CVE-2026-32289

Medium

Advisory

Published 7 Apr 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.1; base score, highest
EPSS: 0.003; 22nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 3,987; of 17,832 indexed, latest versions
Container images: 4,510; deployed by those charts
Fix available: 1 of 2; affected packages

JsBraceDepth Context Tracking Bugs (XSS) in html/template

Carried by container images the latest versions of 3,987 of 17,832 indexed charts deploy, on 4,510 images.

Affected package	Affected versions	Fixed in	Images
golang-1.19deb	1.19.8-2	no fix listed	1
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+180 more	1.25.9	4,510

OSV records: DEBIAN-CVE-2026-32289 GO-2026-4865
Also known as: BIT-golang-2026-32289

Charts affected

3,987 by stars

Chart

Latest

Affected images

Radar Score

linkerd-vizlinkerd2

30.12.11

1 of 5 See more

linkerd-viz linkerd2 30.12.11

1 of the 5 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
prom/prometheus :v2.48.0	b440bc0e8aa5	stdlib@go1.21.4	1.25.9

Open the chart page →

1,385

rocketchatrocketchat-server

7.0.2

5 of 12 See more

rocketchat rocketchat-server 7.0.2

5 of the 12 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
bitnamilegacy/mongodb :6.0.10-debian-11-r8	42319decb591	stdlib@go1.19.12	1.25.9
bitnamilegacy/mongodb-exporter :0.39.0-debian-11-r106	de7256c7adcd	stdlib@go1.20.7	1.25.9
natsio/nats-box :0.19.2	8031d190c7ee	stdlib@go1.25.2	1.25.9
natsio/nats-server-config-reloader :0.21.1	10ff229eaf52	stdlib@go1.25.5	1.25.9
natsio/prometheus-nats-exporter :0.18.0	02469dc907bc	stdlib@go1.24.6	1.25.9

Open the chart page →

12,306

zammadzammad

19.0.1

1 See more

—

solr-operatorapache-solr

0.9.1

2 of 3 See more

solr-operator apache-solr 0.9.1

2 of the 3 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
apache/solr-operator :v0.9.1	4db34508137f	stdlib@go1.22.12	1.25.9
pravega/zookeeper-operator :0.2.15	b2bc4042fdd8	stdlib@go1.19.7	1.25.9

Open the chart page →

2,945

influxdb2influxdata

2.1.2

1 of 1 See more

influxdb2 influxdata 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
library/influxdb :2.7.4-alpine	a10d46445d68	stdlib@go1.21.3	1.25.9

Open the chart page →

2,110

chaos-meshchaos-mesh

2.8.4

1 of 4 See more

chaos-mesh chaos-mesh 2.8.4

1 of the 4 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
ghcr.io/chaos-mesh/chaos-coredns :v0.2.8	38bfdf5e3774	stdlib@go1.25.5	1.25.9

Open the chart page →

6,667

rabbitmqcloudpirates-rabbitmq

0.21.28

1 of 2 See more

rabbitmq cloudpirates-rabbitmq 0.21.28

1 of the 2 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
library/rabbitmq :4.3.6-management	de62d9901fb7	stdlib@go1.22.2	1.25.9

Open the chart page →

848

vclusterloft

0.0.0-ci.3

1 of 2 See more

vcluster loft 0.0.0-ci.3

1 of the 2 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
rancher/k3s :v1.26.0-k3s1	9380f5dbae9a	stdlib@go1.19.4	1.25.9

Open the chart page →

2,470

milvusmilvus

4.0.31

3 of 5 See more

milvus milvus 4.0.31

3 of the 5 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
milvusdb/etcd :3.5.5-r2	102aac62827b	stdlib@go1.18.2	1.25.9
milvusdb/milvus :v2.2.13	a3a55e1c1497	stdlib@go1.18.3	1.25.9
milvusdb/milvus-config-tool :v0.1.1	2212dfb61401	stdlib@go1.16.15	1.25.9

