CVE-2026-39823

Medium

Advisory

Published 7 May 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.1; base score, highest
EPSS: 0.003; 25th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,043; of 17,821 indexed, latest versions
Container images: 4,634; deployed by those charts
Fix available: 1 of 2; affected packages

Bypass of meta content URL escaping causes XSS in html/template

Carried by container images the latest versions of 4,043 of 17,821 indexed charts deploy, on 4,634 images.

Affected package	Affected versions	Fixed in	Images
golang-1.19deb	1.19.8-2	no fix listed	1
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+182 more	1.25.10	4,634

OSV records: DEBIAN-CVE-2026-39823 GO-2026-4982
Also known as: BIT-golang-2026-39823

Charts affected

4,043 by stars

Chart

Latest

Affected images

Radar Score

glassflow-etlglassflow

0.5.21

10 of 16 See more

glassflow-etl glassflow 0.5.21

10 of the 16 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
library/nats :2.12.3-alpine	88fe8e0e09d6	stdlib@go1.25.5	1.25.10
library/postgres :17-alpine	b0f9560a2de0	stdlib@go1.24.6	1.25.10
natsio/nats-box :0.19.2	8031d190c7ee	stdlib@go1.25.2	1.25.10
natsio/nats-server-config-reloader :0.21.1	10ff229eaf52	stdlib@go1.25.5	1.25.10
natsio/prometheus-nats-exporter :0.17.3	26c826662ac8	stdlib@go1.24.2	1.25.10
otel/opentelemetry-collector-contrib :0.108.0	923eb1cfae32	stdlib@go1.23.0	1.25.10
ghcr.io/glassflow/glassflow-etl-be :v3.2.0	20f066d0f631	stdlib@go1.25.0	1.25.10
ghcr.io/glassflow/glassflow-etl-k8s-operator :v3.2.1	e70364e88629	stdlib@go1.25.0	1.25.10
ghcr.io/glassflow/glassflow-etl-migration :v3.2.0	7db1a1bf3dae	stdlib@go1.25.4	1.25.10
ghcr.io/glassflow/kafka-kerberos-gateway :latest	2ae01c524a6e	stdlib@go1.21.13	1.25.10

Open the chart page →

12,028

pgbouncerglassflow

0.1.0

1 of 1 See more

pgbouncer glassflow 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
bitnamilegacy/pgbouncer :1.23.1	92356da09704	stdlib@go1.22.10	1.25.10

Open the chart page →

3,332

postgresqlglassflow

0.1.9

1 of 1 See more

postgresql glassflow 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
library/postgres :17-alpine	18cfe3ef5e68	stdlib@go1.24.6	1.25.10

Open the chart page →

494

glassflow-operatorglassflow-operator

0.8.5

1 of 3 See more

glassflow-operator glassflow-operator 0.8.5

1 of the 3 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
ghcr.io/glassflow/glassflow-etl-k8s-operator :v3.2.1	e70364e88629	stdlib@go1.25.0	1.25.10

Open the chart page →

773

glauthglauth

0.3.17

1 of 2 See more

glauth glauth 0.3.17

1 of the 2 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
ghcr.io/nnstd/glauth :2.5	2e6e09fa77dd	stdlib@go1.24.5	1.25.10

Open the chart page →

2,577

gliderglider

0.1.5

1 of 1 See more

glider glider 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
nadoo/glider :0.16	38aadefbd607	stdlib@go1.20.14	1.25.10

Open the chart page →

895

glpiglpi-chart

0.1.1

1 of 3 See more

glpi glpi-chart 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
library/mariadb :latest	dd9b303aed4f	stdlib@go1.24.6	1.25.10

