StackRadar

CVE-2026-39822

Unscored

Advisory

Published 7 Jul 2026In the index since 5 Sept 2026
Severity
Unscored
worst across findings
CVSS
base score, highest
EPSS
0.002
14th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,346
of 17,837 indexed, latest versions
Container images
4,984
deployed by those charts
Fix available
1 of 1
affected package

Root escape via symlink plus trailing slash in os

Carried by container images the latest versions of 4,346 of 17,837 indexed charts deploy, on 4,984 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+189 more1.25.124,984
OSV records
GO-2026-4970
Also known as
BIT-golang-2026-39822

Charts affected

4,346 by stars
ChartLatestAffected imagesRadar Score

Container images carrying it

4,984 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/jont828/cluster-api-visualizer:v1.5.0678ba6833297
stdlib@go1.24.11
1.25.12
2
ghcr.io/k8snetworkplumbingwg/multus-cni:v4.1.409fdfb7ce090
stdlib@go1.23.4
1.25.12
2
ghcr.io/keptn/certificate-operator:v3.0.0b82064b0e339
stdlib@go1.23.3
1.25.12
2
ghcr.io/keptn/lifecycle-operator:v2.0.0866ced256a8c
stdlib@go1.23.3
1.25.12
2
ghcr.io/keptn/metrics-operator:v2.1.0dc48471c7cf8
stdlib@go1.23.3
1.25.12
2
ghcr.io/kluster-manager/cluster-auth:v0.5.1fba6fb872281
stdlib@go1.25.7
1.25.12
2
ghcr.io/konpyutaika/docker-images/nifikop:v1.14.1-release6bb00c592a82
stdlib@go1.24.4
1.25.12
2
ghcr.io/krateoplatformops/installer/installer:0.6.3a7e922ddac55
stdlib@go1.25.5
1.25.12
2
ghcr.io/libredb/libredb-studio:0.16.2c398419c29a7
stdlib@go1.24.4
1.25.12
2
ghcr.io/matrix-org/sliding-sync:v0.99.19b940cab56435
stdlib@go1.20.14
1.25.12
2
ghcr.io/nucleuscloud/neosync/api:0.5.41e2abb798f29f
stdlib@go1.24.5
1.25.12
2
ghcr.io/nucleuscloud/neosync/worker:0.5.4196f42450c5b1
stdlib@go1.24.5
1.25.12
2
ghcr.io/parca-dev/parca:v0.20.00d1df8f436f7
stdlib@go1.21.1
1.25.12
2
ghcr.io/projectcapsule/capsule:v0.14.6ac02588e65e8
stdlib@go1.26.4
1.25.12
2
ghcr.io/projectcapsule/capsule-proxy:v0.14.17c90292e3172
stdlib@go1.26.4
1.25.12
2
ghcr.io/salaboy/fmtok8s-agenda-service:v0.0.1-native6c5efe150958
stdlib@go1.18.10
1.25.12
2
ghcr.io/salaboy/fmtok8s-c4p-service:v0.0.1-native3f7cc45fd20b
stdlib@go1.19.7
1.25.12
2
ghcr.io/shopify/toxiproxy:2.7.0fc2d40f4904c
stdlib@go1.19.13
1.25.12
2
ghcr.io/sigstore/fulcio:v1.8.8ef72cf56c64b
stdlib@go1.26.4
1.25.12
2
ghcr.io/sigstore/rekor/rekor-server:v1.5.4100d793d68d0
stdlib@go1.26.4
1.25.12
2
ghcr.io/sigstore/scaffolding/createcerts7f59f7c08d1a
stdlib@go1.25.0
1.25.12
2
ghcr.io/smarter-project/smarter-device-manager:v1.20.12228f7f44594a
stdlib@go1.19.3
1.25.12
2
ghcr.io/spiffe/spiffe-csi-driver:0.2.79dfe4f0caff0
stdlib@go1.24.0
1.25.12
2
ghcr.io/spiffe/spiffe-helper:0.11.01c92e5998ad3
stdlib@go1.25.3
