CVE-2026-39822

Unscored

Advisory

Published 7 Jul 2026In the index since 5 Sept 2026

Severity: Unscored; worst across findings
CVSS: —; base score, highest
EPSS: 0.002; 14th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,327; of 17,821 indexed, latest versions
Container images: 5,001; deployed by those charts
Fix available: 1 of 1; affected package

Root escape via symlink plus trailing slash in os

Carried by container images the latest versions of 4,327 of 17,821 indexed charts deploy, on 5,001 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+189 more	1.25.12	5,001

OSV records: GO-2026-4970
Also known as: BIT-golang-2026-39822

Charts affected

4,327 by stars

Chart

Latest

Affected images

Radar Score

vm-standaloneot-container-kit

0.0.4

4 of 6 See more

vm-standalone ot-container-kit 0.0.4

4 of the 6 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
quay.io/opstree/grafana :12.4.3	b61c1ed2f015	stdlib@go1.26.2	1.25.12
quay.io/opstree/kube-state-metrics :2.18.0-debian13	53525d253793	stdlib@go1.25.9	1.25.12
quay.io/opstree/node-exporter :1.11.1-alpine3.23	3b6b3a7eb001	stdlib@go1.26.2	1.25.12
quay.io/opstree/victoriametrics-operator :v0.69.0	66fe5216c278	stdlib@go1.26.2	1.25.12

Open the chart page →

3,507

otel-add-onotel-add-on

0.1.4

1 of 1 See more

otel-add-on otel-add-on 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/kedify/otel-add-on :v0.1.4	a6f2155bd822	stdlib@go1.24.3	1.25.12

Open the chart page →

734

otsots

1.8.4

1 of 2 See more

ots ots 1.8.4

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/luzifer/ots :v1.21.5	c94f6c9ed173	stdlib@go1.26.2	1.25.12

Open the chart page →

367

adotowan-charts

0.1.0

1 of 1 See more

adot owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-observability/aws-otel-collector :v0.43.3	8aa9ea5f67b8	stdlib@go1.24.3	1.25.12

Open the chart page →

1,033

httpbunowan-charts

0.1.0

1 of 1 See more

httpbun owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
sharat87/httpbun :latest	405332d9050a	stdlib@go1.25.1	1.25.12

Open the chart page →

314

minioowan-charts

0.1.2

2 of 2 See more

minio owan-charts 0.1.2

2 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
cleanstart/minio :latest	544bdb8811e1	stdlib@go1.26.4	1.25.12
ghcr.io/georgmangold/console :v1.8.1	58f4f180aa6e	stdlib@go1.24.4	1.25.12

Open the chart page →

1,083

shlinkowan-charts

0.1.0

1 of 1 See more

shlink owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
shlinkio/shlink :stable	666cc24edf72	stdlib@go1.26.4	1.25.12

Open the chart page →

322

kubernetes-taggeroxyno-zeta

1.1.2

1 of 1 See more

kubernetes-tagger oxyno-zeta 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
oxynozeta/kubernetes-tagger :1.3.0	a153c386f5af	stdlib@go1.17	1.25.12

Open the chart page →

1,827

arpap2p-avs

0.1.3

1 of 2 See more

arpa p2p-avs 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/arpa-network/node-client :latest	657a2c9f6e6d	stdlib@go1.22.5	1.25.12

Open the chart page →

1,998

automatap2p-avs

0.1.0

1 of 2 See more

automata p2p-avs 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/automata-network/multi-prover-avs/operator :v0.6.0	752f1aa02438	stdlib@go1.22.1	1.25.12

Open the chart page →

3,695

avap2p-avs

0.1.0

1 of 1 See more

ava p2p-avs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
avaprotocol/ap-avs :1.2.0	c430ea5c37d6	stdlib@go1.22.5	1.25.12

Open the chart page →

3,364

eigendap2p-avs

0.1.1

2 of 3 See more

eigenda p2p-avs 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/layr-labs/eigenda/opr-node :0.8.4	6650119a385f	stdlib@go1.21.1	1.25.12
ghcr.io/layr-labs/eigenda/opr-nodeplugin :0.8.4	e459ad3ae758	stdlib@go1.21.1	1.25.12

Open the chart page →

2,336

predicatep2p-avs

0.1.4

1 of 1 See more

predicate p2p-avs 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/predicatelabs/operator :v1.0.5	b62113fe1b27	stdlib@go1.23.5	1.25.12

