StackRadar

CVE-2026-40611

High

Advisory

Published 16 Apr 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.8
base score, highest
EPSS
0.003
27th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
35
of 17,781 indexed, latest versions
Container images
32
deployed by those charts
Fix available
1 of 3
affected packages

ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider

Carried by container images the latest versions of 35 of 17,781 indexed charts deploy, on 32 images.

Affected packageAffected versionsFixed inImages
github.com/go-acme/lego/v4golangv4.3.1, v4.4.0, v4.5.0, v4.5.3+10 more4.34.022
github.com/go-acme/lego/v3golangv3.1.0, v3.5.0, v3.7.0, v3.8.0+1 moreno fix listed8
github.com/go-acme/legogolangv2.5.0+incompatibleno fix listed2
OSV records
GHSA-qqx8-2xmm-jrv8
Also known as
GO-2026-5593

Charts affected

35 by stars
ChartLatestAffected imagesRadar Score
ambassadordatawire6.9.51 of 2See more

ambassador datawire 6.9.5

1 of the 2 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
github.com/go-acme/lego/v3@v3.1.0
no fix listed

Open the chart page →

4,086
edge-stackdatawire7.1.8-ea1 of 2See more

edge-stack datawire 7.1.8-ea

1 of the 2 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
datawire/aes:2.0.3-ea07f8fe4f4f8e
github.com/go-acme/lego/v3@v3.1.0
no fix listed

Open the chart page →

5,173
waypointhashicorpVerified publisher0.1.211 of 2See more

waypoint hashicorp 0.1.21

1 of the 2 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
hashicorp/waypoint:0.11.397d521a27498
github.com/go-acme/lego/v3@v3.5.0
no fix listed

Open the chart page →

4,167
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
library/traefik:v2.11.00a5157f742d2
github.com/go-acme/lego/v4@v4.15.0
4.34.0

Open the chart page →

17,245
fadicetic0.3.11 of 25See more

fadi cetic 0.3.1

1 of the 25 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
library/traefik:2.5.47d0228d19042
github.com/go-acme/lego/v4@v4.5.0
4.34.0

Open the chart page →

52,919
daskhubdask2024.1.11 of 9See more

daskhub dask 2024.1.1

1 of the 9 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
library/traefik:2.10.61957e3314f43
github.com/go-acme/lego/v4@v4.14.0
4.34.0

Open the chart page →

14,094
statpinggeek-cookbookVerified publisher6.2.01 of 2See more

statping geek-cookbook 6.2.0

1 of the 2 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
statping/statping:v0.90.74e874da513a5c
github.com/go-acme/lego/v3@v3.7.0
no fix listed

Open the chart page →

3,371
forecastlestakaterVerified publisher2.1.11 of 1See more

forecastle stakater 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
stakater/forecastle:v2.0.2382cd9572352
github.com/go-acme/lego/v4@v4.30.1
4.34.0

Open the chart page →

712
maeshtraefikOfficialVerified publisher2.1.21 of 7See more

maesh traefik 2.1.2

1 of the 7 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
containous/maesh:v1.3.2587162516502
github.com/go-acme/lego/v3@v3.8.0
no fix listed

Open the chart page →

4,136
traefik-meshtraefikOfficialVerified publisher4.1.12 of 7See more

traefik-mesh traefik 4.1.1

2 of the 7 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
library/traefik:v2.57d5a6ae66572
github.com/go-acme/lego/v4@v4.6.0
4.34.0
traefik/mesh:v1.4.8cf071f3e165c
github.com/go-acme/lego/v4@v4.7.0
4.34.0

Open the chart page →

9,257
cosmo-controller-managercosmoVerified publisher0.9.01 of 2See more

cosmo-controller-manager cosmo 0.9.0

1 of the 2 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
ghcr.io/cosmo-workspace/cosmo-controller-manager:v0.9.08c7fa5552028
github.com/go-acme/lego/v4@v4.10.2
4.34.0

Open the chart page →

1,927
cosmo-dashboardcosmoVerified publisher0.9.11 of 1See more

cosmo-dashboard cosmo 0.9.1

1 of the 1 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
ghcr.io/cosmo-workspace/cosmo-dashboard:v0.9.16a1c4a81a924
github.com/go-acme/lego/v4@v4.10.2
4.34.0

Open the chart page →

1,939
filebrowsergeek-cookbookVerified publisher1.4.21 of 1See more

filebrowser geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.18.04fcd47af573c
github.com/go-acme/lego@v2.5.0+incompatible
no fix listed

Open the chart page →

3,474
voice-biometricslumenvox2.0.11 of 26See more

voice-biometrics lumenvox 2.0.1

1 of the 26 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
library/traefik:v2.57d5a6ae66572
github.com/go-acme/lego/v4@v4.6.0
4.34.0

Open the chart page →

70,741
statpingstatping0.1.141 of 1See more

statping statping 0.1.14

1 of the 1 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
statping/statping:v0.90.74e874da513a5c
github.com/go-acme/lego/v3@v3.7.0
no fix listed

