StackRadar

CVE-2026-39831

Critical

Advisory

Published 22 May 2026In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
0.004
36th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,533
of 17,832 indexed, latest versions
Container images
2,854
deployed by those charts
Fix available
1 of 1
affected package

golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed

Carried by container images the latest versions of 2,533 of 17,832 indexed charts deploy, on 2,854 images.

Affected packageAffected versionsFixed inImages
golang.org/x/cryptogolangv0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+153 more0.52.02,854
OSV records
GHSA-89gr-r52h-f8rx
Also known as
GO-2026-5019

Charts affected

2,533 by stars
ChartLatestAffected imagesRadar Score
traefik-hubtraefikOfficialVerified publisher4.2.01 of 1See more

traefik-hub traefik 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
ghcr.io/traefik/traefik-hub:v2.11.0322f5f8cc105
golang.org/x/crypto@v0.14.0
0.52.0

Open the chart page →

3,194
atlantistrozz3.12.111 of 1See more

atlantis trozz 3.12.11

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
runatlantis/atlantis:v0.16.145fbaf7e207c
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

5,288
guardrails-agent-kubernetesturbotVerified publisher0.3.01 of 1See more

guardrails-agent-kubernetes turbot 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
ghcr.io/turbot/guardrails-agent-kubernetes:0.3.09d01bf9c9224
golang.org/x/crypto@v0.26.0
0.52.0

Open the chart page →

4,135
boundaryundergridVerified publisher0.1.01 of 3See more

boundary undergrid 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
hashicorp/boundary:0.8.1fb70bd9210ff
golang.org/x/crypto@v0.0.0-20220331220935-ae2d96664a29
0.52.0

Open the chart page →

4,968
upbot-operatorupbot-operator0.0.201 of 2See more

upbot-operator upbot-operator 0.0.20

1 of the 2 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
alpine/k8s:1.28.13e5c0b053fed7
golang.org/x/crypto@v0.24.0
0.52.0

Open the chart page →

4,488
user-componentuser-component1.2.01 of 4See more

user-component user-component 1.2.0

1 of the 4 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/user-component-php:latest198db44fabb5
golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904
0.52.0

Open the chart page →

7,317
user-manager-serveruser-manager-server1.27.11 of 1See more

user-manager-server user-manager-server 1.27.1

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
public.ecr.aws/cloudnatix/llmariner/user-manager-server:1.27.1628a14449241
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

757
v2ray-proxyv2ray-proxy0.2.41 of 1See more

v2ray-proxy v2ray-proxy 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
pinclr/v2ray-proxy:latestf37f250b7091
golang.org/x/crypto@v0.6.0
0.52.0

Open the chart page →

1,962
vault-gcp-secretsvault-gcp-secrets1.19.51 of 1See more

vault-gcp-secrets vault-gcp-secrets 1.19.5

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
ghcr.io/tjm/vault-gcp-secrets:v1.19.59f157fe035f1
golang.org/x/crypto@v0.38.0
0.52.0

Open the chart page →

2,448
vearchvearch3.3.42 of 4See more

vearch vearch 3.3.4

2 of the 4 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
prom/prometheus:v2.13.10a8caa2e9f19
golang.org/x/crypto@v0.0.0-20190701094942-4def268fd1a4
0.52.0
vearch/vearch:3.3.40768af33f9d9
golang.org/x/crypto@v0.9.0
0.52.0

Open the chart page →

5,023
devportal-admin-uiveecode-platformVerified publisher0.5.41 of 1See more

devportal-admin-ui veecode-platform 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
veecode/devportal-admin-ui:0.4.30c69fd286b489
golang.org/x/crypto@v0.25.0
0.52.0

Open the chart page →

5,314
riveruivirtualrootVerified publisher0.1.31 of 1See more

riverui virtualroot 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
ghcr.io/riverqueue/riverui:0.5.32dc54179b25a
golang.org/x/crypto@v0.22.0
0.52.0

