CVE-2026-39822

Unscored

Advisory

Published 7 Jul 2026In the index since 5 Sept 2026

Severity: Unscored; worst across findings
CVSS: —; base score, highest
EPSS: 0.002; 14th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,327; of 17,821 indexed, latest versions
Container images: 5,001; deployed by those charts
Fix available: 1 of 1; affected package

Root escape via symlink plus trailing slash in os

Carried by container images the latest versions of 4,327 of 17,821 indexed charts deploy, on 5,001 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+189 more	1.25.12	5,001

OSV records: GO-2026-4970
Also known as: BIT-golang-2026-39822

Charts affected

4,327 by stars

Chart

Latest

Affected images

Radar Score

vm-standaloneot-container-kit

0.0.4

4 of 6 See more

vm-standalone ot-container-kit 0.0.4

4 of the 6 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
quay.io/opstree/grafana :12.4.3	b61c1ed2f015	stdlib@go1.26.2	1.25.12
quay.io/opstree/kube-state-metrics :2.18.0-debian13	53525d253793	stdlib@go1.25.9	1.25.12
quay.io/opstree/node-exporter :1.11.1-alpine3.23	3b6b3a7eb001	stdlib@go1.26.2	1.25.12
quay.io/opstree/victoriametrics-operator :v0.69.0	66fe5216c278	stdlib@go1.26.2	1.25.12

Open the chart page →

3,507

otel-add-onotel-add-on

0.1.4

1 of 1 See more

otel-add-on otel-add-on 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/kedify/otel-add-on :v0.1.4	a6f2155bd822	stdlib@go1.24.3	1.25.12

Open the chart page →

734

otsots

1.8.4

1 of 2 See more

ots ots 1.8.4

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/luzifer/ots :v1.21.5	c94f6c9ed173	stdlib@go1.26.2	1.25.12

Open the chart page →

367

adotowan-charts

0.1.0

1 of 1 See more

adot owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-observability/aws-otel-collector :v0.43.3	8aa9ea5f67b8	stdlib@go1.24.3	1.25.12

Open the chart page →

1,033

httpbunowan-charts

0.1.0

1 of 1 See more

httpbun owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
sharat87/httpbun :latest	405332d9050a	stdlib@go1.25.1	1.25.12

Open the chart page →

314

minioowan-charts

0.1.2

2 of 2 See more

minio owan-charts 0.1.2

2 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
cleanstart/minio :latest	544bdb8811e1	stdlib@go1.26.4	1.25.12
ghcr.io/georgmangold/console :v1.8.1	58f4f180aa6e	stdlib@go1.24.4	1.25.12

Open the chart page →

1,083

shlinkowan-charts

0.1.0

1 of 1 See more

shlink owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
shlinkio/shlink :stable	666cc24edf72	stdlib@go1.26.4	1.25.12

Open the chart page →

322

kubernetes-taggeroxyno-zeta

1.1.2

1 of 1 See more

kubernetes-tagger oxyno-zeta 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
oxynozeta/kubernetes-tagger :1.3.0	a153c386f5af	stdlib@go1.17	1.25.12

Open the chart page →

1,827

arpap2p-avs

0.1.3

1 of 2 See more

arpa p2p-avs 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/arpa-network/node-client :latest	657a2c9f6e6d	stdlib@go1.22.5	1.25.12

Open the chart page →

1,998

automatap2p-avs

0.1.0

1 of 2 See more

automata p2p-avs 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/automata-network/multi-prover-avs/operator :v0.6.0	752f1aa02438	stdlib@go1.22.1	1.25.12

Open the chart page →

3,695

avap2p-avs

0.1.0

1 of 1 See more

ava p2p-avs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
avaprotocol/ap-avs :1.2.0	c430ea5c37d6	stdlib@go1.22.5	1.25.12

Open the chart page →

3,364

eigendap2p-avs

0.1.1

2 of 3 See more

eigenda p2p-avs 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/layr-labs/eigenda/opr-node :0.8.4	6650119a385f	stdlib@go1.21.1	1.25.12
ghcr.io/layr-labs/eigenda/opr-nodeplugin :0.8.4	e459ad3ae758	stdlib@go1.21.1	1.25.12

Open the chart page →

2,336

predicatep2p-avs

0.1.4

1 of 1 See more

predicate p2p-avs 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/predicatelabs/operator :v1.0.5	b62113fe1b27	stdlib@go1.23.5	1.25.12

Open the chart page →

893

p4p4

0.1.0

3 of 7 See more

p4 p4 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
codeurjc/toposervice :v1.23	9fb4c11e6a49	stdlib@go1.18.10	1.25.12
library/mongo :5.0-focal	5e15a3f014ed	stdlib@go1.25.9	1.25.12
library/mysql :8	b3b90af2a655	stdlib@go1.24.6	1.25.12