Open the chart page →

12,368

gnp-stackgnp-stack

0.0.5

7 of 14 See more

gnp-stack gnp-stack 0.0.5

7 of the 14 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
grafana/grafana :12.2.1	35c41e0fd029	stdlib@go1.25.3	1.25.10
rancher/local-path-provisioner :v0.0.32	9289da488b07	stdlib@go1.24.4	1.25.10
ghcr.io/openconfig/gnmic :0.45.0	d422a9ebd4a2	stdlib@go1.24.12	1.25.10
quay.io/prometheus-operator/prometheus-operator :v0.85.0	890b3bb05cf4	stdlib@go1.24.6	1.25.10
quay.io/prometheus/node-exporter :v1.9.1	d00a542e409e	stdlib@go1.23.7	1.25.10
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.6.3	3d671cf20a35	stdlib@go1.25.1	1.25.10
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.17.0	2bbc91556733	stdlib@go1.24.6	1.25.10

Open the chart page →

7,727

go-app-helmgo-app-helm

0.1.0

1 of 1 See more

go-app-helm go-app-helm 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
manojchaulagain/go-k8s :0.1.0	f237b5f637ae	stdlib@go1.20.1	1.25.10

Open the chart page →

1,595

go-file-servergo-file-server

1.0.0

1 of 2 See more

go-file-server go-file-server 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
goccx/go-file-server :latest	f4b3ebea0303	stdlib@go1.21.10	1.25.10

Open the chart page →

2,223

gofitgofit

0.0.1

1 of 1 See more

gofit gofit 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
ghcr.io/bamaas/gofit :0.0.1	32b6a174b419	stdlib@go1.22.11	1.25.10

Open the chart page →

651

googly-logingoogly-login

0.1.0

1 of 2 See more

googly-login googly-login 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
library/postgres :16	f1c3376c26f2	stdlib@go1.24.6	1.25.10

Open the chart page →

1,618

gorsegorse-io

0.4.2

3 of 4 See more

gorse gorse-io 0.4.2

3 of the 4 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
zhenghaoz/gorse-master :0.4.12	033046b432ec	stdlib@go1.20.1	1.25.10
zhenghaoz/gorse-server :0.4.12	39c565685b01	stdlib@go1.20.1	1.25.10
zhenghaoz/gorse-worker :0.4.12	f7739f64c9b0	stdlib@go1.20.1	1.25.10

Open the chart page →

4,438

gotwaygotway

0.8.0

1 of 1 See more

gotway gotway 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
ghcr.io/gotway/gotway :v0.0.13	7ed73c1979ee	stdlib@go1.18.3	1.25.10

Open the chart page →

1,827

Governify-Bluejaygovernify

0.1.0

2 of 12 See more

Governify-Bluejay governify 0.1.0

2 of the 12 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
governify/dashboard :latest	e83a17ba5038	stdlib@go1.17	1.25.10
library/mongo :latest	5211c51171f5	stdlib@go1.24.6	1.25.10

Open the chart page →

22,650

Governify-Falcongovernify

0.1.0

2 of 10 See more

Governify-Falcon governify 0.1.0

2 of the 10 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
governify/dashboard :latest	e83a17ba5038	stdlib@go1.17	1.25.10
library/mongo :latest	5211c51171f5	stdlib@go1.24.6	1.25.10

Open the chart page →

24,516

goweeklygoweekly

2.0.0

1 of 1 See more

goweekly goweekly 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
zufardhiyaulhaq/goweekly :v2.0.0	08dcc130fbea	stdlib@go1.17.12	1.25.10

Open the chart page →

1,230

harborgpg-dev

1.18.3

5 of 8 See more

harbor gpg-dev 1.18.3

5 of the 8 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
goharbor/harbor-core :v2.14.3	a30e5a8be3d9	stdlib@go1.24.13	1.25.10
goharbor/harbor-jobservice :v2.14.3	e2b0298e894d	stdlib@go1.24.13	1.25.10
goharbor/harbor-registryctl :v2.14.3	ddf6bb429eb6	stdlib@go1.24.13	1.25.10
goharbor/registry-photon :v2.14.3	6533fc396cbc	stdlib@go1.24.13	1.25.10
goharbor/trivy-adapter-photon :v2.14.3	5c6f7162804c	stdlib@go1.25.7	1.25.10