Open the chart page →

3,371
switchboardswitchboardVerified publisher0.7.41 of 1See more

switchboard switchboard 0.7.4

1 of the 1 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
ghcr.io/borchero/switchboard:0.7.454a193b757da
github.com/go-acme/lego/v4@v4.33.0
4.34.0

Open the chart page →

839
traefik-hubtraefikOfficialVerified publisher4.2.01 of 1See more

traefik-hub traefik 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
ghcr.io/traefik/traefik-hub:v2.11.0322f5f8cc105
github.com/go-acme/lego/v4@v4.14.2
4.34.0

Open the chart page →

3,165
ambassadorazureorkestra6.7.91 of 2See more

ambassador azureorkestra 6.7.9

1 of the 2 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
datawire/aes:1.13.62beb65062c8b
github.com/go-acme/lego/v3@v3.1.0
no fix listed

Open the chart page →

5,521
ociscosmicrocks0.7.01 of 2See more

ocis cosmicrocks 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
owncloud/ocis:7.1.388e7c854517d
github.com/go-acme/lego/v4@v4.4.0
4.34.0

Open the chart page →

1,925
cosmo-traefikcosmoVerified publisher0.9.11 of 2See more

cosmo-traefik cosmo 0.9.1

1 of the 2 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
library/traefik:v2.10.11489caffaedb
github.com/go-acme/lego/v4@v4.10.2
4.34.0

Open the chart page →

3,672
dask-gatewaydask2026.3.01 of 2See more

dask-gateway dask 2026.3.0

1 of the 2 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
library/traefik:3.3.5104204dadedf
github.com/go-acme/lego/v4@v4.22.2
4.34.0

Open the chart page →

1,994
traefikgpg-dev39.0.81 of 1See more

traefik gpg-dev 39.0.8

1 of the 1 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
library/traefik:v3.6.1334d5089d0b41
github.com/go-acme/lego/v4@v4.33.0
4.34.0

Open the chart page →

1,274
opencloudhelmforgeVerified publisher1.0.01 of 1See more

opencloud helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
opencloudeu/opencloud:7.2.46d992ccc5f1c
github.com/go-acme/lego/v4@v4.4.0
4.34.0

Open the chart page →

663
opencloudjacobcolvinVerified publisher0.2.31 of 13See more

opencloud jacobcolvin 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
opencloudeu/opencloud-rolling:2.1.0f9634bb04905
github.com/go-acme/lego/v4@v4.4.0
4.34.0

Open the chart page →

45,239
traefik2mesosphere9.18.01 of 1See more

traefik2 mesosphere 9.18.0

1 of the 1 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
library/traefik:2.4.8eda951fd29a8
github.com/go-acme/lego/v4@v4.3.1
4.34.0

Open the chart page →

3,341
webspacednetsocVerified publisher0.2.81 of 2See more

webspaced netsoc 0.2.8

1 of the 2 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
ghcr.io/netsoc/webspaced:0.5.1edc238a538a0
github.com/go-acme/lego/v4@v4.4.0
4.34.0

Open the chart page →

5,193
ocisocis-community0.1.01 of 1See more

ocis ocis-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
owncloud/ocis:8.0.1b38fd8fdd58f
github.com/go-acme/lego/v4@v4.25.2
4.34.0

Open the chart page →

2,346
ed-traefikscaleway-charts0.2.01 of 1See more

ed-traefik scaleway-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
library/traefik:v1.7.345d47b7bb2546
github.com/go-acme/lego/v4@v4.5.3
4.34.0

Open the chart page →

2,133
ed-traefik2scaleway-charts0.2.01 of 1See more

ed-traefik2 scaleway-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
library/traefik:2.5.62f603f8d3abe
github.com/go-acme/lego/v4@v4.5.3
4.34.0

Open the chart page →

3,160
cert-manager-webhook-cloudnsschichtelVerified publisher1.2.01 of 1See more

cert-manager-webhook-cloudns schichtel 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
ghcr.io/pschichtel/cert-manager-webhook-cloudns:1.1.01020638bbe23
github.com/go-acme/lego/v4@v4.15.0
4.34.0

Open the chart page →

1,396
ambassador-manifestssqream-chartsVerified publisher0.6.31 of 1See more

ambassador-manifests sqream-charts 0.6.3

1 of the 1 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
datawire/aes:3.11.195ec30b3c732
github.com/go-acme/lego/v3@v3.9.0
no fix listed

Open the chart page →

2,416
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
opencloudeu/opencloud-rolling:2.1.0f9634bb04905
github.com/go-acme/lego/v4@v4.4.0
4.34.0

Open the chart page →

45,239
ambassadorwenerme6.9.51 of 2See more

ambassador wenerme 6.9.5

1 of the 2 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
github.com/go-acme/lego/v3@v3.1.0
no fix listed

Open the chart page →

4,086
filebrowserwenerme1.0.01 of 1See more

filebrowser wenerme 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.13.0c5d0a75a0041
github.com/go-acme/lego@v2.5.0+incompatible
no fix listed

Open the chart page →

3,174
traefikwenerme9.1.11 of 1See more

traefik wenerme 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-40611.