Open the chart page →

893

p4p4

0.1.0

3 of 7 See more

p4 p4 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
codeurjc/toposervice :v1.23	9fb4c11e6a49	stdlib@go1.18.10	1.25.12
library/mongo :5.0-focal	5e15a3f014ed	stdlib@go1.25.9	1.25.12
library/mysql :8	b3b90af2a655	stdlib@go1.24.6	1.25.12

Open the chart page →

27,884

myappp4-helm

0.1.0

1 of 6 See more

19,769

pacmanpacman-mh

0.1.28

1 of 2 See more

pacman pacman-mh 0.1.28

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mongo :7.0.28-jammy	88785f6f665a	stdlib@go1.24.0	1.25.12

Open the chart page →

3,627

pagespages

1.0.0

1 of 3 See more

20,287

pagespages10

1.0.0

1 of 3 See more

20,287

pagespages111

1.0.0

1 of 3 See more

pages pages111 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages2

1.0.0

1 of 3 See more

20,287

pagespages-alexchmielu

1.0.0

1 of 3 See more

pages pages-alexchmielu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-alps

1.0.0

1 of 3 See more

pages pages-alps 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-alstom

1.0.0

1 of 3 See more

pages pages-alstom 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-ambala

1.0.0

1 of 3 See more

pages pages-ambala 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-andromeda

1.0.0

1 of 3 See more

pages pages-andromeda 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespagesbadami

1.0.0

1 of 3 See more

pages pagesbadami 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-blackburn

1.0.0

1 of 3 See more

pages pages-blackburn 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-botes

1.0.0

1 of 3 See more

pages pages-botes 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-brian

1.0.0

1 of 3 See more

pages pages-brian 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-buckll

1.0.0

1 of 3 See more

pages pages-buckll 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-camden

1.0.0

1 of 3 See more

pages pages-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-camden771

1.0.0

1 of 3 See more

pages pages-camden771 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-draco

1.0.0

1 of 3 See more

pages pages-draco 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-ellora

1.0.0

1 of 3 See more

pages pages-ellora 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-finchley

1.0.0

1 of 3 See more

pages pages-finchley 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-fornax

1.0.0

1 of 3 See more

pages pages-fornax 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-harsh

1.0.0

1 of 3 See more

pages pages-harsh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespagesk

1.0.0

1 of 3 See more

20,287

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-mihai

1.0.0

1 of 3 See more

pages pages-mihai 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-nivesh

1.0.0

1 of 3 See more

pages pages-nivesh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespagessandeepgudu

1.0.0

1 of 3 See more

pages pagessandeepgudu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-shubhanker

1.0.0

1 of 3 See more

pages pages-shubhanker 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-ssharma0909

1.0.0

1 of 3 See more

pages pages-ssharma0909 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-sucharitha

1.0.0

1 of 3 See more

pages pages-sucharitha 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-sudhir

1.0.0

1 of 3 See more

pages pages-sudhir 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-sushi

1.0.0

1 of 3 See more

pages pages-sushi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-vasanth5814

1.0.0

1 of 3 See more

pages pages-vasanth5814 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-vjp