Open the chart page →

3,460

ingress-nginxgpg-dev

4.9.0

2 of 2 See more

ingress-nginx gpg-dev 4.9.0

2 of the 2 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
registry.k8s.io/ingress-nginx/controller :v1.9.5	b3aba22b1da8	stdlib@go1.21.5	1.25.10
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v20231011-8b53cabe0	a7943503b45d	stdlib@go1.21.3	1.25.10

Open the chart page →

2,316

jaegergpg-dev

3.3.3

4 of 5 See more

jaeger gpg-dev 3.3.3

4 of the 5 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-agent :1.53.0	0214a0ef24b1	stdlib@go1.21.5	1.25.10
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	stdlib@go1.18.2	1.25.10
jaegertracing/jaeger-collector :1.53.0	7f1269222903	stdlib@go1.21.5	1.25.10
jaegertracing/jaeger-query :1.53.0	049bb0d64ea3	stdlib@go1.21.5	1.25.10

Open the chart page →

19,390

kube-prometheus-stackgpg-dev

84.0.0

5 of 6 See more

kube-prometheus-stack gpg-dev 84.0.0

5 of the 6 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
grafana/grafana :13.0.1	0f86bada30d6	stdlib@go1.26.0	1.25.10
ghcr.io/jkroepke/kube-webhook-certgen :1.8.1	4f6da0256b1b	stdlib@go1.26.2	1.25.10
quay.io/prometheus-operator/prometheus-operator :v0.90.1	52a6a92d915e	stdlib@go1.25.8	1.25.10
quay.io/prometheus/node-exporter :v1.11.1	0f422f62c15f	stdlib@go1.26.1	1.25.10
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	stdlib@go1.25.5	1.25.10

Open the chart page →

4,334

kubernetes-dashboardgpg-dev

7.5.0

4 of 5 See more

kubernetes-dashboard gpg-dev 7.5.0

4 of the 5 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
kubernetesui/dashboard-api :1.7.0	60595892c2cf	stdlib@go1.22.3	1.25.10
kubernetesui/dashboard-auth :1.1.3	07135c09e9ff	stdlib@go1.22.2	1.25.10
kubernetesui/dashboard-metrics-scraper :1.1.1	7747d363c9fe	stdlib@go1.22.1	1.25.10
kubernetesui/dashboard-web :1.4.0	4445b31a2c25	stdlib@go1.22.3	1.25.10

Open the chart page →

6,105

metrics-servergpg-dev

3.12.1

1 of 1 See more

metrics-server gpg-dev 3.12.1

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
registry.k8s.io/metrics-server/metrics-server :v0.7.1	db3800085a09	stdlib@go1.21.8	1.25.10

Open the chart page →

1,086

opentelemetry-demogpg-dev

0.33.8

8 of 27 See more

opentelemetry-demo gpg-dev 0.33.8

8 of the 27 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
grafana/grafana :11.3.1	fa801ab6e1ae	stdlib@go1.23.1	1.25.10
jaegertracing/all-in-one :1.53.0	60e65bfffe1f	stdlib@go1.21.5	1.25.10
otel/opentelemetry-collector-contrib :0.114.0	37fa87091cfa	stdlib@go1.23.3	1.25.10
ghcr.io/open-feature/flagd :v0.11.1	a7ea52f87446	stdlib@go1.22.5	1.25.10
ghcr.io/open-telemetry/demo :1.12.0-productcatalogservice	008b9b662289	stdlib@go1.22.8	1.25.10
ghcr.io/open-telemetry/demo :1.12.0-checkoutservice	380eccdc29e9	stdlib@go1.22.8	1.25.10
ghcr.io/open-telemetry/demo :1.12.0-shippingservice	a3ca4c02a5df	stdlib@go1.21.5	1.25.10
quay.io/prometheus/prometheus :v3.0.0	3b9b2a15d376	stdlib@go1.23.3	1.25.10