Container imageDigestPackageFixed in
library/traefik:2.2.8f5af5a5ce17f
github.com/go-acme/lego/v3@v3.8.0
no fix listed

Open the chart page →

3,369

Container images carrying it

32 by charts deploying them

A fixed version is listed for 1 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
datawire/aes:1.14.48588eafe6862
github.com/go-acme/lego/v3@v3.1.0
no fix listed
2
library/traefik:v2.57d5a6ae66572
github.com/go-acme/lego/v4@v4.6.0
4.34.0
2
opencloudeu/opencloud-rolling:2.1.0f9634bb04905
github.com/go-acme/lego/v4@v4.4.0
4.34.0
2
statping/statping:v0.90.74e874da513a5c
github.com/go-acme/lego/v3@v3.7.0
no fix listed
2
containous/maesh:v1.3.2587162516502
github.com/go-acme/lego/v3@v3.8.0
no fix listed
1
datawire/aes:2.0.3-ea07f8fe4f4f8e
github.com/go-acme/lego/v3@v3.1.0
no fix listed
1
datawire/aes:1.13.62beb65062c8b
github.com/go-acme/lego/v3@v3.1.0
no fix listed
1
datawire/aes:3.11.195ec30b3c732
github.com/go-acme/lego/v3@v3.9.0
no fix listed
1
filebrowser/filebrowser:v2.18.04fcd47af573c
github.com/go-acme/lego@v2.5.0+incompatible
no fix listed
1
filebrowser/filebrowser:v2.13.0c5d0a75a0041
github.com/go-acme/lego@v2.5.0+incompatible
no fix listed
1
hashicorp/waypoint:0.11.397d521a27498
github.com/go-acme/lego/v3@v3.5.0
no fix listed
1
library/traefik:v2.11.00a5157f742d2
github.com/go-acme/lego/v4@v4.15.0
4.34.0
1
library/traefik:3.3.5104204dadedf
github.com/go-acme/lego/v4@v4.22.2
4.34.0
1
library/traefik:v2.10.11489caffaedb
github.com/go-acme/lego/v4@v4.10.2
4.34.0
1
library/traefik:2.10.61957e3314f43
github.com/go-acme/lego/v4@v4.14.0
4.34.0
1
library/traefik:2.5.62f603f8d3abe
github.com/go-acme/lego/v4@v4.5.3
4.34.0
1
library/traefik:v3.6.1334d5089d0b41
github.com/go-acme/lego/v4@v4.33.0
4.34.0
1
library/traefik:v1.7.345d47b7bb2546
github.com/go-acme/lego/v4@v4.5.3
4.34.0
1
library/traefik:2.5.47d0228d19042
github.com/go-acme/lego/v4@v4.5.0
4.34.0
1
library/traefik:2.4.8eda951fd29a8
github.com/go-acme/lego/v4@v4.3.1
4.34.0
1
library/traefik:2.2.8f5af5a5ce17f
github.com/go-acme/lego/v3@v3.8.0
no fix listed
1
opencloudeu/opencloud:7.2.46d992ccc5f1c
github.com/go-acme/lego/v4@v4.4.0
4.34.0
1
owncloud/ocis:7.1.388e7c854517d
github.com/go-acme/lego/v4@v4.4.0
4.34.0
1
owncloud/ocis:8.0.1b38fd8fdd58f
github.com/go-acme/lego/v4@v4.25.2
4.34.0
1
stakater/forecastle:v2.0.2382cd9572352
github.com/go-acme/lego/v4@v4.30.1
4.34.0
1
traefik/mesh:v1.4.8cf071f3e165c
github.com/go-acme/lego/v4@v4.7.0
4.34.0
1
ghcr.io/borchero/switchboard:0.7.454a193b757da
github.com/go-acme/lego/v4@v4.33.0
4.34.0
1
ghcr.io/cosmo-workspace/cosmo-controller-manager:v0.9.08c7fa5552028
github.com/go-acme/lego/v4@v4.10.2
4.34.0
1
ghcr.io/cosmo-workspace/cosmo-dashboard:v0.9.16a1c4a81a924
github.com/go-acme/lego/v4@v4.10.2
4.34.0
1
ghcr.io/netsoc/webspaced:0.5.1edc238a538a0
github.com/go-acme/lego/v4@v4.4.0
4.34.0
1
ghcr.io/pschichtel/cert-manager-webhook-cloudns:1.1.01020638bbe23
github.com/go-acme/lego/v4@v4.15.0
4.34.0
1
ghcr.io/traefik/traefik-hub:v2.11.0322f5f8cc105
github.com/go-acme/lego/v4@v4.14.2
4.34.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.