CVE-2026-39822

Unscored

Advisory

Published 7 Jul 2026In the index since 5 Sept 2026

Severity: Unscored; worst across findings
CVSS: —; base score, highest
EPSS: 0.002; 14th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,327; of 17,821 indexed, latest versions
Container images: 5,001; deployed by those charts
Fix available: 1 of 1; affected package

Root escape via symlink plus trailing slash in os

Carried by container images the latest versions of 4,327 of 17,821 indexed charts deploy, on 5,001 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+189 more	1.25.12	5,001

OSV records: GO-2026-4970
Also known as: BIT-golang-2026-39822

Charts affected

4,327 by stars

Chart

Latest

Affected images

Radar Score

vm-standaloneot-container-kit

0.0.4

4 of 6 See more

vm-standalone ot-container-kit 0.0.4

4 of the 6 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
quay.io/opstree/grafana :12.4.3	b61c1ed2f015	stdlib@go1.26.2	1.25.12
quay.io/opstree/kube-state-metrics :2.18.0-debian13	53525d253793	stdlib@go1.25.9	1.25.12
quay.io/opstree/node-exporter :1.11.1-alpine3.23	3b6b3a7eb001	stdlib@go1.26.2	1.25.12
quay.io/opstree/victoriametrics-operator :v0.69.0	66fe5216c278	stdlib@go1.26.2	1.25.12

Open the chart page →

3,507

otel-add-onotel-add-on

0.1.4

1 of 1 See more

otel-add-on otel-add-on 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/kedify/otel-add-on :v0.1.4	a6f2155bd822	stdlib@go1.24.3	1.25.12

Open the chart page →

734

otsots

1.8.4

1 of 2 See more

ots ots 1.8.4

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/luzifer/ots :v1.21.5	c94f6c9ed173	stdlib@go1.26.2	1.25.12

Open the chart page →

367

adotowan-charts

0.1.0

1 of 1 See more

adot owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-observability/aws-otel-collector :v0.43.3	8aa9ea5f67b8	stdlib@go1.24.3	1.25.12

Open the chart page →

1,033

httpbunowan-charts

0.1.0

1 of 1 See more

httpbun owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
sharat87/httpbun :latest	405332d9050a	stdlib@go1.25.1	1.25.12

Open the chart page →

314

minioowan-charts

0.1.2

2 of 2 See more

minio owan-charts 0.1.2

2 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
cleanstart/minio :latest	544bdb8811e1	stdlib@go1.26.4	1.25.12
ghcr.io/georgmangold/console :v1.8.1	58f4f180aa6e	stdlib@go1.24.4	1.25.12

Open the chart page →

1,083

shlinkowan-charts

0.1.0

1 of 1 See more

shlink owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
shlinkio/shlink :stable	666cc24edf72	stdlib@go1.26.4	1.25.12

Open the chart page →

322

kubernetes-taggeroxyno-zeta

1.1.2

1 of 1 See more

kubernetes-tagger oxyno-zeta 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
oxynozeta/kubernetes-tagger :1.3.0	a153c386f5af	stdlib@go1.17	1.25.12

Open the chart page →

1,827

arpap2p-avs

0.1.3

1 of 2 See more

arpa p2p-avs 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/arpa-network/node-client :latest	657a2c9f6e6d	stdlib@go1.22.5	1.25.12

Open the chart page →

1,998

automatap2p-avs

0.1.0

1 of 2 See more

automata p2p-avs 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/automata-network/multi-prover-avs/operator :v0.6.0	752f1aa02438	stdlib@go1.22.1	1.25.12

Open the chart page →

3,695

avap2p-avs

0.1.0

1 of 1 See more

ava p2p-avs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
avaprotocol/ap-avs :1.2.0	c430ea5c37d6	stdlib@go1.22.5	1.25.12

Open the chart page →

3,364

eigendap2p-avs

0.1.1

2 of 3 See more

eigenda p2p-avs 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/layr-labs/eigenda/opr-node :0.8.4	6650119a385f	stdlib@go1.21.1	1.25.12
ghcr.io/layr-labs/eigenda/opr-nodeplugin :0.8.4	e459ad3ae758	stdlib@go1.21.1	1.25.12

Open the chart page →

2,336

predicatep2p-avs

0.1.4

1 of 1 See more

predicate p2p-avs 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/predicatelabs/operator :v1.0.5	b62113fe1b27	stdlib@go1.23.5	1.25.12

Open the chart page →

893

p4p4

0.1.0

3 of 7 See more

p4 p4 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
codeurjc/toposervice :v1.23	9fb4c11e6a49	stdlib@go1.18.10	1.25.12
library/mongo :5.0-focal	5e15a3f014ed	stdlib@go1.25.9	1.25.12
library/mysql :8	b3b90af2a655	stdlib@go1.24.6	1.25.12