Open the chart page →

50,088

prometheusgpg-dev

29.2.1

6 of 6 See more

prometheus gpg-dev 29.2.1

6 of the 6 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
quay.io/prometheus-operator/prometheus-config-reloader :v0.90.1	693faa0b8724	stdlib@go1.25.8	1.25.10
quay.io/prometheus/alertmanager :v0.32.0	58e117eabcce	stdlib@go1.26.2	1.25.10
quay.io/prometheus/node-exporter :v1.11.1	0f422f62c15f	stdlib@go1.26.1	1.25.10
quay.io/prometheus/prometheus :v3.11.2	cd37346c9745	stdlib@go1.26.2	1.25.10
quay.io/prometheus/pushgateway :v1.11.2	49ed9fdf3780	stdlib@go1.25.3	1.25.10
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	stdlib@go1.25.5	1.25.10

Open the chart page →

3,309

prometheus-operator-admission-webhookgpg-dev

0.18.1

2 of 2 See more

prometheus-operator-admission-webhook gpg-dev 0.18.1

2 of the 2 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
quay.io/prometheus-operator/admission-webhook :v0.79.2	d4c97a1b2d67	stdlib@go1.23.4	1.25.10
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v20221220-controller-v1.5.1-58-g787ea74b6	4d99688e5573	stdlib@go1.19.4	1.25.10

Open the chart page →

1,687

thanosgpg-dev

0.5.3

1 of 1 See more

thanos gpg-dev 0.5.3

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
thanosio/thanos :v0.41.0	cf3e9b292e43	stdlib@go1.25.7	1.25.10

Open the chart page →

602

traefikgpg-dev

39.0.8

1 of 1 See more

traefik gpg-dev 39.0.8

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
library/traefik :v3.6.13	34d5089d0b41	stdlib@go1.25.8	1.25.10

Open the chart page →

1,309

velerogpg-dev

12.0.0

1 of 1 See more

velero gpg-dev 12.0.0

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
velero/velero :v1.18.0	e4d1e79be2ee	stdlib@go1.25.7	1.25.10

Open the chart page →

1,582

whoami-demogpg-dev

0.1.0

1 of 1 See more

whoami-demo gpg-dev 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
containous/whoami :latest	7d6a3c8f9147	stdlib@go1.14	1.25.10

Open the chart page →

1,280

grafana-cloud-onboardinggrafana

0.4.7

5 of 5 See more

grafana-cloud-onboarding grafana 0.4.7

5 of the 5 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
grafana/beyla-k8s-cache :2	53b2f561cb1b	stdlib@go1.25.3	1.25.10
ghcr.io/grafana/alloy-operator :1.8.1	ae85d68749c7	stdlib@go1.25.8	1.25.10
ghcr.io/grafana/helm-chart-toolbox-kubectl :0.1.1	c137478627cc	stdlib@go1.23.6	1.25.10
quay.io/prometheus/node-exporter :v1.11.1	0f422f62c15f	stdlib@go1.26.1	1.25.10
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	stdlib@go1.25.5	1.25.10

Open the chart page →

4,738

grafana-samplinggrafana

1.1.7

2 of 2 See more

grafana-sampling grafana 1.1.7

2 of the 2 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
grafana/alloy :v1.11.3	8c7256f412fe	stdlib@go1.24.6	1.25.10
quay.io/prometheus-operator/prometheus-config-reloader :v0.81.0	959d47672fbf	stdlib@go1.23.7	1.25.10

Open the chart page →

3,412

mimir-openshift-experimentalgrafana

2.1.0

3 of 4 See more

mimir-openshift-experimental grafana 2.1.0

3 of the 4 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
grafana/mimir :2.0.0	80c1a8eb24dd	stdlib@go1.17.8	1.25.10
minio/mc :RELEASE.2021-02-14T04-28-06Z	2a374c124d44	stdlib@go1.15.7	1.25.10
minio/minio :RELEASE.2021-02-14T04-01-33Z	bd11edda91f3	stdlib@go1.15.7	1.25.10

Open the chart page →

17,818

pyroscope-monitoringgrafana

0.1.1

5 of 6 See more

pyroscope-monitoring grafana 0.1.1

5 of the 6 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
grafana/otel-lgtm :0.11.10	09d8c3ce4f3a	stdlib@go1.24.6	1.25.10
ghcr.io/grafana/alloy-operator :1.3.0	2088dcb22aaa	stdlib@go1.24.5	1.25.10
ghcr.io/grafana/helm-chart-toolbox-kubectl :0.1.1	c137478627cc	stdlib@go1.23.6	1.25.10
quay.io/prometheus/node-exporter :v1.9.1	d00a542e409e	stdlib@go1.23.7	1.25.10
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.17.0	2bbc91556733	stdlib@go1.24.6	1.25.10

