StackRadar

CVE-2026-39821

High

Advisory

Published 22 May 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
0.007
51st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,616
of 17,805 indexed, latest versions
Container images
5,324
deployed by those charts
Fix available
3 of 3
affected packages

Red Hat Security Advisory: git-lfs security update

Carried by container images the latest versions of 4,616 of 17,805 indexed charts deploy, on 5,324 images.

Affected packageAffected versionsFixed inImages
git-lfsrpm2.13.3-3.el8_60:3.4.1-11.el8_101
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+190 more1.25.135,284
golang.org/x/netgolangv0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+220 more0.55.03,716
OSV records
RHSA-2026:30853GO-2026-5026

Charts affected

4,616 by stars
ChartLatestAffected imagesRadar Score
prometheusalertygqygq2Verified publisher1.0.01 of 1See more

prometheusalert ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
feiyu563/prometheus-alert:v4.9.1224cfa68cbd9
golang.org/x/net@v0.24.0
stdlib@go1.20.6
0.55.0
1.25.13

Open the chart page →

1,610
matrixdb-operatorymatrixOfficialVerified publisher0.13.01 of 2See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
matrixdb/kubebuilder_kube-rbac-proxy:v0.12.0ed3c7e6291e8
golang.org/x/net@v0.0.0-20220325170049-de3da57026de
stdlib@go1.18.1
0.55.0
1.25.13

Open the chart page →

1,966
rawfile-csiymatrixVerified publisher0.2.14 of 4See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
matrixdb/custom-external-provisioner:4622a07d7-202204247e9ffe249a51
golang.org/x/net@v0.0.0-20211209124913-491a49abca63
stdlib@go1.17.8
0.55.0
1.25.13
matrixdb/rawfile-csi:v0.2.195b2e38e913d
golang.org/x/net@v0.0.0-20220225172249-27dd8689420f
stdlib@go1.17.9
0.55.0
1.25.13
matrixdb/sig-storage_csi-node-driver-registrar:v2.2.0ba763bb01ddc
golang.org/x/net@v0.0.0-20210316092652-d523dce5a7f4
stdlib@go1.16
0.55.0
1.25.13
matrixdb/sig-storage_livenessprobe:v2.3.07ab06fe3d8a7
golang.org/x/net@v0.0.0-20210316092652-d523dce5a7f4
stdlib@go1.16
0.55.0
1.25.13

Open the chart page →

8,002
nginx-vts-exporterymrs0.1.21 of 1See more

nginx-vts-exporter ymrs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
sophos/nginx-vts-exporter:latestf1073556b29b
stdlib@go1.13.6
1.25.13

Open the chart page →

1,337
version-checkerymrs0.2.31 of 1See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
quay.io/jetstack/version-checker:v0.2.15f6f8ba0b671
golang.org/x/net@v0.0.0-20200707034311-ab3426394381
stdlib@go1.15.2
0.55.0
1.25.13

Open the chart page →

3,025
prometheus-monitoring-stackyotron-helm-charts1.2.01 of 3See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
golang.org/x/net@v0.51.0
stdlib@go1.26.5
0.55.0
1.25.13

Open the chart page →

936
ical-filter-proxyyungwoodVerified publisher0.3.11 of 1See more

ical-filter-proxy yungwood 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
yungwood/ical-filter-proxy:0.3.1ddc3f30ab05f
stdlib@go1.26.5
1.25.13

Open the chart page →

60
synergy-wholesale-exporteryungwoodVerified publisher0.1.11 of 1See more

synergy-wholesale-exporter yungwood 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
yungwood/synergy-wholesale-exporter:0.1.1054dce85989b
stdlib@go1.26.5
1.25.13

Open the chart page →

60
zahori-consulzahoriVerified publisher1.0.12 of 2See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
hashicorp/consul:1.15.3ddff34041c5c
golang.org/x/net@v0.8.0
stdlib@go1.20.4
0.55.0
1.25.13
hashicorp/consul-k8s-control-plane:1.1.262bed1bf8106
golang.org/x/net@v0.7.0
stdlib@go1.20.4
0.55.0
1.25.13

Open the chart page →

5,077
zahori-moonzahoriVerified publisher1.0.13 of 3See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
quay.io/aerokube/moon:2.5.1a8837b00ba1c
golang.org/x/net@v0.7.0
stdlib@go1.20.4
0.55.0
1.25.13
quay.io/aerokube/moon-conf:2.5.19ca307b30080
golang.org/x/net@v0.7.0
stdlib@go1.20.4
0.55.0
1.25.13
quay.io/aerokube/moon-ui:2.0.589990b146824
golang.org/x/net@v0.11.0
stdlib@go1.20.5
0.55.0
1.25.13