Open the chart page →

1,135
go-egvoid-xmh1.1.13 of 3See more

go-eg void-xmh 1.1.1

3 of the 3 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
voidxmh/xmh-auther:v193e42a569ca8
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0
voidxmh/xmh-cacher:v11b7397412320
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0
voidxmh/xmh-ui:v12ff3f2146547
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

7,470
vultr-ccmvultrVerified publisher1.3.01 of 1See more

vultr-ccm vultr 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
vultr/vultr-cloud-controller-manager:v0.3.01806f17d620c
golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83
0.52.0

Open the chart page →

3,043
waardepapierenwaardepapieren1.0.01 of 3See more

waardepapieren waardepapieren 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/waardepapieren-php:latestb2666ffcbad8
golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904
0.52.0

Open the chart page →

8,092
waardepapieren-baliewaardepapieren-balie1.0.01 of 3See more

waardepapieren-balie waardepapieren-balie 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/waardepapieren-balie-php:latestf36c423cd259
golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904
0.52.0

Open the chart page →

7,886
waardepapieren-registerwaardepapieren-register1.1.01 of 4See more

waardepapieren-register waardepapieren-register 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/waardepapieren-register-php:latest9affab218351
golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904
0.52.0

Open the chart page →

7,442
wachdwachdVerified publisher0.4.371 of 1See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
ghcr.io/wachd/wachd:0.4.1805b05c56da94
golang.org/x/crypto@v0.37.0
0.52.0

Open the chart page →

1,275
azure-metrics-exporterwebdevopsVerified publisher1.2.111 of 1See more

azure-metrics-exporter webdevops 1.2.11

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
webdevops/azure-metrics-exporter:25.12.01d3b453fba99
golang.org/x/crypto@v0.46.0
0.52.0

Open the chart page →

509
frpcwener1.0.11 of 1See more

frpc wener 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
wener/frpc:v0.37.0cc9fd4da44c0
golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2
0.52.0

Open the chart page →

3,361
frpswener1.0.11 of 1See more

frps wener 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
wener/frps:v0.37.05c92cc9e8597
golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2
0.52.0

Open the chart page →

3,361
prometheus-snmp-exporterwener9.18.01 of 1See more

prometheus-snmp-exporter wener 9.18.0

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
quay.io/prometheus/snmp-exporter:v0.30.1e5fd5e8b43ac
golang.org/x/crypto@v0.46.0
0.52.0

Open the chart page →

509
seaweedfswener2.92.01 of 1See more

seaweedfs wener 2.92.0

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
chrislusf/seaweedfs:2.92db095fe8a8d6
golang.org/x/crypto@v0.0.0-20201216223049-8b5274cf687f
0.52.0

Open the chart page →

2,748
frpswenerme1.0.11 of 1See more

frps wenerme 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
wener/frps:v0.37.05c92cc9e8597
golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2
0.52.0

Open the chart page →

3,361
natswenerme2.15.01 of 3See more

nats wenerme 2.15.0

1 of the 3 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
natsio/nats-box:0.19.7ffce8bd10338
golang.org/x/crypto@v0.50.0
0.52.0

Open the chart page →

2,151
prometheus-blackbox-exporterwenerme11.18.01 of 1See more

prometheus-blackbox-exporter wenerme 11.18.0

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
quay.io/prometheus/blackbox-exporter:v0.28.0e753ff9f3fc4
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

600
yugabytewenerme2026.1.21 of 1See more

yugabyte wenerme 2026.1.2

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
yugabytedb/yugabyte:2026.1.2.0-b137b6dba322c734
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