Open the chart page →

8,493

snyk-exportergrafana

0.1.0

1 of 1 See more

snyk-exporter grafana 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
grafana/snyk_exporter :v1.4.1	d3c9093401ca	stdlib@go1.21.0	1.25.10

Open the chart page →

670

prometheusgrafana-uxadax

26.0.1

6 of 6 See more

prometheus grafana-uxadax 26.0.1

6 of the 6 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
prom/prometheus :v3.0.1	565ee8650122	stdlib@go1.23.3	1.25.10
quay.io/prometheus-operator/prometheus-config-reloader :v0.78.2	944b2c67345c	stdlib@go1.23.3	1.25.10
quay.io/prometheus/alertmanager :v0.27.0	e13b6ed5cb92	stdlib@go1.21.7	1.25.10
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	stdlib@go1.22.5	1.25.10
quay.io/prometheus/pushgateway :v1.10.0	7a4d0696a24e	stdlib@go1.23.1	1.25.10
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.14.0	37d841299325	stdlib@go1.23.3	1.25.10

Open the chart page →

5,324

grafregistratiecomponentgrafregistratiecomponent

1.0.0

1 of 3 See more

grafregistratiecomponent grafregistratiecomponent 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/grafregistratiecomponent-php :latest	35225eaa87ab	stdlib@go1.13.10	1.25.10

Open the chart page →

7,521

grapple-installergrapple-installer

0.3.22

1 of 1 See more

grapple-installer grapple-installer 0.3.22

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
grpl/grapple-cli :0.2.127	c00aafee6629	stdlib@go1.18.10	1.25.10

Open the chart page →

83,520

grayloggraylog

1.0.2

1 of 4 See more

5,026

fasttrackmlgresearch

0.1.0

1 of 1 See more

fasttrackml gresearch 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
gresearch/fasttrackml :latest	16d1228220fc	stdlib@go1.21.10	1.25.10

Open the chart page →

1,399

siembolgresearch

0.1.6

1 of 4 See more

siembol gresearch 0.1.6

1 of the 4 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
alpine/k8s :1.18.16	a41efe02a041	stdlib@go1.15.2	1.25.10

Open the chart page →

14,304

act-runnergringolito

0.2.0

1 of 1 See more

act-runner gringolito 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
gitea/act_runner :0.2.11-dind-rootless	6120b1165f3a	stdlib@go1.22.7	1.25.10

Open the chart page →

2,608

loki-proxygroundcover

0.1.1

1 of 1 See more

loki-proxy groundcover 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
public.ecr.aws/groundcovercom/loki-proxy :0.1.1	783d550ad813	stdlib@go1.17.13	1.25.10

Open the chart page →

2,183

routergroundcover

1.12.378

4 of 7 See more

router groundcover 1.12.378

4 of the 7 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
public.ecr.aws/groundcovercom/grafana-groundcover :v0.0.54-grafana11.3.7	ee9d973e3952	stdlib@go1.26.1	1.25.10
public.ecr.aws/groundcovercom/kong/kubernetes-ingress-controller :3.5.3-20260205	bf9db911deed	stdlib@go1.25.7	1.25.10
public.ecr.aws/groundcovercom/postgres :18.1-20260208	b7d7910c0bb0	stdlib@go1.25.7	1.25.10
quay.io/groundcover/tools :20260719	b705e0cbe171	stdlib@go1.24.4	1.25.10

Open the chart page →

6,192

mysqlgroundhog2k

3.1.4

1 of 1 See more

mysql groundhog2k 3.1.4

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
library/mysql :9.7.2	257388edf9c8	stdlib@go1.24.6	1.25.10