Open the chart page →

27,884

myappp4-helm

0.1.0

1 of 6 See more

19,769

pacmanpacman-mh

0.1.28

1 of 2 See more

pacman pacman-mh 0.1.28

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mongo :7.0.28-jammy	88785f6f665a	stdlib@go1.24.0	1.25.12

Open the chart page →

3,627

pagespages

1.0.0

1 of 3 See more

20,287

pagespages10

1.0.0

1 of 3 See more

20,287

pagespages111

1.0.0

1 of 3 See more

pages pages111 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages2

1.0.0

1 of 3 See more

20,287

pagespages-alexchmielu

1.0.0

1 of 3 See more

pages pages-alexchmielu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-alps

1.0.0

1 of 3 See more

pages pages-alps 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-alstom

1.0.0

1 of 3 See more

pages pages-alstom 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-ambala

1.0.0

1 of 3 See more

pages pages-ambala 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-andromeda

1.0.0

1 of 3 See more

pages pages-andromeda 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespagesbadami

1.0.0

1 of 3 See more

pages pagesbadami 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-blackburn

1.0.0

1 of 3 See more

pages pages-blackburn 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-botes

1.0.0

1 of 3 See more

pages pages-botes 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-brian

1.0.0

1 of 3 See more

pages pages-brian 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-buckll

1.0.0

1 of 3 See more

pages pages-buckll 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-camden

1.0.0

1 of 3 See more

pages pages-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-camden771

1.0.0

1 of 3 See more

pages pages-camden771 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-draco

1.0.0

1 of 3 See more

pages pages-draco 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-ellora

1.0.0

1 of 3 See more

pages pages-ellora 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-finchley

1.0.0

1 of 3 See more

pages pages-finchley 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-fornax

1.0.0

1 of 3 See more

pages pages-fornax 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-harsh

1.0.0

1 of 3 See more

pages pages-harsh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespagesk

1.0.0

1 of 3 See more

20,287

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-mihai

1.0.0

1 of 3 See more

pages pages-mihai 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-nivesh

1.0.0

1 of 3 See more

pages pages-nivesh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespagessandeepgudu

1.0.0

1 of 3 See more

pages pagessandeepgudu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-shubhanker

1.0.0

1 of 3 See more

pages pages-shubhanker 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-ssharma0909

1.0.0

1 of 3 See more

pages pages-ssharma0909 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-sucharitha

1.0.0

1 of 3 See more

pages pages-sucharitha 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-sudhir

1.0.0

1 of 3 See more

pages pages-sudhir 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-sushi

1.0.0

1 of 3 See more

pages pages-sushi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-vasanth5814