Open the chart page →

167,022

cockroachdbcockroachdb

22.0.3

1 of 3 See more

cockroachdb cockroachdb 22.0.3

1 of the 3 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
cockroachdb/cockroach-self-signer-cert :1.10	07a49acec18d	stdlib@go1.23.12	1.25.9

Open the chart page →

770

grafana-agentgrafana

0.44.2

2 of 2 See more

grafana-agent grafana 0.44.2

2 of the 2 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
grafana/agent :v0.44.2	3364714a2f64	stdlib@go1.22.11	1.25.9
ghcr.io/jimmidyson/configmap-reload :v0.12.0	a7c754986900	stdlib@go1.21.1	1.25.9

Open the chart page →

3,585

semaphoresemaphoreui

16.2.2

1 of 1 See more

semaphore semaphoreui 16.2.2

1 of the 1 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
semaphoreui/semaphore :v2.18.3	e9260bfa8255	stdlib@go1.25.5	1.25.9

Open the chart page →

2,419

clearmlallegroai

7.15.0

1 of 4 See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
bitnamilegacy/mongodb :6.0.10-debian-11-r8	42319decb591	stdlib@go1.19.12	1.25.9

Open the chart page →

10,814

signozsignoz

0.142.1

5 of 5 See more

signoz signoz 0.142.1

5 of the 5 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.21.2	cd9252644ce0	stdlib@go1.19.10	1.25.9
altinity/metrics-exporter :0.21.2	df3d57215356	stdlib@go1.19.10	1.25.9
signoz/signoz :v0.142.1	49501b04d77a	stdlib@go1.25.7	1.25.9
signoz/signoz-otel-collector :v0.144.10	34ecb436b687	stdlib@go1.25.0	1.25.9
signoz/zookeeper :3.7.1	fcc4a3288154	stdlib@go1.21.2	1.25.9

Open the chart page →

7,632

weblateweblate

0.5.38

1 of 3 See more

weblate weblate 0.5.38

1 of the 3 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
bitnamilegacy/redis :latest	5927ff3702df	stdlib@go1.24.5	1.25.9

Open the chart page →

6,707

postgresgroundhog2k

1.6.8

1 of 1 See more

postgres groundhog2k 1.6.8

1 of the 1 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
library/postgres :18.6	86c951e05bf5	stdlib@go1.24.6	1.25.9

Open the chart page →

1,268

community-operatormongodb-helm-charts

0.13.0

1 of 1 See more

community-operator mongodb-helm-charts 0.13.0

1 of the 1 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
quay.io/mongodb/mongodb-kubernetes-operator :0.13.0	2dcc6393e6f7	stdlib@go1.24.2	1.25.9

Open the chart page →

1,127

prometheus-kafka-exporterprometheus-community

4.0.0

1 of 1 See more

prometheus-kafka-exporter prometheus-community 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
danielqsj/kafka-exporter :v1.9.0	4150e46b2e96	stdlib@go1.24.0	1.25.9

Open the chart page →

717

node-local-dnsdeliveryhero

2.9.2

1 of 1 See more

node-local-dns deliveryhero 2.9.2

1 of the 1 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
registry.k8s.io/dns/k8s-dns-node-cache :1.26.7	8b9a78d101a1	stdlib@go1.24.8	1.25.9

Open the chart page →

1,763

bitcoin-corehirosystems

2.1.7

1 of 1 See more

bitcoin-core hirosystems 2.1.7

1 of the 1 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
dobtc/bitcoin :25.1	a870f7cb1105	stdlib@go1.19.8	1.25.9

Open the chart page →

4,840

rancherrancher-latest

2.15.1

1 of 2 See more

rancher rancher-latest 2.15.1

1 of the 2 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
rancher/rancher :v2.15.1	5f6c4dc52a05	stdlib@go1.26.1	1.25.9

Open the chart page →

1,535

nacosygqygq2

2.1.10

2 of 4 See more

nacos ygqygq2 2.1.10

2 of the 4 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
nacos/nacos-peer-finder-plugin :latest	a9c769301fa6	stdlib@go1.13.5	1.25.9
ygqygq2/mysql-exec-sql :latest	54f30def1558	stdlib@go1.18.2	1.25.9