Open the chart page →

463

tailscale-subnet-routergtaylor

1.2.1

1 of 1 See more

tailscale-subnet-router gtaylor 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
ghcr.io/tailscale/tailscale :v1.34.1	ce1862e6b3a5	stdlib@go1.19.2-ts3fd24dee31	1.25.10

Open the chart page →

1,835

minifluxhajowieland

1.0.0

1 of 1 See more

miniflux hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
ghcr.io/miniflux/miniflux :2.2.8	3a11ac10969e	stdlib@go1.24.2	1.25.10

Open the chart page →

1,259

hakoniwahakoniwa

0.1.0

1 of 1 See more

hakoniwa hakoniwa 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
ghcr.io/aplulu/hakoniwa :0.1.0	accf0b921388	stdlib@go1.25.5	1.25.10

Open the chart page →

338

docker-authhalkeye

0.1.1

1 of 1 See more

docker-auth halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
cesanta/docker_auth :1.6.0	4d16885f3d4c	stdlib@go1.13.7	1.25.10

Open the chart page →

2,382

matrix-media-repohalkeye

1.0.5

1 of 1 See more

matrix-media-repo halkeye 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-39823.

Container image	Digest	Package	Fixed in
turt2live/matrix-media-repo :v1.2.8	bfbd459f89a5	stdlib@go1.16.3	1.25.10