217
wharf-ainowharf-helmVerified publisher0.1.55 of 7See more

wharf-aino wharf-helm 0.1.5

5 of the 7 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
quay.io/iver-wharf/wharf-api:v5.2.0b736b345437d
golang.org/x/crypto@v0.0.0-20220214200702-86341886e292
0.52.0
quay.io/iver-wharf/wharf-cmd:v0.8.2e98d13459cdc
golang.org/x/crypto@v0.0.0-20220411220226-7b82a4e95df4
0.52.0
quay.io/iver-wharf/wharf-provider-azuredevops:v3.0.12fe7e4dcffdf
golang.org/x/crypto@v0.0.0-20220427172511-eb4f295cb31f
0.52.0
quay.io/iver-wharf/wharf-provider-github:v3.0.177a22cb45c2a
golang.org/x/crypto@v0.0.0-20220427172511-eb4f295cb31f
0.52.0
quay.io/iver-wharf/wharf-provider-gitlab:v2.0.1d7079e0890da
golang.org/x/crypto@v0.0.0-20220427172511-eb4f295cb31f
0.52.0

Open the chart page →

13,492
wharf-cmdwharf-helmVerified publisher0.3.31 of 1See more

wharf-cmd wharf-helm 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
quay.io/iver-wharf/wharf-cmd:v0.8.2e98d13459cdc
golang.org/x/crypto@v0.0.0-20220411220226-7b82a4e95df4
0.52.0

Open the chart page →

3,437
external-monitoringwiremindVerified publisher0.3.01 of 1See more

external-monitoring wiremind 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
quay.io/prometheus/blackbox-exporter:v0.24.03af31f8bd1ad
golang.org/x/crypto@v0.8.0
0.52.0

Open the chart page →

1,301
kubemodwiremindVerified publisher0.1.51 of 2See more

kubemod wiremind 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
kubemod/kubemod:v0.13.0cadca39288ad
golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904
0.52.0

Open the chart page →

3,031
wordpress-helmwordpress-helm0.2.91 of 4See more

wordpress-helm wordpress-helm 0.2.9

1 of the 4 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
aapjeisbaas/wp-frankenphp:v0.2.26b261abc7fb0
golang.org/x/crypto@v0.51.0
0.52.0

Open the chart page →

8,582
wraftwraft0.1.121 of 9See more

wraft wraft 0.1.12

1 of the 9 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2023-07-21T21-12-44Z8e5e9490cd50
golang.org/x/crypto@v0.9.0
0.52.0

Open the chart page →

9,341
redis-db-assignment-operatorwyrihaximusnetVerified publisher1.0.61 of 1See more

redis-db-assignment-operator wyrihaximusnet 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
ghcr.io/wyrihaximusnet/kubernetes-redis-db-assignment-operator:v1.0.831060be60bec
golang.org/x/crypto@v0.0.0-20220315160706-3147a52a75dd
0.52.0

Open the chart page →

2,236
prometheusalertxxl-job-adminVerified publisher1.4.01 of 1See more

prometheusalert xxl-job-admin 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
feiyu563/prometheus-alert:v4.9.28192368b0578
golang.org/x/crypto@v0.22.0
0.52.0

Open the chart page →

1,116
heistyouniqx-ossVerified publisher1.1.2091 of 1See more

heist youniqx-oss 1.1.209

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
quay.io/youniqx/heist:v1.1.209c43b3a9d98ae
golang.org/x/crypto@v0.26.0
0.52.0

Open the chart page →

806
tailscale-relayzeet0.1.51 of 1See more

tailscale-relay zeet 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
zeetdev/tailscale-relay:v1.24.21967aa2840b6
golang.org/x/crypto@v0.0.0-20220427172511-eb4f295cb31f
0.52.0

Open the chart page →

2,167
jenkinsaditisingh-jenkins1.0.01 of 1See more

jenkins aditisingh-jenkins 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

2,582
gobackupadnoctemVerified publisher0.4.01 of 1See more

gobackup adnoctem 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
huacnlee/gobackup:v3.1.1560be93229a5
golang.org/x/crypto@v0.41.0
0.52.0