Open the chart page →

5,005

sealed-secretsbitnami

2.5.19

1 of 1 See more

sealed-secrets bitnami 2.5.19

1 of the 1 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
bitnami/sealed-secrets-controller :0.31.0-debian-12-r0	74eaff41382b	stdlib@go1.24.6	1.25.9

Open the chart page →

643

mariadbcloudpirates-mariadb

0.16.15

1 of 1 See more

mariadb cloudpirates-mariadb 0.16.15

1 of the 1 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
library/mariadb :13.0.2	d4fdec0510ad	stdlib@go1.24.6	1.25.9

Open the chart page →

1,435

difydouban

0.10.0

4 of 6 See more

dify douban 0.10.0

4 of the 6 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
bitnamilegacy/redis :7.2.4-debian-12-r13	9c6fecd24bf3	stdlib@go1.21.9	1.25.9
langgenius/dify-plugin-daemon :0.5.1-local	8269050f192e	stdlib@go1.25.5	1.25.9
langgenius/dify-sandbox :0.2.12	4e65e8a351a2	stdlib@go1.23.3	1.25.9
langgenius/dify-web :1.10.1-fix.1	c306ac577912	stdlib@go1.23.5	1.25.9

Open the chart page →

74,142

dragonflydragonfly

1.8.5

1 of 3 See more

dragonfly dragonfly 1.8.5

1 of the 3 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
dragonflyoss/scheduler :v2.5.2	d5dea9e662cd	stdlib@go1.25.5	1.25.9

Open the chart page →

4,187

secrets-store-csi-driversecret-store-csi-driver

1.6.1

2 of 4 See more

secrets-store-csi-driver secret-store-csi-driver 1.6.1

2 of the 4 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.16.0	ab482308a492	stdlib@go1.25.7	1.25.9
registry.k8s.io/sig-storage/livenessprobe :v2.18.0	c4cc074199c0	stdlib@go1.25.7	1.25.9

Open the chart page →

1,821

stackgres-operatorstackgres-charts

1.19.1

1 of 2 See more

stackgres-operator stackgres-charts 1.19.1

1 of the 2 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
quay.io/ongres/kubectl :v1.25.16-build-6.53	04dada9e4503	stdlib@go1.20.10	1.25.9

Open the chart page →

2,156

mongodbcloudpirates-mongodb

0.18.15

1 of 1 See more

mongodb cloudpirates-mongodb 0.18.15

1 of the 1 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
library/mongo :8.3.11	5d7043a4ffe0	stdlib@go1.24.6	1.25.9

Open the chart page →

958

code-servernicholaswilde

1.1.1

1 of 1 See more

code-server nicholaswilde 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
ghcr.io/linuxserver/code-server :version-v3.11.1	a385ba5cb161	stdlib@go1.16.4	1.25.9

Open the chart page →

16,393

pulsarapache

4.7.0

6 of 10 See more

pulsar apache 4.7.0

6 of the 10 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
alpine/k8s :1.32.12	048f8d9c8cc7	stdlib@go1.25.7	1.25.9
grafana/grafana :12.4.1	e932bd6ed0e0	stdlib@go1.25.8	1.25.9
rancher/kubectl :v1.25.0	85a0d1148784	stdlib@go1.19	1.25.9
victoriametrics/operator :v0.68.3	f52e1bd679cb	stdlib@go1.25.8	1.25.9
quay.io/prometheus/node-exporter :v1.10.2	337ff1d356b6	stdlib@go1.25.3	1.25.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	stdlib@go1.25.5	1.25.9

Open the chart page →

9,951

miniocloudpirates-minio

0.13.4

1 of 1 See more

minio cloudpirates-minio 0.13.4

1 of the 1 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
cloudpirates/image-minio :RELEASE.2025-10-15T17-29-55Z-hardened	8dc02a7e5093	stdlib@go1.25.7	1.25.9

