1
stdlib@go1.19.5
1.25.9
supabase/gotrue:v2.91.07174d551d720
stdlib@go1.20.7
1.25.9

Open the chart page →

80,878
hello-gohello-goVerified publisher0.2.21 of 1See more

hello-go hello-go 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
anujarosha/hello-go:v1.0.1ed60e46870b6
stdlib@go1.18.3
1.25.9

Open the chart page →

1,316
hello_worldcharthellohelm0.1.01 of 1See more

hello_worldchart hellohelm 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
dockerdaemon0901/rolldice:v14e5bfe179c7e
stdlib@go1.21.0
1.25.9

Open the chart page →

870
helm-airportshelm-airports0.1.02 of 7See more

helm-airports helm-airports 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
postgis/postgis:latest01a6a70e41e6
stdlib@go1.18.2
1.25.9
wurstmeister/kafka:latest2d4bbf9cc83d
stdlib@go1.17.10
1.25.9

Open the chart page →

12,785
airports-kafkahelm-airports-dan0.1.01 of 2See more

airports-kafka helm-airports-dan 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
stdlib@go1.17.10
1.25.9

Open the chart page →

4,620
airports-postgreshelm-airports-dan0.1.01 of 1See more

airports-postgres helm-airports-dan 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
postgis/postgis:latest01a6a70e41e6
stdlib@go1.18.2
1.25.9

Open the chart page →

1,029
helm-airportshelm-airports-dan0.1.02 of 7See more

helm-airports helm-airports-dan 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
postgis/postgis:latest01a6a70e41e6
stdlib@go1.18.2
1.25.9
wurstmeister/kafka:latest2d4bbf9cc83d
stdlib@go1.17.10
1.25.9

Open the chart page →

5,649
airports-kafkahelm-airports-kafka0.1.01 of 2See more

airports-kafka helm-airports-kafka 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
stdlib@go1.17.10
1.25.9

Open the chart page →

4,620
airports-postgreshelm-airports-postgres0.1.01 of 1See more

airports-postgres helm-airports-postgres 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
postgis/postgis:latest01a6a70e41e6
stdlib@go1.18.2
1.25.9

Open the chart page →

1,029
jenkinshelm-chart-for-jenkinsVerified publisher1.0.01 of 1See more

jenkins helm-chart-for-jenkins 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
stdlib@go1.25.3
1.25.9

Open the chart page →

2,646
pageshelm-chart-repos-camden1.0.01 of 3See more

pages helm-chart-repos-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.25.9

Open the chart page →

20,575
adguard-homehelm-chart-roeiVerified publisher0.107.591 of 2See more

adguard-home helm-chart-roei 0.107.59

1 of the 2 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
adguard/adguardhome:v0.107.595d5e3aef39a8
stdlib@go1.24.1
1.25.9

Open the chart page →

758
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
stdlib@go1.23.3
1.25.9

Open the chart page →

5,045
iofoghelm-chartsVerified publisher0.1.11 of 3See more

iofog helm-charts 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
iofog/router:2.0.17260cf861479
stdlib@go1.15
1.25.9

Open the chart page →

24,542
logging-stackhelm-charts-alexis-carbillet0.1.05 of 9See more

logging-stack helm-charts-alexis-carbillet 0.1.0

5 of the 9 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
grafana/agent-operator:v0.25.1a136c6208aa3
stdlib@go1.18
1.25.9
grafana/grafana:11.1.0079600c9517b
stdlib@go1.22.4
1.25.9
grafana/loki:2.6.11ee60f980950
stdlib@go1.17.9
1.25.9
grafana/loki:2.8.2b1da1d23037e
stdlib@go1.20.4
1.25.9
grafana/loki-canary:2.6.1ab2a2569307b
stdlib@go1.17.9
1.25.9