Open the chart page →

1,845
popeyeadnoctemVerified publisher0.3.01 of 1See more

popeye adnoctem 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
derailed/popeye:v0.22.18e68e22c7663
golang.org/x/crypto@v0.32.0
0.52.0

Open the chart page →

1,343
uptime-kumaadnoctemVerified publisher0.4.11 of 1See more

uptime-kuma adnoctem 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
golang.org/x/crypto@v0.51.0
0.52.0

Open the chart page →

31,207
adresserviceadresservice1.1.01 of 5See more

adresservice adresservice 1.1.0

1 of the 5 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/adresservice-php:latestc5075f0320cd
golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904
0.52.0

Open the chart page →

7,460
moonaerokube1.1.372 of 3See more

moon aerokube 1.1.37

2 of the 3 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
aerokube/moon:1.9.17da76ca51220d
golang.org/x/crypto@v0.23.0
0.52.0
aerokube/selenoid-ui:1.10.113f3e299509fd
golang.org/x/crypto@v0.9.0
0.52.0

Open the chart page →

2,473
aerospike-kubernetes-operatoraerospike4.5.01 of 1See more

aerospike-kubernetes-operator aerospike 4.5.0

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
aerospike/aerospike-kubernetes-operator:4.5.070a9eeb991b8
golang.org/x/crypto@v0.51.0
0.52.0

Open the chart page →

658
aerospike-backup-serviceaerospike-helmVerified publisher2.0.131 of 1See more

aerospike-backup-service aerospike-helm 2.0.13

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
aerospike/aerospike-backup-service:3.5.1be40d709c583
golang.org/x/crypto@v0.48.0
0.52.0

Open the chart page →

637
agendaserviceagendaservice1.0.01 of 3See more

agendaservice agendaservice 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
conduction/agendaservice-php:latest9cfeeb6c7c20
golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904
0.52.0

Open the chart page →

7,220
agentkube-operatoragentkube-operator0.3.01 of 1See more

agentkube-operator agentkube-operator 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.43.0f5c29683a301
golang.org/x/crypto@v0.7.0
0.52.0

Open the chart page →

1,734
mt-channel-brokerahhhhVerified publisher0.1.03 of 3See more

mt-channel-broker ahhhh 0.1.0

3 of the 3 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
gcr.io/knative-releases/knative.dev/eventing/cmd/broker/filterdigest-pinnedd675f211a40f
golang.org/x/crypto@v0.28.0
0.52.0
gcr.io/knative-releases/knative.dev/eventing/cmd/broker/ingressdigest-pinnedec4b544499ba
golang.org/x/crypto@v0.28.0
0.52.0
gcr.io/knative-releases/knative.dev/eventing/cmd/mtchannel_brokerdigest-pinned395f4ff1bd34
golang.org/x/crypto@v0.28.0
0.52.0

Open the chart page →

2,631
airbyteairbyte-v2Verified publisher2.3.02 of 10See more

airbyte airbyte-v2 2.3.0

2 of the 10 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
airbyte/minio:RELEASE.2023-11-20T22-40-07Zfdae972eaf0e
golang.org/x/crypto@v0.14.0
0.52.0
temporalio/auto-setup:1.27.2b44cbfeb43db
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

12,223
airports-kafkaairports-kafka0.1.01 of 2See more

airports-kafka airports-kafka 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-39831.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
golang.org/x/crypto@v0.0.0-20211202192323-5770296d904e
0.52.0

Open the chart page →

4,559

Container images carrying it

2,854 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/csi-attacher:v4.10.0be59d0556508
golang.org/x/crypto@v0.38.0
0.52.0
1
registry.k8s.io/sig-storage/csi-resizer:v2.0.04a95d94e57ad
golang.org/x/crypto@v0.37.0
0.52.0
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
golang.org/x/crypto@v0.36.0
0.52.0
1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.03ce0fdba4d8e
golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975
0.52.0
1

syft 1.42.1 · advisories as of 23 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.