CVE-2026-39822

Unscored

Advisory

Published 7 Jul 2026In the index since 5 Sept 2026

Severity: Unscored; worst across findings
CVSS: —; base score, highest
EPSS: 0.002; 14th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,327; of 17,821 indexed, latest versions
Container images: 5,001; deployed by those charts
Fix available: 1 of 1; affected package

Root escape via symlink plus trailing slash in os

Carried by container images the latest versions of 4,327 of 17,821 indexed charts deploy, on 5,001 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+189 more	1.25.12	5,001

OSV records: GO-2026-4970
Also known as: BIT-golang-2026-39822

Charts affected

4,327 by stars

Chart

Latest

Affected images

Radar Score

vm-standaloneot-container-kit

0.0.4

4 of 6 See more

vm-standalone ot-container-kit 0.0.4

4 of the 6 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
quay.io/opstree/grafana :12.4.3	b61c1ed2f015	stdlib@go1.26.2	1.25.12
quay.io/opstree/kube-state-metrics :2.18.0-debian13	53525d253793	stdlib@go1.25.9	1.25.12
quay.io/opstree/node-exporter :1.11.1-alpine3.23	3b6b3a7eb001	stdlib@go1.26.2	1.25.12
quay.io/opstree/victoriametrics-operator :v0.69.0	66fe5216c278	stdlib@go1.26.2	1.25.12

Open the chart page →

3,507

otel-add-onotel-add-on

0.1.4

1 of 1 See more

otel-add-on otel-add-on 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/kedify/otel-add-on :v0.1.4	a6f2155bd822	stdlib@go1.24.3	1.25.12

Open the chart page →

734

otsots

1.8.4

1 of 2 See more

ots ots 1.8.4

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/luzifer/ots :v1.21.5	c94f6c9ed173	stdlib@go1.26.2	1.25.12

Open the chart page →

367

adotowan-charts

0.1.0

1 of 1 See more

adot owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-observability/aws-otel-collector :v0.43.3	8aa9ea5f67b8	stdlib@go1.24.3	1.25.12

Open the chart page →

1,033

httpbunowan-charts

0.1.0

1 of 1 See more

httpbun owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
sharat87/httpbun :latest	405332d9050a	stdlib@go1.25.1	1.25.12

Open the chart page →

314

minioowan-charts

0.1.2

2 of 2 See more

minio owan-charts 0.1.2

2 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
cleanstart/minio :latest	544bdb8811e1	stdlib@go1.26.4	1.25.12
ghcr.io/georgmangold/console :v1.8.1	58f4f180aa6e	stdlib@go1.24.4	1.25.12

Open the chart page →

1,083

shlinkowan-charts

0.1.0

1 of 1 See more

shlink owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
shlinkio/shlink :stable	666cc24edf72	stdlib@go1.26.4	1.25.12

Open the chart page →

322

kubernetes-taggeroxyno-zeta

1.1.2

1 of 1 See more

kubernetes-tagger oxyno-zeta 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
oxynozeta/kubernetes-tagger :1.3.0	a153c386f5af	stdlib@go1.17	1.25.12

Open the chart page →

1,827

arpap2p-avs

0.1.3

1 of 2 See more

arpa p2p-avs 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/arpa-network/node-client :latest	657a2c9f6e6d	stdlib@go1.22.5	1.25.12

Open the chart page →

1,998

automatap2p-avs

0.1.0

1 of 2 See more

automata p2p-avs 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/automata-network/multi-prover-avs/operator :v0.6.0	752f1aa02438	stdlib@go1.22.1	1.25.12

Open the chart page →

3,695

avap2p-avs

0.1.0

1 of 1 See more

ava p2p-avs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
avaprotocol/ap-avs :1.2.0	c430ea5c37d6	stdlib@go1.22.5	1.25.12

Open the chart page →

3,364

eigendap2p-avs

0.1.1

2 of 3 See more

eigenda p2p-avs 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/layr-labs/eigenda/opr-node :0.8.4	6650119a385f	stdlib@go1.21.1	1.25.12
ghcr.io/layr-labs/eigenda/opr-nodeplugin :0.8.4	e459ad3ae758	stdlib@go1.21.1	1.25.12

Open the chart page →

2,336

predicatep2p-avs

0.1.4

1 of 1 See more

predicate p2p-avs 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/predicatelabs/operator :v1.0.5	b62113fe1b27	stdlib@go1.23.5	1.25.12

Open the chart page →

893

p4p4

0.1.0

3 of 7 See more

p4 p4 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
codeurjc/toposervice :v1.23	9fb4c11e6a49	stdlib@go1.18.10	1.25.12
library/mongo :5.0-focal	5e15a3f014ed	stdlib@go1.25.9	1.25.12
library/mysql :8	b3b90af2a655	stdlib@go1.24.6	1.25.12

Open the chart page →

27,884

myappp4-helm

0.1.0

1 of 6 See more

19,769

pacmanpacman-mh

0.1.28

1 of 2 See more

pacman pacman-mh 0.1.28

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mongo :7.0.28-jammy	88785f6f665a	stdlib@go1.24.0	1.25.12