Open the chart page →

4,463

Container images carrying it

4,634 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/prometheus/statsd-exporter :v0.27.2	9ed70604d941	stdlib@go1.22.8	1.25.10	1
quay.io/prometheus/statsd-exporter :v0.22.8	f53cca722a03	stdlib@go1.18.6	1.25.10	1
quay.io/rabbitmqoperator/messaging-topology-operator :1.18.1	f97c36882244	stdlib@go1.24.6	1.25.10	1
quay.io/reactiveops/rbac-manager :v1.9.5	87e3f461446f	stdlib@go1.25.5	1.25.10	1
quay.io/redhat-appstudio/appstudio-utils :dbbdd82734232e6289e8fbae5b4c858481a7c057	7b4202c25b67	stdlib@go1.20.8	1.25.10	1
quay.io/redhat-cop/cert-utils-operator :v1.3.12	0290e7b2800a	stdlib@go1.19.13	1.25.10	1
quay.io/redhat-cop/patch-operator :v0.1.11	030ade9b9428	stdlib@go1.21.9	1.25.10	1
quay.io/redhat-developer/servicebinding-operator	16286ac84ddd	stdlib@go1.20.6	1.25.10	1
quay.io/reiml/smtp-gotify :latest	80ffa9d2044a	stdlib@go1.23.9	1.25.10	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	stdlib@go1.16	1.25.10	1
quay.io/rimusz/hostpath-provisioner :v0.2.5	87f0398ec7ff	stdlib@go1.16.7	1.25.10	1
quay.io/sergeyshevch/s3manager :feature_refactoring	ff59fcdf44eb	stdlib@go1.18	1.25.10	1
quay.io/skopeo/stable :v1.13	4853591bd1d2	stdlib@go1.21.0	1.25.10	1
quay.io/solo-io/certgen :0.0.0-fork	b17a8c7d1f32	stdlib@go1.18.1	1.25.10	1
quay.io/solo-io/discovery :0.0.0-fork	5b62aaade3c9	stdlib@go1.18.1	1.25.10	1
quay.io/solo-io/gloo :0.0.0-fork	9a6c84560d44	stdlib@go1.18.1	1.25.10	1
quay.io/solo-io/gloo-envoy-wrapper :0.0.0-fork	26ae185e835a	stdlib@go1.18.1	1.25.10	1
quay.io/spotahome/redis-operator :latest	8c772955184e	stdlib@go1.20.7	1.25.10	1
quay.io/superq/draytek-exporter :v0.2.0	3b577bdceaae	stdlib@go1.25.4	1.25.10	1
quay.io/superq/smokeping-prober :v0.7.1	25d07dfc1d7e	stdlib@go1.20.5	1.25.10	1
quay.io/thanos/thanos :v0.40.1	aae7b2b030ed	stdlib@go1.25.3	1.25.10	1
quay.io/thanos/thanos :v0.17.1	e362f02ed304	stdlib@go1.15	1.25.10	1
quay.io/thanos/thanos :v0.36.1	e542959e1b36	stdlib@go1.21.13	1.25.10	1
quay.io/tigera/operator :v1.20.1	379efe0c2541	stdlib@go1.15.2	1.25.10	1
quay.io/tigera/operator :v1.15.1	c6591da87aa8	stdlib@go1.15.2	1.25.10	1
quay.io/titansoft/imagepullsecret-patcher :v0.14	21e6d6a155dc	stdlib@go1.13.15	1.25.10	1
quay.io/uswitch/kiam :v4.0	be3a5846922d	stdlib@go1.13.8	1.25.10	1
quay.io/vouch/vouch-proxy :0.39	d34e220de3cf	stdlib@go1.18.10	1.25.10	1
quay.io/wi_stefan/dsba-db-migrations :0.0.12	5b986cd14a08	stdlib@go1.18.9	1.25.10	1
quay.io/wraft/wraft-frontend :latest	f1bbbd5e9bb9	stdlib@go1.23.10	1.25.10	1
quay.io/youniqx/heist :v1.1.209	c43b3a9d98ae	stdlib@go1.22.7	1.25.10	1
quay.io/zncdatadev/airflow-operator :0.4.0	b716ef483b75	stdlib@go1.25.8	1.25.10	1
quay.io/zncdatadev/commons-operator :0.4.0	1a353def9fe1	stdlib@go1.25.8	1.25.10	1
quay.io/zncdatadev/dolphinscheduler-operator :0.4.0	d0a4e55eeb7f	stdlib@go1.25.8	1.25.10	1
quay.io/zncdatadev/hbase-operator :0.4.0	69e9a1b0daf8	stdlib@go1.25.8	1.25.10	1
quay.io/zncdatadev/hdfs-operator :0.4.0	eb3c2928250e	stdlib@go1.25.8	1.25.10	1
quay.io/zncdatadev/hive-operator :0.4.0	d66ba9149c22	stdlib@go1.25.8	1.25.10	1
quay.io/zncdatadev/kafka-operator :0.4.0	0a0b4c39c1ba	stdlib@go1.25.8	1.25.10	1
quay.io/zncdatadev/listener-csi-driver :0.4.0	b69bed123b02	stdlib@go1.25.8	1.25.10	1
quay.io/zncdatadev/listener-operator :0.4.0	68b92dae8d75	stdlib@go1.25.8	1.25.10	1
quay.io/zncdatadev/nifi-operator :0.4.0	bb4e26ff5e2f	stdlib@go1.25.8	1.25.10	1
quay.io/zncdatadev/secret-csi-driver :0.4.0	604a7d98ab58	stdlib@go1.25.8	1.25.10	1
quay.io/zncdatadev/spark-k8s-operator :0.4.0	d3f2b10c4a6d	stdlib@go1.25.8	1.25.10	1
quay.io/zncdatadev/superset-operator :0.4.0	102e66e32218	stdlib@go1.25.8	1.25.10	1
quay.io/zncdatadev/trino-operator :0.4.0	4f516757aee3	stdlib@go1.25.8	1.25.10	1
quay.io/zncdatadev/zookeeper-operator :0.4.0	b4f33d89ac45	stdlib@go1.25.8	1.25.10	1
registry.gitlab.com/arm-research/smarter/smarter-device-manager :v1.20.11	826b984e75d4	stdlib@go1.19.1	1.25.10	1
registry.gitlab.com/arm-research/smarter/smarter-device-manager :v1.20.7	864fc338571e	stdlib@go1.16.4	1.25.10	1
registry.gitlab.com/autokubeops/kube-image-webhook :v0.2.0	fcf464708a21	stdlib@go1.18.1	1.25.10	1
registry.gitlab.com/av1o/go-prism :4fdcff7d3870c28e5f024b6947cb552d4b956ee2	7a6f84b81c4e	stdlib@go1.16.2	1.25.10	1