Open the chart page →

1,230

vertical-pod-autoscalercowboysysop

11.1.1

4 of 4 See more

vertical-pod-autoscaler cowboysysop 11.1.1

4 of the 4 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
bitnamilegacy/kubectl :1.29.3	f5fc0d561d9e	stdlib@go1.21.8	1.25.9
registry.k8s.io/autoscaling/vpa-admission-controller :1.5.1	9928d59477fb	stdlib@go1.24.6	1.25.9
registry.k8s.io/autoscaling/vpa-recommender :1.5.1	e629c61b75eb	stdlib@go1.24.6	1.25.9
registry.k8s.io/autoscaling/vpa-updater :1.5.1	cba2aa4b3239	stdlib@go1.24.6	1.25.9

Open the chart page →

7,014

difydify-helm

0.38.0

2 of 11 See more

dify dify-helm 0.38.0

2 of the 11 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
bitnamilegacy/redis :7.0.11-debian-11-r12	1161dcd293a0	stdlib@go1.19.9	1.25.9
langgenius/dify-sandbox :0.2.15	750e1111426e	stdlib@go1.24.13	1.25.9

Open the chart page →

63,436

pyroscopegrafana

2.3.1

2 of 3 See more

pyroscope grafana 2.3.1

2 of the 3 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
grafana/alloy :v1.12.2	f94b1c82957a	stdlib@go1.25.5	1.25.9
quay.io/prometheus-operator/prometheus-config-reloader :v0.81.0	959d47672fbf	stdlib@go1.23.7	1.25.9

Open the chart page →

3,298

botkubeinfracloudio

1.14.0

1 of 1 See more

botkube infracloudio 1.14.0

1 of the 1 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
ghcr.io/kubeshop/botkube :v1.14.0	c6fe64c7bfcd	stdlib@go1.21.13	1.25.9

Open the chart page →

1,104

operatorminio-operator

7.1.1

1 of 1 See more

operator minio-operator 7.1.1

1 of the 1 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
quay.io/minio/operator :v7.1.1	cd587f60c43d	stdlib@go1.24.2	1.25.9

Open the chart page →

874

unleashunleash

5.6.8

1 of 2 See more

unleash unleash 5.6.8

1 of the 2 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
library/postgres :18-alpine	6c538e7206ea	stdlib@go1.24.6	1.25.9

Open the chart page →

1,752

ambassadordatawire

6.9.5

1 of 2 See more

ambassador datawire 6.9.5

1 of the 2 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
datawire/aes :1.14.4	8588eafe6862	stdlib@go1.15	1.25.9

Open the chart page →

4,121

rabbitmqgroundhog2k

2.3.9

1 of 2 See more

rabbitmq groundhog2k 2.3.9

1 of the 2 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
library/rabbitmq :4.3.6	67bad329974a	stdlib@go1.22.2	1.25.9

Open the chart page →

848

vela-corekubevela

1.11.0

3 of 3 See more

vela-core kubevela 1.11.0

3 of the 3 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
oamdev/cluster-gateway :v1.9.0-alpha.2	5591e29d66a2	stdlib@go1.19.8	1.25.9
oamdev/kube-webhook-certgen :v2.4.1	231c423c2b17	stdlib@go1.17.11	1.25.9
oamdev/vela-core :v1.11.0	95fa412c934e	stdlib@go1.23.8	1.25.9

Open the chart page →

4,605

oktetookteto

0.0.0-2026-08-24

2 of 10 See more

okteto okteto 0.0.0-2026-08-24

2 of the 10 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
ghcr.io/okteto/buildkit :0.0.0-2026-08-24	14527ca5d2a9	stdlib@go1.25.7	1.25.9
ghcr.io/okteto/okteto :3.22.0	4585017f52f6	stdlib@go1.24.0	1.25.9

Open the chart page →

5,587

hydraory

0.64.0

1 of 2 See more

1,318

prometheus-msteamsprometheus-msteams

1.3.6

1 of 1 See more

prometheus-msteams prometheus-msteams 1.3.6

1 of the 1 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
quay.io/prometheusmsteams/prometheus-msteams :v1.5.3	a9f4d31ab811	stdlib@go1.24.9	1.25.9