Open the chart page →

12,760
monitoring-stackhelm-charts-alexis-carbillet0.1.09 of 11See more

monitoring-stack helm-charts-alexis-carbillet 0.1.0

9 of the 11 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
grafana/grafana:11.3.0a0f881232a6f
stdlib@go1.23.1
1.25.9
grafana/grafana:latestac461fb352ab
stdlib@go1.25.7
1.25.9
prom/prometheus:v2.48.1a67e5e402ff5
stdlib@go1.21.5
1.25.9
quay.io/prometheus-operator/prometheus-config-reloader:v0.70.0e20576b76ffd
stdlib@go1.21.4
1.25.9
quay.io/prometheus/alertmanager:v0.26.0361db356b330
stdlib@go1.20.7
1.25.9
quay.io/prometheus/node-exporter:v1.7.04cb2b9019f17
stdlib@go1.21.4
1.25.9
quay.io/prometheus/node-exporter:v1.8.1fa7fa12a57ef
stdlib@go1.22.3
1.25.9
quay.io/prometheus/pushgateway:v1.6.2979a69ab4a40
stdlib@go1.21.1
1.25.9
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.1af8220f53493
stdlib@go1.20.10
1.25.9

Open the chart page →

10,587
teslamate-apihelm-charts-darox1.0.11 of 1See more

teslamate-api helm-charts-darox 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
tobiasehlert/teslamateapi:1.20.2cf09259ad0ea
stdlib@go1.24.0
1.25.9

Open the chart page →

1,211
aws-ebs-csi-driverhelm-charts-nr2.17.46 of 6See more

aws-ebs-csi-driver helm-charts-nr 2.17.4

6 of the 6 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.16.11564359e1e0e
stdlib@go1.19.6
1.25.9
public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.1.0-eks-1-25-latest701eea03388c
stdlib@go1.19.5
1.25.9
public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v3.4.0-eks-1-25-latest460ee1a59fea
stdlib@go1.19.7
1.25.9
public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.7.0-eks-1-25-lateste711da25e7a0
stdlib@go1.19.8
1.25.9
public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.9.0-eks-1-25-latest8a305e162caa
stdlib@go1.19.8
1.25.9
public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.7.0-eks-1-25-latestf4345e67df8f
stdlib@go1.19.8
1.25.9

Open the chart page →

6,573
aws-s3-proxyhelm-charts-nr0.1.71 of 1See more

aws-s3-proxy helm-charts-nr 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
pottava/s3-proxy:2.020a0bcb15f76
stdlib@go1.13.7
1.25.9

Open the chart page →

1,324
aws-service-events-exporterhelm-charts-nr1.0.71 of 1See more

aws-service-events-exporter helm-charts-nr 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
thomasnyambati/aws-service-events-exporter:1.0.01e18a0944ceb
stdlib@go1.15.6
1.25.9

Open the chart page →

1,301
aws-service-quotas-exporterhelm-charts-nr0.1.41 of 1See more

aws-service-quotas-exporter helm-charts-nr 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
thoughtmachine/aws-service-quotas-exporter:v1.3.2c6065ba55c72
stdlib@go1.19.4
1.25.9

Open the chart page →

773
cortex-gatewayhelm-charts-nr0.1.91 of 1See more

cortex-gateway helm-charts-nr 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
goelankit/cortex-gateway:v1.1.00d9a82dcf026
stdlib@go1.18
1.25.9

Open the chart page →

2,240
datadog-controllerhelm-charts-nr1.2.01 of 1See more

datadog-controller helm-charts-nr 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
maxrocketinternet/datadog-controller:0.1a867315facf8
stdlib@go1.13.15
1.25.9

Open the chart page →

2,289
dregsyhelm-charts-nr0.1.51 of 1See more

dregsy helm-charts-nr 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-32282.

Container imageDigestPackageFixed in
xelalex/dregsy:0.4.3574054e1c417
stdlib@go1.18.3
1.25.9

Open the chart page →

2,975

Container images carrying it

4,603 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/snapshot-controller:v6.2.198bab4eaf23c
stdlib@go1.19
1.25.9
1
registry.k8s.io/sig-storage/snapshot-controller:v6.3.1ce6ca3c0e30b
stdlib@go1.20.5
1.25.9
1
registry.k8s.io/sig-storage/volume-data-source-validator:v1.0.0d35884236461
stdlib@go1.17.3
1.25.9
1

syft 1.42.1 · advisories as of 27 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.