1.0.0

1 of 3 See more

pages pages-vjp 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

Container images carrying it

5,001 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
tinymediamanager/tinymediamanager :5.3.2	2b34dc85099e	stdlib@go1.24.4	1.25.12	1
tksky1/cubeuniverse :0.1alpha	ec7b889f380f	stdlib@go1.20.3	1.25.12	1
tobiasbp/db-backup :0.0.3	14bee6e33a26	stdlib@go1.13.10	1.25.12	1
tobiasehlert/teslamateapi :1.20.2	cf09259ad0ea	stdlib@go1.24.0	1.25.12	1
tobirachel/node-project3 :v1	7d9f37154994	stdlib@go1.17.5	1.25.12	1
tolgee/tolgee :v3.224.2	f55f50b7c6a9	stdlib@go1.24.6	1.25.12	1
toucansoftware/spa-reloader :latest	c187b1fba501	stdlib@go1.13.15	1.25.12	1
traefik/mesh :v1.4.8	cf071f3e165c	stdlib@go1.19	1.25.12	1
traefik/whoami :v1.10.2	1474027c3166	stdlib@go1.22.2	1.25.12	1
traefik/whoami :v1.10	1699d99cb4b9	stdlib@go1.23.5	1.25.12	1
traefik/whoami :v1.6.1	2c52bb2c8480	stdlib@go1.15.6	1.25.12	1
traefik/whoami :v1.8.0	8d0f943abdbf	stdlib@go1.17.7	1.25.12	1
traefik/whoami :v1.6.0	d38496bf0900	stdlib@go1.15.2	1.25.12	1
traggo/server :0.2.3	f1ced637510e	stdlib@go1.13.1	1.25.12	1
tranhailong/nfs-server :4.2-2-gcsfuse	028662749be2	stdlib@go1.18.4	1.25.12	1
treeverse/lakefs :0.69.0	478f37a6cffc	stdlib@go1.17.8	1.25.12	1
trinodb/trino :480	1565e8cac299	stdlib@go1.26.1	1.25.12	1
trinodb/trino :481	5b5e0a97f599	stdlib@go1.26.2	1.25.12	1
trinodb/trino :479	6af989b0846d	stdlib@go1.25.4	1.25.12	1
truebyteinnovationllp/redis-exporter :v1.86.0	1c6a945af653	stdlib@go1.25.11	1.25.12	1
tundeficky/nodejs-app :v1.0.0	3cf9a9ce54e8	stdlib@go1.17.5	1.25.12	1
turt2live/matrix-media-repo :v1.2.8	bfbd459f89a5	stdlib@go1.16.3	1.25.12	1
tusproject/tusd :v1.10.0	1e457b59fd5b	stdlib@go1.19.2	1.25.12	1
tusproject/tusd :v1.13.0	f8088058b80f	stdlib@go1.21.0	1.25.12	1
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	stdlib@go1.21.7	1.25.12	1
twinproduction/aws-eks-asg-rolling-update-handler :v1.7.0	8f38c206972e	stdlib@go1.19.3	1.25.12	1
twinproduction/gatus :v5.34.0	3fff895e77d3	stdlib@go1.25.5	1.25.12	1
twinproduction/gatus :v3.8.0	49dc0d9b2e2c	stdlib@go1.18.1	1.25.12	1
tykio/portal :v1.18.0	92509e00e618	stdlib@go1.25.11	1.25.12	1
uderelier19/pardus-nginx :25-nodeport	8ab640b44e3f	stdlib@go1.24.4	1.25.12	1
udhos/apiping :1.5.0	41ab9bae6f3b	stdlib@go1.25.4	1.25.12	1
udhos/eks-auto-pod-id-assoc :0.6.0	196ef68af380	stdlib@go1.26.3	1.25.12	1
udhos/forward :1.1.3	12e120d39fdb	stdlib@go1.20.5	1.25.12	1
udhos/gateboard :1.12.5	3acc0e7599bf	stdlib@go1.25.3	1.25.12	1
udhos/gateboard-discovery :1.9.5	5567c9363c4c	stdlib@go1.25.3	1.25.12	1
udhos/k8s-mutating-admission-webhook :1.15.1	e588db500edf	stdlib@go1.26.3	1.25.12	1
udhos/lambdaping :1.0.4	6bd2cf2ac732	stdlib@go1.23.4	1.25.12	1
udhos/miniapi :1.3.2	8a7042db82ce	stdlib@go1.23.2	1.25.12	1
udhos/mongoping :1.3.1	03b08b63f524	stdlib@go1.24.2	1.25.12	1
udhos/prime :1.0.0	e432012dd34a	stdlib@go1.20.4	1.25.12	1
udhos/rabbitping :1.3.0	474c467bbf42	stdlib@go1.24.3	1.25.12	1
udhos/redis-enforce-expire :1.0.0	615b6a7d742e	stdlib@go1.26.1	1.25.12	1
udhos/secrets :1.0.6	daa2b4eaac09	stdlib@go1.24.2	1.25.12	1
udhos/snsping :1.2.9	6ae70677b6a3	stdlib@go1.23.4	1.25.12	1
udhos/sqs-to-sns :2.0.15	cf7979da82e1	stdlib@go1.26.3	1.25.12	1
udhos/token-server :1.0.9	728013f2fac1	stdlib@go1.25.1	1.25.12	1
uffizzi/uffizzi-cluster-operator :v1.4.5	14e528bbd926	stdlib@go1.19.13	1.25.12	1
uffizzi/uffizzi-cluster-operator :v1.6.5	5ca448a08783	stdlib@go1.19.13	1.25.12	1
uptrace/uptrace :2.0.2	34a02c3b2d12	stdlib@go1.24.10	1.25.12	1
utho/utho-app-operator :0.1.4	6e8a690e8b7a	stdlib@go1.22.8	1.25.12	1