Open the chart page →

2,908
zahori-schedulerzahoriVerified publisher1.0.11 of 1See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
zahoriaut/zahori-scheduler:1.0.047d0979b1184
stdlib@go1.20.5
1.25.13

Open the chart page →

2,485
posthogzeet0.23.22 of 9See more

posthog zeet 0.23.2

2 of the 9 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.19.07a85f522c5bc
golang.org/x/net@v0.0.0-20210525063256-abc453219eb5
stdlib@go1.17.13
0.55.0
1.25.13
altinity/metrics-exporter:latest8940ecadae65
stdlib@go1.26.5
1.25.13

Open the chart page →

3,700
endlessh-gozekker6Verified publisher0.4.01 of 1See more

endlessh-go zekker6 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
ghcr.io/shizunge/endlessh-go:2026.0730.08826dad32623
stdlib@go1.26.5
1.25.13

Open the chart page →

493
karmazekker6Verified publisher0.21.01 of 1See more

karma zekker6 0.21.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
ghcr.io/prymitive/karma:v0.13298d9ed609118
stdlib@go1.26.5
1.25.13

Open the chart page →

56
zookeeper-exporterzookeeper-exporter0.1.01 of 1See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
dabealu/zookeeper-exporter:latest86106fec315f
stdlib@go1.14.15
1.25.13

Open the chart page →

1,248
zoo-project-druzoo-projectOfficialVerified publisher0.10.42 of 6See more

zoo-project-dru zoo-project 0.10.4

2 of the 6 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
library/postgres:18.4-alpine3.249a8afca54e78
stdlib@go1.24.6
1.25.13
zooproject/zoo-project:dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a9a507cb7e2dd
golang.org/x/net@v0.49.0
stdlib@go1.26.5
0.55.0
1.25.13