Open the chart page →

27,884

myappp4-helm

0.1.0

1 of 6 See more

19,769

pacmanpacman-mh

0.1.28

1 of 2 See more

pacman pacman-mh 0.1.28

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mongo :7.0.28-jammy	88785f6f665a	stdlib@go1.24.0	1.25.12

Open the chart page →

3,627

pagespages

1.0.0

1 of 3 See more

20,287

pagespages10

1.0.0

1 of 3 See more

20,287

pagespages111

1.0.0

1 of 3 See more

pages pages111 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages2

1.0.0

1 of 3 See more

20,287

pagespages-alexchmielu

1.0.0

1 of 3 See more

pages pages-alexchmielu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-alps

1.0.0

1 of 3 See more

pages pages-alps 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-alstom

1.0.0

1 of 3 See more

pages pages-alstom 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-ambala

1.0.0

1 of 3 See more

pages pages-ambala 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-andromeda

1.0.0

1 of 3 See more

pages pages-andromeda 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespagesbadami

1.0.0

1 of 3 See more

pages pagesbadami 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-blackburn

1.0.0

1 of 3 See more

pages pages-blackburn 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-botes

1.0.0

1 of 3 See more

pages pages-botes 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-brian

1.0.0

1 of 3 See more

pages pages-brian 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-buckll

1.0.0

1 of 3 See more

pages pages-buckll 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-camden

1.0.0

1 of 3 See more

pages pages-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-camden771

1.0.0

1 of 3 See more

pages pages-camden771 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-draco

1.0.0

1 of 3 See more

pages pages-draco 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-ellora

1.0.0

1 of 3 See more

pages pages-ellora 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-finchley

1.0.0

1 of 3 See more

pages pages-finchley 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-fornax

1.0.0

1 of 3 See more

pages pages-fornax 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-harsh

1.0.0

1 of 3 See more

pages pages-harsh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespagesk

1.0.0

1 of 3 See more

20,287

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-mihai

1.0.0

1 of 3 See more

pages pages-mihai 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-nivesh

1.0.0

1 of 3 See more

pages pages-nivesh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespagessandeepgudu

1.0.0

1 of 3 See more

pages pagessandeepgudu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-shubhanker

1.0.0

1 of 3 See more

pages pages-shubhanker 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-ssharma0909

1.0.0

1 of 3 See more

pages pages-ssharma0909 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-sucharitha

1.0.0

1 of 3 See more

pages pages-sucharitha 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-sudhir

1.0.0

1 of 3 See more

pages pages-sudhir 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-sushi

1.0.0

1 of 3 See more

pages pages-sushi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-vasanth5814

1.0.0

1 of 3 See more

pages pages-vasanth5814 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-vjp