1.0.0

1 of 3 See more

pages pages-vasanth5814 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

pagespages-vjp

1.0.0

1 of 3 See more

pages pages-vjp 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.12

Open the chart page →

20,287

Container images carrying it

5,001 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/home-assistant/home-assistant :2026.8.2	56690a89c79a	stdlib@go1.23.3	1.25.12	1
ghcr.io/home-assistant/home-assistant :2025.12.5	9a5a3eb4a213	stdlib@go1.25.4	1.25.12	1
ghcr.io/home-assistant/home-assistant :2026.9.2	a1bc133af84e	stdlib@go1.25.6	1.25.12	1
ghcr.io/home-assistant/home-assistant :2022.5.4	ec6d67fbedfa	stdlib@go1.17.1	1.25.12	1
ghcr.io/home-assistant/home-assistant :2023.11.3	feffc0b8227d	stdlib@go1.17.1	1.25.12	1
ghcr.io/home-operations/home-assistant :2026.3.1	067e54e2e107	stdlib@go1.25.6	1.25.12	1
ghcr.io/honeycombio/kspan/kspan :0.2	c966a4f8a4b7	stdlib@go1.20.1	1.25.12	1
ghcr.io/hsn723/cert-estuary :0.2.0	0c4b6132b0ad	stdlib@go1.26.2	1.25.12	1
ghcr.io/hsn723/dkim-manager :1.4.0	0312232b31a2	stdlib@go1.26.0	1.25.12	1
ghcr.io/hsn723/postfix_exporter :0.20.0	b7da7c554018	stdlib@go1.26.2	1.25.12	1
ghcr.io/huseyinbabal/kubetag :latest	e161eddc59a0	stdlib@go1.25.5	1.25.12	1
ghcr.io/hyperspike/valkey-operator :v0.0.61	7d8c669f11a4	stdlib@go1.25.2	1.25.12	1
ghcr.io/idebeijer/gameserver-operator :latest	1b099cfe9e5e	stdlib@go1.25.7	1.25.12	1
ghcr.io/ignisda/ryot :v10.5.0	a752b6aee537	stdlib@go1.23.1	1.25.12	1
ghcr.io/igrikus/garm-operator :4.2.0	9e24d8a6a3b2	stdlib@go1.26.2	1.25.12	1
ghcr.io/imcitius/checker-edge :1.1.11	74426c1fe00f	stdlib@go1.25.9	1.25.12	1
ghcr.io/imgproxy/imgproxy :v3.30.0	74c1bee92e04	stdlib@go1.25.1	1.25.12	1
ghcr.io/imunhatep/kube-node-ready :0.5.0	7439f6f9f85c	stdlib@go1.25.7	1.25.12	1
ghcr.io/indeedeng/harbor-container-webhook :main	45ca15fc294f	stdlib@go1.24.1	1.25.12	1
ghcr.io/inlets/inlets-operator :0.17.22	08265c006973	stdlib@go1.26.2	1.25.12	1
ghcr.io/interlink-hq/interlink/virtual-kubelet-inttw :latest	0e05a7b49c33	stdlib@go1.24.5	1.25.12	1
ghcr.io/invergent-ai/surogate-hub :latest	6d4106724d56	stdlib@go1.24.13	1.25.12	1
ghcr.io/itakurah/kubernetes-event-exporter :v1.7	8abb52b66557	stdlib@go1.20.14	1.25.12	1
ghcr.io/it-at-m/appswitcher-server :1.3.0	10006bc0f309	stdlib@go1.24.3	1.25.12	1
ghcr.io/itzg/minecraft-server :latest	46919d151d39	stdlib@go1.24.6	1.25.12	1
ghcr.io/jaconi-io/koptimize :1.2.5	aca1bbd609b6	stdlib@go1.20.7	1.25.12	1
ghcr.io/jadolg/klum :v0.8.17	c66cc93f9d03	stdlib@go1.26.3	1.25.12	1
ghcr.io/jaydee94/kubeseal-webgui/api :4.5.3	3cceb9462ae1	stdlib@go1.24.4	1.25.12	1
ghcr.io/jens-maus/raspberrymatic :3.83.6.20250824	4b22b4f407c4	stdlib@go1.24.4	1.25.12	1
ghcr.io/jimmidyson/configmap-reload :v0.13.1	ca0c14eef541	stdlib@go1.22.4	1.25.12	1
ghcr.io/jkroepke/kube-webhook-certgen :1.8.0	43401e216e89	stdlib@go1.26.1	1.25.12	1
ghcr.io/jkroepke/kube-webhook-certgen :1.8.1	4f6da0256b1b	stdlib@go1.26.2	1.25.12	1
ghcr.io/jkroepke/kube-webhook-certgen :1.7.7	b18964551d8e	stdlib@go1.25.5	1.25.12	1
ghcr.io/jlclx/runtimeclass-controller :latest	b3a87f92a963	stdlib@go1.17.13	1.25.12	1
ghcr.io/jmberesford/retrom-service :retrom-v0.7.14	4d763d58f11d	stdlib@go1.20.12	1.25.12	1
ghcr.io/jmcgrath207/par :v0.1.0	9977511cb142	stdlib@go1.19.10	1.25.12	1
ghcr.io/jmriebold/sqs-prometheus-exporter :1.1.0	7564828ab7cb	stdlib@go1.24.0	1.25.12	1
ghcr.io/jodevsa/wireguard-operator/manager :v2.0.28	39412bdd403b	stdlib@go1.22.2	1.25.12	1
ghcr.io/jsclayton/prometheus-plex-exporter :latest	18ef1b2197ef	stdlib@go1.23.0	1.25.12	1
ghcr.io/juanfont/headscale :0.29.1	8453e47ea6bf	stdlib@go1.26.4	1.25.12	1
ghcr.io/juanfont/headscale :v0.25.0	97febecbe6cb	stdlib@go1.23.4	1.25.12	1
ghcr.io/justwatchcom/sql_exporter :v0.8	c4b1d3d0f052	stdlib@go1.24.4	1.25.12	1
ghcr.io/k10app/businit :latest	94c9a3e799c2	stdlib@go1.19.3	1.25.12	1
ghcr.io/k8s-at-home/apache-musicindex :v1.4.1-2	c9bd82dc5fda	stdlib@go1.18.4	1.25.12	1
ghcr.io/k8s-at-home/bazarr :v1.0.3	fdb5501cdfb9	stdlib@go1.16.8	1.25.12	1
ghcr.io/k8s-at-home/cni-plugins :v0.9.1	241592d93640	stdlib@go1.15.8	1.25.12	1
ghcr.io/k8s-at-home/emby :v4.6.1.0	5c6b8f91f1c4	stdlib@go1.15	1.25.12	1
ghcr.io/k8s-at-home/gateway-admision-controller :v2.0.0	0d6d0df98fe4	stdlib@go1.16.4	1.25.12	1
ghcr.io/k8s-at-home/gateway-admision-controller :v3.5.0	175512bb3f61	stdlib@go1.18.3	1.25.12	1
ghcr.io/k8s-at-home/haste-server :latest	827aa2f2389d	stdlib@go1.15	1.25.12	1