Open the chart page →

7,964

Container images carrying it

5,324 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
bitnamilegacy/etcd:latest99b408c15272
golang.org/x/net@v0.38.0
stdlib@go1.23.10
0.55.0
1.25.13
3
bitnamilegacy/kubectl:latestcd354d5b2556
golang.org/x/net@v0.41.0
stdlib@go1.24.5
0.55.0
1.25.13
3
bitnamilegacy/mongodb:6.0.4-debian-11-r10016dce036593
golang.org/x/net@v0.0.0-20220906165146-f3363e06e74c
stdlib@go1.17.10
0.55.0
1.25.13
3
bitnamilegacy/os-shell:12-debian-12-r5177e65e9d633e
golang.org/x/net@v0.42.0
stdlib@go1.25.0
0.55.0
1.25.13
3
bitnamilegacy/pgpool:4.6.3-debian-12-r0d3bf3910f148
stdlib@go1.25.0
1.25.13
3
bitnamilegacy/valkey-cluster:8.1.3-debian-12-r332869e769b7e
stdlib@go1.24.6
1.25.13
3
caddy/ingress:v0.2.118d1366fc0e9
golang.org/x/net@v0.17.0
stdlib@go1.21.4
0.55.0
1.25.13
3
ciscolabs/rtsp-server:latestb59fc10bb821
golang.org/x/net@v0.0.0-20220526153639-5463443f8c37
stdlib@go1.19.2
0.55.0
1.25.13
3
cloudflare/cloudflared:2026.8.3:latest51c9cefcb456
stdlib@go1.26.4
1.25.13
3
cloudpirates/image-minio:RELEASE.2025-10-15T17-29-55Z-hardened8dc02a7e5093
golang.org/x/net@v0.47.0
stdlib@go1.25.7
0.55.0
1.25.13
3
csiplugin/csi-resizer:v1.2.036c31f7e1f43
golang.org/x/net@v0.0.0-20210316092652-d523dce5a7f4
stdlib@go1.16
0.55.0
1.25.13
3
csiplugin/csi-snapshotter:v4.0.051f2dfde5bcc
golang.org/x/net@v0.0.0-20201209123823-ac852fbbde11
stdlib@go1.15
0.55.0
1.25.13
3
datawire/aes:1.14.48588eafe6862
golang.org/x/net@v0.0.0-20210119194325-5f4716e94777
stdlib@go1.15
0.55.0
1.25.13
3
derailed/popeye:v0.22.18e68e22c7663
golang.org/x/net@v0.34.0
stdlib@go1.23.5
0.55.0
1.25.13
3
dgraph/dgraph:v21.12.03b55ea83fffe
golang.org/x/net@v0.0.0-20201021035429-f5854403a974
stdlib@go1.17.3
0.55.0
1.25.13
3
dnationcloud/kubernetes-jsonnet-translator:2.0.178fed4f3c130
stdlib@go1.26.5
1.25.13
3
envoyproxy/gateway:v1.7.5156b7d32c73b
stdlib@go1.26.5
1.25.13
3
ethpandaops/tracoor:latestd8514b9f4c59
golang.org/x/net@v0.40.0
stdlib@go1.24.13
0.55.0
1.25.13
3
grafana/grafana:8.2.500568d89c4f8
golang.org/x/net@v0.0.0-20210726213435-c6fcb2dbf985
stdlib@go1.17
0.55.0
1.25.13
3
grafana/grafana:11.0.00dc5a246ab16
golang.org/x/net@v0.23.0
stdlib@go1.21.10
0.55.0
1.25.13
3
grafana/grafana:13.1.0121a7a9ece6d
golang.org/x/net@v0.49.0
stdlib@go1.25.7
0.55.0
1.25.13
3
grafana/grafana:13.2.1-distroless3600073f45a9
golang.org/x/net@v0.51.0
stdlib@go1.26.4
0.55.0
1.25.13
3
grafana/grafana:11.3.0a0f881232a6f
golang.org/x/net@v0.29.0
stdlib@go1.23.1
0.55.0
1.25.13
3
grafana/loki:3.4.258a6c186ce78
golang.org/x/net@v0.34.0
stdlib@go1.23.6
0.55.0
1.25.13
3
grafana/loki:3.7.7:latestd70e4659623f
stdlib@go1.26.5
1.25.13
3
grafana/loki-canary:3.6.70dac7d5cb383
golang.org/x/net@v0.47.0
stdlib@go1.24.13
0.55.0
1.25.13
3
grafana/promtail:2.4.2626900031c4e
golang.org/x/net@v0.0.0-20211101193420-4a448f8816b3
stdlib@go1.17.2
0.55.0
1.25.13
3
groundnuty/k8s-wait-for:v2.0c14d7271e401
golang.org/x/net@v0.0.0-20220722155237-a158d28d115b
stdlib@go1.19.3
0.55.0
1.25.13
3
hashicorp/http-echo:1.0.0:latestfcb75f691c8b
stdlib@go1.21.1
1.25.13
3
hashicorp/vault:2.0.45be49781ecf7
stdlib@go1.26.5
1.25.13
3
hashicorp/vault-k8s:1.7.655e27b080c9b
stdlib@go1.26.5
1.25.13
3
jacobalberty/unifi:v10.0.162896c0ab82d33
stdlib@go1.24.6
1.25.13
3
kubegems/kubegems:v1.24.10a730bcf9322a
golang.org/x/net@v0.19.0
stdlib@go1.24.10
0.55.0
1.25.13
3
library/docker:20.10-dind:20-dindaf96c680a7e1
golang.org/x/net@v0.4.0
stdlib@go1.19.7
0.55.0
1.25.13
3
library/mysql:latest66aec17cd21a
stdlib@go1.24.6
1.25.13
3
library/nats:2.10-alpineb83efabe3e7d
stdlib@go1.24.2
1.25.13
3
library/postgres:14.13162a6ead070
stdlib@go1.16.7
1.25.13
3
library/postgres:15.7-alpine:15.7-alpine3.20468d34fefd63
stdlib@go1.18.2
1.25.13
3
library/postgres:115d2aa4a7b5f9
stdlib@go1.16.7
1.25.13
3
library/postgres:14-alpine727876d27466
stdlib@go1.24.6
1.25.13
3
library/redis:7.2.4-alpinec8bb255c3559
stdlib@go1.18.2
1.25.13
3
louislam/uptime-kuma:2.5.4917318f9d7be
stdlib@go1.20.5
1.25.13
3
mcp/grafana:latest9362bcf6aa0e
stdlib@go1.26.5
1.25.13
3
meshery/meshery:stable-latest44b64ee128fb
stdlib@go1.26.4
1.25.13
3
migrate/migrate:latestcc4ad8e19d66
golang.org/x/net@v0.47.0
stdlib@go1.25.4
0.55.0
1.25.13
3
minio/minio:RELEASE.2021-02-14T04-01-33Zbd11edda91f3
golang.org/x/net@v0.0.0-20201216054612-986b41b23924
stdlib@go1.15.7
0.55.0
1.25.13
3
minio/operator:v4.3.754393e03f3b2
golang.org/x/net@v0.0.0-20210421230115-4e50805a0758
stdlib@go1.17.4
0.55.0
1.25.13
3
mintel/dex-k8s-authenticator:1.4.0caf71cee7b9a
golang.org/x/net@v0.0.0-20190522155817-f3200d17e092
stdlib@go1.13.11
0.55.0
1.25.13
3
natsio/nats-account-server:1.0.0a3381560aab6
stdlib@go1.16.6
1.25.13
3
natsio/nats-box:0.19.28031d190c7ee
golang.org/x/net@v0.44.0
stdlib@go1.25.2
0.55.0
1.25.13
3

syft 1.42.1 · advisories as of 19 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.