1.25.12
2
ghcr.io/squat/generic-device-plugin:36bfc606bba2064de6ede0ff2764cbb52edff70dba6f0b4cf6c8
stdlib@go1.20.2
1.25.12
2
ghcr.io/stashed/stash-ui-server:v0.23.047cffbc65700
stdlib@go1.25.3
1.25.12
2
ghcr.io/thecatlady/webhook:2.8.0f04718704dab
stdlib@go1.20.1
1.25.12
2
ghcr.io/voyagermesh/echoserver:v20221109:v20221109-7ee2f3efa56a9251de6
stdlib@go1.19
1.25.12
2
ghcr.io/voyagermesh/gateway:v1.8.24237fd16a3cb
stdlib@go1.26.4
1.25.12
2
ghcr.io/wg-easy/wg-easy:15:15.4.00e7bc9d34e86
stdlib@go1.26.3
1.25.12
2
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.1-1-ubi9d20bd62f0182
stdlib@go1.25.4
1.25.12
2
public.ecr.aws/cloudnatix/llmariner/api-usage-cleaner:1.16.0d47f43484055
stdlib@go1.23.12
1.25.12
2
public.ecr.aws/cloudnatix/llmariner/api-usage-server:1.16.08f9c32b866b0
stdlib@go1.23.12
1.25.12
2
public.ecr.aws/cloudnatix/llmariner/cluster-manager-server:1.8.0364b3ff0fcb7
stdlib@go1.24.5
1.25.12
2
public.ecr.aws/cloudnatix/llmariner/cluster-monitor-server:0.10.22d28f9e3eab4
stdlib@go1.23.11
1.25.12
2
public.ecr.aws/cloudnatix/llmariner/file-manager-server:1.11.0301216788e93
stdlib@go1.23.11
1.25.12
2
public.ecr.aws/cloudnatix/llmariner/inference-manager-engine:1.46.0c46f109c3d0b
stdlib@go1.25.9
1.25.12
2
public.ecr.aws/cloudnatix/llmariner/job-manager-dispatcher:1.27.0582508903cb0
stdlib@go1.23.12
1.25.12
2
public.ecr.aws/cloudnatix/llmariner/job-manager-server:1.27.0fe9de719f91e
stdlib@go1.23.12
1.25.12
2
public.ecr.aws/cloudnatix/llmariner/model-manager-loader:1.27.026ac7263a823
stdlib@go1.24.0
1.25.12
2
public.ecr.aws/cloudnatix/llmariner/model-manager-server:1.27.0c057dcdd9ef3
stdlib@go1.23.12
1.25.12
2
public.ecr.aws/cloudnatix/llmariner/rbac-server:1.19.1df1adeb86679
stdlib@go1.23.12
1.25.12
2
public.ecr.aws/cloudnatix/llmariner/user-manager-server:1.27.1628a14449241
stdlib@go1.23.12
1.25.12
2
public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.16.11564359e1e0e
stdlib@go1.19.6
1.25.12
2
public.ecr.aws/eks-distro/etcd-io/etcd:v3.5.6-eks-1-24-7efa6dee17ed2
stdlib@go1.16.15
1.25.12
2
public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.1.0-eks-1-25-latest701eea03388c
stdlib@go1.19.5
1.25.12
2
public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner:v3.4.0-eks-1-25-latest460ee1a59fea
stdlib@go1.19.7
1.25.12
2
public.ecr.aws/eks-distro/kubernetes-csi/external-resizer:v1.7.0-eks-1-25-lateste711da25e7a0
stdlib@go1.19.8
1.25.12
2
public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe:v2.9.0-eks-1-25-latest8a305e162caa
stdlib@go1.19.8
1.25.12
2
public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar:v2.7.0-eks-1-25-latestf4345e67df8f
stdlib@go1.19.8
1.25.12
2

syft 1.42.1 · advisories as of 23 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.