Open the chart page →

3,627

pagespages

1.0.0

1 of 3 See more

20,287

pagespages10

1.0.0

1 of 3 See more

20,287

pagespages111

1.0.0

1 of 3 See more

pages pages111 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages2

1.0.0

1 of 3 See more

20,287

pagespages-alexchmielu

1.0.0

1 of 3 See more

pages pages-alexchmielu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-alps

1.0.0

1 of 3 See more

pages pages-alps 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-alstom

1.0.0

1 of 3 See more

pages pages-alstom 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-ambala

1.0.0

1 of 3 See more

pages pages-ambala 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-andromeda

1.0.0

1 of 3 See more

pages pages-andromeda 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespagesbadami

1.0.0

1 of 3 See more

pages pagesbadami 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-blackburn

1.0.0

1 of 3 See more

pages pages-blackburn 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-botes

1.0.0

1 of 3 See more

pages pages-botes 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-brian

1.0.0

1 of 3 See more

pages pages-brian 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-buckll

1.0.0

1 of 3 See more

pages pages-buckll 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-camden

1.0.0

1 of 3 See more

pages pages-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-camden771

1.0.0

1 of 3 See more

pages pages-camden771 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-draco

1.0.0

1 of 3 See more

pages pages-draco 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-ellora

1.0.0

1 of 3 See more

pages pages-ellora 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-finchley

1.0.0

1 of 3 See more

pages pages-finchley 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-fornax

1.0.0

1 of 3 See more

pages pages-fornax 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-harsh

1.0.0

1 of 3 See more

pages pages-harsh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespagesk

1.0.0

1 of 3 See more

20,287

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-mihai

1.0.0

1 of 3 See more

pages pages-mihai 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-nivesh

1.0.0

1 of 3 See more

pages pages-nivesh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespagessandeepgudu

1.0.0

1 of 3 See more

pages pagessandeepgudu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-shubhanker

1.0.0

1 of 3 See more

pages pages-shubhanker 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-ssharma0909

1.0.0

1 of 3 See more

pages pages-ssharma0909 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-sucharitha

1.0.0

1 of 3 See more

pages pages-sucharitha 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-sudhir

1.0.0

1 of 3 See more

pages pages-sudhir 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-sushi

1.0.0

1 of 3 See more

pages pages-sushi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-vasanth5814

1.0.0

1 of 3 See more

pages pages-vasanth5814 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-vjp