1.0.0

1 of 3 See more

pages pages-vjp 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

Container images carrying it

5,001 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
rss3/proxyd :d2c5ced00901227473fc196fda838191f0cb4e02	8d9a44c650fa	stdlib@go1.21.3	1.25.12	1
rtuszik/photon-docker :2.4.0	21549c60f9e6	stdlib@go1.22.2	1.25.12	1
runatlantis/atlantis :v0.16.1	45fbaf7e207c	stdlib@go1.14.7	1.25.12	1
ruslanguns/metadata-injector-operator :v0.0.1	6c77e4675e07	stdlib@go1.22.11	1.25.12	1
rustrial/k8s-gitops-secrets-controller :0.6.0	93326a322a01	stdlib@go1.26.4	1.25.12	1
ryuunosukeds3/orbital :latest	0879f7261b10	stdlib@go1.23.9	1.25.12	1
sablierapp/sablier :1.16.1	413704376656	stdlib@go1.26.3	1.25.12	1
salaboy/agenda-service-0967b907d9920c99918e2b91b91937b3	ce9ce8293e4e	stdlib@go1.20.1	1.25.12	1
salaboy/c4p-service-a3dc0474cbfa348afcdf47a8eee70ba9	bb64bf14467d	stdlib@go1.20.1	1.25.12	1
salaboy/frontend-go-1739aa83b5e69d4ccb8a5615830ae66c	1ff7c90845e4	stdlib@go1.20.1	1.25.12	1
salaboy/notifications-service-0e27884e01429ab7e350cb5dff61b525	799c35f9f306	stdlib@go1.20.1	1.25.12	1
samarthya/spinnaker :v1.0	ef06d81036af	stdlib@go1.17.6	1.25.12	1
samcm/checkpointz :latest	a66b24a87766	stdlib@go1.25.1	1.25.12	1
sarwansharma/minio :v3	59d1da9385d1	stdlib@go1.18.3	1.25.12	1
sbs20/scanservjs :release-v3.0.3	dad1fd6e9a98	stdlib@go1.19.8	1.25.12	1
scaleway/scaleway-csi :v0.3.4	11135998e31c	stdlib@go1.24.12	1.25.12	1
schemahero/schemahero-manager :0.22.1	1609e1a05cd3	stdlib@go1.24.6	1.25.12	1
scholtz2/algorand-participation-aramidmain-extended :4.4.1-stable	f12ce1cfb72e	stdlib@go1.25.3	1.25.12	1
scholtz2/algorand-participation-mainnet-extended :4.4.1-stable	5aaa5d4ab8b8	stdlib@go1.25.3	1.25.12	1
scholtz2/algorand-participation-voimain-extended :4.4.1-stable	64966de56d9f	stdlib@go1.25.3	1.25.12	1
scholtz2/algorand-relay-mainnet :4.4.1-stable	e9af7d8ff6bb	stdlib@go1.25.3	1.25.12	1
scholtz2/aramid-algo-follow-node :v4.3.0-stable	1ec63eca86b6	stdlib@go1.23.9	1.25.12	1
scholtz2/aramid-algo-node :v4.4.1-stable	70263d8fab5b	stdlib@go1.23.11	1.25.12	1
scholtz2/aramid-conduit :v1.9.0-stable	3a3b3d3277d2	stdlib@go1.26.3	1.25.12	1
scholtz2/aramid-indexer :v3.9.0-stable	6770214bc881	stdlib@go1.26.3	1.25.12	1
seafileltd/seafile-mc :9.0.10	6693911bcc40	stdlib@go1.19	1.25.12	1
seafileltd/seafile-mc :10.0.1	70628f29c663	stdlib@go1.20	1.25.12	1
seafileltd/seafile-mc :9.0.9	7ac833196f60	stdlib@go1.19	1.25.12	1
seafileltd/seafile-mc :11.0.12	d0c66e4621bd	stdlib@go1.21.4	1.25.12	1
sealio/hermitcrab :v0.1.4	a326a2f03660	stdlib@go1.21.6	1.25.12	1
sealio/terraform-deployer :v1.5.7-seal.1	b0389d9848a5	stdlib@go1.20.7	1.25.12	1
securecodebox/operator :5.8.0	c14bd5c550e3	stdlib@go1.26.4	1.25.12	1
seldonio/seldon-core-operator :1.19.0	544e3bf71bd1	stdlib@go1.24.11	1.25.12	1
selectdb/doris.k8s-operator :1.3.1	919210765cb8	stdlib@go1.19.13	1.25.12	1
semaphoreui/semaphore :latest :v2.19.12	3996804607eb	stdlib@go1.23.3	1.25.12	1
semaphoreui/semaphore :v2.9.64	5b50bc11833f	stdlib@go1.21.8	1.25.12	1
semaphoreui/semaphore :v2.19.14	98ad9bc7a2a0	stdlib@go1.25.5	1.25.12	1
semaphoreui/semaphore :v2.18.3	e9260bfa8255	stdlib@go1.25.5	1.25.12	1
semitechnologies/weaviate :1.19.1	7a00d226f063	stdlib@go1.19.9	1.25.12	1
sentriz/gonic :v0.13.1	a74012a6adf3	stdlib@go1.16.4	1.25.12	1
shaowenchen/ops-controller-manager :latest	35575d4f2bfe	stdlib@go1.24.13	1.25.12	1
shaowenchen/ops-server :latest	6bac5cebd125	stdlib@go1.24.9	1.25.12	1
sharanalwar/redchef-frontend :latest	5e82950b16b7	stdlib@go1.23.7	1.25.12	1
sharat87/httpbun :latest	405332d9050a	stdlib@go1.25.1	1.25.12	1
shenxn/protonmail-bridge :1.8.7-1	acf31af7c111	stdlib@go1.15.12	1.25.12	1
shlomibendavid/k8s-applier :0311240529	a22ffbe0f04e	stdlib@go1.21.7	1.25.12	1
shyim/shopware :6.4.6.0	a951c0e6b836	stdlib@go1.20.7	1.25.12	1
sigma2as/minio :20240306-3a2e4f5	c284ead9ec3e	stdlib@go1.19.2	1.25.12	1
signald/signald :0.18.2	0ffad7ccc2eb	stdlib@go1.18.1	1.25.12	1
signald/signald :0.23.2	edbff058278c	stdlib@go1.18.10	1.25.12	1