Open the chart page →

942

concourseconcourse

20.3.0

1 of 2 See more

concourse concourse 20.3.0

1 of the 2 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
library/postgres :17	f4c66b820c6f	stdlib@go1.24.6	1.25.9

Open the chart page →

1,670

san-iscsi-csienix

4.0.2

1 of 7 See more

san-iscsi-csi enix 4.0.2

1 of the 7 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
enix/san-iscsi-csi :v4.0.2	f963da81ecf7	stdlib@go1.16.8	1.25.9

Open the chart page →

4,212

headscalegabe565

0.16.0

1 of 2 See more

headscale gabe565 0.16.0

1 of the 2 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
ghcr.io/juanfont/headscale :v0.25.0	97febecbe6cb	stdlib@go1.23.4	1.25.9

Open the chart page →

1,868

oncallgrafana

1.16.5

7 of 12 See more

oncall grafana 1.16.5

7 of the 12 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
grafana/grafana :11.1.4	886b56d5534e	stdlib@go1.22.4	1.25.9
quay.io/jetstack/cert-manager-cainjector :v1.8.0	e7b6203ccb37	stdlib@go1.17.8	1.25.9
quay.io/jetstack/cert-manager-controller :v1.8.0	e1642bf8e933	stdlib@go1.17.8	1.25.9
quay.io/jetstack/cert-manager-ctl :v1.8.0	595c548dee6f	stdlib@go1.17.8	1.25.9
quay.io/jetstack/cert-manager-webhook :v1.8.0	fd798a5a773e	stdlib@go1.17.8	1.25.9
registry.k8s.io/ingress-nginx/controller :v1.2.1	5516d103a9c2	stdlib@go1.18.2	1.25.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.1.1	64d8c73dca98	stdlib@go1.16.9	1.25.9

Open the chart page →

16,475

k8sgpt-operatork8sgpt

0.2.29

1 of 2 See more

k8sgpt-operator k8sgpt 0.2.29

1 of the 2 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
quay.io/brancz/kube-rbac-proxy :v0.19.1	9f21034731c7	stdlib@go1.24.2	1.25.9

Open the chart page →

988

openbaoopenbao

0.29.5

1 of 2 See more

openbao openbao 0.29.5

1 of the 2 container images this version deploys carry CVE-2026-32289.

Container image	Digest	Package	Fixed in
hashicorp/vault-k8s :1.7.2	ae3d307658b7	stdlib@go1.25.5	1.25.9

Open the chart page →

1,521

Container images carrying it

4,510 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
registry.k8s.io/sig-storage/local-volume-provisioner :v2.8.0	3e2bf2eaef9f	stdlib@go1.23.4	1.25.9	1
registry.k8s.io/sig-storage/local-volume-provisioner :v2.9.0	f9d65db8bda2	stdlib@go1.25.5	1.25.9	1
registry.k8s.io/sig-storage/nfsplugin :v4.11.0	ce5b5ccd5eb0	stdlib@go1.23.6	1.25.9	1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner :v4.0.0	3ce0fdba4d8e	stdlib@go1.15	1.25.9	1
registry.k8s.io/sig-storage/objectstorage-sidecar :v0.2.2	c7166a73a303	stdlib@go1.24.11	1.25.9	1
registry.k8s.io/sig-storage/snapshot-controller :v8.2.1	472fa35a89da	stdlib@go1.23.6	1.25.9	1
registry.k8s.io/sig-storage/snapshot-controller :v4.2.1	95587f8777d7	stdlib@go1.16.2	1.25.9	1
registry.k8s.io/sig-storage/snapshot-controller :v6.2.1	98bab4eaf23c	stdlib@go1.19	1.25.9	1
registry.k8s.io/sig-storage/snapshot-controller :v6.3.1	ce6ca3c0e30b	stdlib@go1.20.5	1.25.9	1
registry.k8s.io/sig-storage/volume-data-source-validator :v1.0.0	d35884236461	stdlib@go1.17.3	1.25.9	1