1.0.0

1 of 3 See more

pages pages-vjp 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

Container images carrying it

5,001 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/conductionnl/verzoekconversieservice-php :latest	e918014fb8d3	stdlib@go1.13.10	1.25.12	1
ghcr.io/conductionnl/verzoekregistratiecomponent-php :latest	c4f6c03af5d3	stdlib@go1.13.10	1.25.12	1
ghcr.io/conductionnl/verzoektypecatalogus-php :latest	64f5eb7a398b	stdlib@go1.13.10	1.25.12	1
ghcr.io/conductionnl/waardepapieren-balie-php :latest	f36c423cd259	stdlib@go1.13.10	1.25.12	1
ghcr.io/conductionnl/waardepapieren-php :latest	b2666ffcbad8	stdlib@go1.13.10	1.25.12	1
ghcr.io/conductionnl/waardepapieren-register-php :latest	9affab218351	stdlib@go1.13.10	1.25.12	1
ghcr.io/conductionnl/webresourcecatalogus-php :latest	8f1bbd5cda85	stdlib@go1.13.10	1.25.12	1
ghcr.io/containeroo/agent-forge-operator :v1.1.4	8f6d8acd134a	stdlib@go1.26.0	1.25.12	1
ghcr.io/containeroo/autovpa :v0.0.34	25b801d8d1f7	stdlib@go1.26.0	1.25.12	1
ghcr.io/containeroo/cert-manager-webhook-bluecat :latest	96f82d5840d4	stdlib@go1.26.0	1.25.12	1
ghcr.io/containeroo/cloudflare-operator :v1.10.6	0eda6d237a84	stdlib@go1.26.0	1.25.12	1
ghcr.io/containeroo/filesystem-exporter :v1.5.2	a66121e16d4e	stdlib@go1.26.1	1.25.12	1
ghcr.io/containeroo/kube-ephemeral-container-exporter :v0.0.14	b238f3c58d83	stdlib@go1.26.0	1.25.12	1
ghcr.io/containeroo/terrascaler :v0.1.0	b152a8514bd3	stdlib@go1.26.3	1.25.12	1
ghcr.io/containers/nri-plugins/nri-memory-policy :v0.14.0	531d21ec4ba2	stdlib@go1.26.0	1.25.12	1
ghcr.io/containers/nri-plugins/nri-memory-qos :v0.14.0	c7c5c24ed894	stdlib@go1.26.0	1.25.12	1
ghcr.io/containers/nri-plugins/nri-memtierd :v0.14.0	9138314e12ba	stdlib@go1.26.0	1.25.12	1
ghcr.io/containers/nri-plugins/nri-resctrl-mon :v0.14.0	a9c9775fab70	stdlib@go1.26.0	1.25.12	1
ghcr.io/containers/nri-plugins/nri-resource-annotator :v0.14.0	8100a19e85f7	stdlib@go1.26.0	1.25.12	1
ghcr.io/containers/nri-plugins/nri-resource-policy-balloons :v0.14.0	a8c8297c7274	stdlib@go1.26.0	1.25.12	1
ghcr.io/containers/nri-plugins/nri-resource-policy-template :v0.14.0	0edfc075277b	stdlib@go1.26.0	1.25.12	1
ghcr.io/containers/nri-plugins/nri-resource-policy-topology-aware :v0.14.0	e2443833726a	stdlib@go1.26.0	1.25.12	1
ghcr.io/containers/nri-plugins/nri-sgx-epc :v0.14.0	b4c4d0d83c14	stdlib@go1.26.0	1.25.12	1
ghcr.io/coollabsio/minio :RELEASE.2025-10-15T17-29-55Z	69b55a1c1c5d	stdlib@go1.24.6	1.25.12	1
ghcr.io/cosanet/cosanet :1.0.0	98cb5d9fa215	stdlib@go1.25.0	1.25.12	1
ghcr.io/cosmo-workspace/cosmo-controller-manager :v0.9.0	8c7fa5552028	stdlib@go1.20.5	1.25.12	1
ghcr.io/cosmo-workspace/cosmo-dashboard :v0.9.1	6a1c4a81a924	stdlib@go1.20.5	1.25.12	1
ghcr.io/cosmo-workspace/dev-code-server :v0.0.3	16fda01ae58a	stdlib@go1.22.5	1.25.12	1
ghcr.io/crashappsec/chalk-operator :v0.1.1	28eee62e9bfa	stdlib@go1.24.13	1.25.12	1
ghcr.io/crazygit/cert-manager-alidns-webhook :0.1.4	976be6506eb6	stdlib@go1.25.3	1.25.12	1
ghcr.io/crazy-max/cloudflared :2025.9.1	9b4e856d18f6	stdlib@go1.24.7	1.25.12	1
ghcr.io/crazy-max/diun :4.19.0	c94e32b888e4	stdlib@go1.16.5	1.25.12	1
ghcr.io/crazy-max/samba :4.15.5	bed6f4ec2e82	stdlib@go1.17.2	1.25.12	1
ghcr.io/cronschedules/cronjob-scale-down-operator :0.4.4	1c4e803d7169	stdlib@go1.25.0	1.25.12	1
ghcr.io/csepulveda/trivy-webhook-aws-security-hub :v0.1.20	6836b779b060	stdlib@go1.26.2	1.25.12	1
ghcr.io/ctron/kubectl :1.25	e37d61b5277c	stdlib@go1.20.10	1.25.12	1
ghcr.io/cubefs/cfs-csi-driver :3.2.0.150.0	8723616a976a	stdlib@go1.18.4	1.25.12	1
ghcr.io/cybozu-go/accurate :2.0.0	be4a2680bef4	stdlib@go1.26.3	1.25.12	1
ghcr.io/d0ugal/internet-perf-exporter :v0.2.91	f5c9a96fe52a	stdlib@go1.26.4	1.25.12	1
ghcr.io/danieldonoghue/vault-sync-operator :v0.0.1-beta.3	8d7ec69a193c	stdlib@go1.25.9	1.25.12	1
ghcr.io/daocloud/crproxy/crproxy :v0.8.0	ee1eb3c9c9a1	stdlib@go1.21.11	1.25.12	1
ghcr.io/dapr/injector :1.17.0-rc.3	7a2fd888ed5f	stdlib@go1.24.11	1.25.12	1
ghcr.io/dapr/operator :1.17.0-rc.3	d5cc61cbe735	stdlib@go1.24.11	1.25.12	1
ghcr.io/dapr/placement :1.17.0-rc.3	a237b43cd5c6	stdlib@go1.24.11	1.25.12	1
ghcr.io/dapr/scheduler :1.17.0-rc.3	6c62e01e736b	stdlib@go1.24.11	1.25.12	1
ghcr.io/dapr/sentry :1.17.0-rc.3	bf79b03591e0	stdlib@go1.24.11	1.25.12	1
ghcr.io/dask/dask-notebook :2024.1.0	f53bde3acd4f	stdlib@go1.21.5	1.25.12	1
ghcr.io/davidkarlsen/flyway-operator :0.2.13	66f60b461c0d	stdlib@go1.24.4	1.25.12	1
ghcr.io/dcristobalhmad/kube-secrets-exporter :latest	a9043737cb73	stdlib@go1.22.3	1.25.12	1
ghcr.io/debridmediamanager/zurg-testing :v0.9.3-final	5c47ef99443a	stdlib@go1.22.5	1.25.12	1