CVE-2026-33487
HighAdvisory
Published 18 Mar 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.003
- 22nd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 127
- of 17,781 indexed, latest versions
- Container images
- 97
- deployed by those charts
- Fix available
- 1 of 1
- affected package
validateSignature Loop Variable Capture Signature Bypass in goxmldsig
Carried by container images the latest versions of 127 of 17,781 indexed charts deploy, on 97 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v0.0.0-20180430223755-7acd5e4a6ef7, v0.0.0-20200902171629-2e1fbc2c5593, v1.1.0, v1.1.1+4 more | 1.6.0 | 97 |
- OSV records
- GHSA-479m-364c-43vc
- Also known as
- GO-2026-4753
Charts affected
127 by stars
Container images carrying it
97 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| grafana/ | d72946c8e5d5 | github.com/ | 1.6.0 | 6 |
| quay.io/ | 2e4c14d1b444 | github.com/ | 1.6.0 | 6 |
| grafana/ | 1ff3999e0fc0 | github.com/ | 1.6.0 | 4 |
| grafana/ | 00568d89c4f8 | github.com/ | 1.6.0 | 3 |
| grafana/ | 0dc5a246ab16 | github.com/ | 1.6.0 | 3 |
| grafana/ | a0f881232a6f | github.com/ | 1.6.0 | 3 |
| ghcr.io/ | 8499afd690c4 | github.com/ | 1.6.0 | 3 |
| quay.io/ | 7bcf286807b8 | github.com/ | 1.6.0 | 3 |
| governify/ | e83a17ba5038 | github.com/ | 1.6.0 | 2 |
| grafana/ | 057896e23443 | github.com/ | 1.6.0 | 2 |
| grafana/ | 079600c9517b | github.com/ | 1.6.0 | 2 |
| grafana/ | 42d3e6bc1865 | github.com/ | 1.6.0 | 2 |
| grafana/ | 511bc20bfcd1 | github.com/ | 1.6.0 | 2 |
| grafana/ | 886b56d5534e | github.com/ | 1.6.0 | 2 |
| grafana/ | d8ea37798ccc | github.com/ | 1.6.0 | 2 |
| mattermost/ | b8bd1246cb3a | github.com/ | 1.6.0 | 2 |
| opencloudeu/ | f9634bb04905 | github.com/ | 1.6.0 | 2 |
| streamnative/ | 0e6d7aa3ef32 | github.com/ | 1.6.0 | 2 |
| ghcr.io/ | 5e88f2205de1 | github.com/ | 1.6.0 | 2 |
| quay.io/ | c9b7f6d0d953 | github.com/ | 1.6.0 | 2 |
| quay.io/ | 8c65b333a3d3 | github.com/ | 1.6.0 | 2 |
| bitnamilegacy/ | cb8ab5515676 | github.com/ | 1.6.0 | 1 |
| bytesafe/ | ee287384c005 | github.com/ | 1.6.0 | 1 |
| casbin/ | 66f836ef778b | github.com/ | 1.6.0 | 1 |
| casbin/ | 770ad9ec3190 | github.com/ | 1.6.0 | 1 |
| casbin/ | 7729da148c61 | github.com/ | 1.6.0 | 1 |
| casbin/ | e08231f16c00 | github.com/ | 1.6.0 | 1 |
| cortezaproject/ | 0bcdcbcd3c63 | github.com/ | 1.6.0 | 1 |
| cortezaproject/ | 8eb7a26605c9 | github.com/ | 1.6.0 | 1 |
| cortezaproject/ | cb9f200de5d2 | github.com/ | 1.6.0 | 1 |
| defactops/ | 825cdf9ba706 | github.com/ | 1.6.0 | 1 |
| dexidp/ | 43655afd1a8f | github.com/ | 1.6.0 | 1 |
| emqx/ | fa876f71e5d6 | github.com/ | 1.6.0 | 1 |
| fleetdm/ | 12e644b7f40e | github.com/ | 1.6.0 | 1 |
| grafana/ | 052147d7e0ec | github.com/ | 1.6.0 | 1 |
| grafana/ | 0679e877ba20 | github.com/ | 1.6.0 | 1 |
| grafana/ | 09bb407e26ab | github.com/ | 1.6.0 | 1 |
| grafana/ | 15b977f5207d | github.com/ | 1.6.0 | 1 |
| grafana/ | 1a359d92f40e | github.com/ | 1.6.0 | 1 |
| grafana/ | 1b9ca4bbc4a2 | github.com/ | 1.6.0 | 1 |
| grafana/ | 39c849cebccc | github.com/ | 1.6.0 | 1 |
| grafana/ | 464eac539793 | github.com/ | 1.6.0 | 1 |
| grafana/ | 5781759b3d27 | github.com/ | 1.6.0 | 1 |
| grafana/ | 696823fbc561 | github.com/ | 1.6.0 | 1 |
| grafana/ | 6b5b37eb35bb | github.com/ | 1.6.0 | 1 |
| grafana/ | 6d42886b3ebe | github.com/ | 1.6.0 | 1 |
| grafana/ | 733842cca5bd | github.com/ | 1.6.0 | 1 |
| grafana/ | 76dcf36e7d2a | github.com/ | 1.6.0 | 1 |
| grafana/ | 8640e5038e83 | github.com/ | 1.6.0 | 1 |
| grafana/ | 8b37a2f028f1 | github.com/ | 1.6.0 | 1 |