CVE-2026-41568
MediumAdvisory
Published 18 May 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.1
- base score, highest
- EPSS
- 0.001
- 1st percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 587
- of 17,787 indexed, latest versions
- Container images
- 578
- deployed by those charts
- Fix available
- 1 of 3
- affected packages
Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap
Carried by container images the latest versions of 587 of 17,787 indexed charts deploy, on 578 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v0.0.0-20180620051407-e2593239d949, v0.7.3-0.20190327010347-be7ac8be2ae0, v1.4.2-0.20190924003213-a8608b5b67c7, v1.4.2-0.20191121165722-d1d5f6476656+84 more | no fix listed | 553 |
| github.com/ | v0.7.3-0.20190826074503-38ab9da00309, v1.4.2-0.20170731201646-1009e6a40b29, v1.13.1, v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible+4 more | no fix listed | 30 |
| docker.iodeb | 20.10.24+dfsg1-1+deb12u1+b6, 26.1.5+dfsg1-9+b13 | 26.1.5+dfsg1-9+deb13u1 | 2 |
- OSV records
- DEBIAN-CVE-2026-41568GHSA-vp62-88p7-qqf5
- Also known as
- GO-2026-5668
Charts affected
587 by stars
Container images carrying it
578 by charts deploying them
A fixed version is listed for 1 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | f681e0343a31 | github.com/ | no fix listed | 1 |
| ghcr.io/ | 3491a0f31c4a | github.com/ | no fix listed | 1 |
| ghcr.io/ | 00131e3d1eaf | github.com/ | no fix listed | 1 |
| ghcr.io/ | 9f157fe035f1 | github.com/ | no fix listed | 1 |
| ghcr.io/ | 322f5f8cc105 | github.com/ | no fix listed | 1 |
| ghcr.io/ | 9d01bf9c9224 | github.com/ | no fix listed | 1 |
| ghcr.io/ | 23f4da194134 | github.com/ | no fix listed | 1 |
| ghcr.io/ | 21715979aefa | github.com/ | no fix listed | 1 |
| ghcr.io/ | 49800ff775f3 | github.com/ | no fix listed | 1 |
| public.ecr.aws/ | 1eb61443d68e | github.com/ | no fix listed | 1 |
| public.ecr.aws/ | 8aa9ea5f67b8 | github.com/ | no fix listed | 1 |
| public.ecr.aws/ | 01d8413d5075 | github.com/ | no fix listed | 1 |
| public.ecr.aws/ | f4925b15ce94 | github.com/ | no fix listed | 1 |
| public.ecr.aws/ | e8014c6c58b6 | github.com/ | no fix listed | 1 |
| public.ecr.aws/ | e97e0e7a2088 | github.com/ | no fix listed | 1 |
| public.ecr.aws/ | 651739583336 | github.com/ | no fix listed | 1 |
| quay.io/ | 5b6701d8fb31 | github.com/ | no fix listed | 1 |
| quay.io/ | 95b5cf7ba6fe | github.com/ | no fix listed | 1 |
| quay.io/ | acaf37352569 | github.com/ | no fix listed | 1 |
| quay.io/ | 6ab0da144235 | github.com/ | no fix listed | 1 |
| quay.io/ | 14b482c1f1b8 | github.com/ | no fix listed | 1 |
| quay.io/ | d6fd2a9e3273 | github.com/ | no fix listed | 1 |
| quay.io/ | 13aaae779248 | github.com/ | no fix listed | 1 |
| quay.io/ | 0885ab519dac | github.com/ | no fix listed | 1 |
| quay.io/ | a3b9a07648b6 | github.com/ | no fix listed | 1 |
| quay.io/ | 3590af73f65a | github.com/ | no fix listed | 1 |
| quay.io/ | 63baf86a49ac | github.com/ | no fix listed | 1 |
| quay.io/ | d78cd113b2bc | github.com/ | no fix listed | 1 |
| quay.io/ | b741efae8d31 | github.com/ | no fix listed | 1 |
| quay.io/ | 9663f06adcb1 | github.com/ | no fix listed | 1 |
| quay.io/ | cc79b9e2a1c8 | github.com/ | no fix listed | 1 |
| quay.io/ | 4d9fce2c050e | github.com/ | no fix listed | 1 |
| quay.io/ | 595c548dee6f | github.com/ | no fix listed | 1 |
| quay.io/ | 81b2d775edad | github.com/ | no fix listed | 1 |
| quay.io/ | 8d54fe9d0c0d | github.com/ | no fix listed | 1 |
| quay.io/ | e045b26eb6df | github.com/ | no fix listed | 1 |
| quay.io/ | ec6ab507c5da | github.com/ | no fix listed | 1 |
| quay.io/ | 34de6387233b | github.com/ | no fix listed | 1 |
| quay.io/ | ebba936046ab | github.com/ | no fix listed | 1 |
| quay.io/ | 58651dce3376 | github.com/ | no fix listed | 1 |
| quay.io/ | 9bed2f723ea0 | github.com/ | no fix listed | 1 |
| quay.io/ | 2044ed750f5e | github.com/ github.com/ | no fix listed no fix listed | 1 |
| quay.io/ | 01b2694425e9 | github.com/ github.com/ | no fix listed no fix listed | 1 |
| quay.io/ | 01f2b053ace1 | github.com/ | no fix listed | 1 |
| quay.io/ | edb322094359 | github.com/ | no fix listed | 1 |
| quay.io/ | 65a38180e27a | github.com/ | no fix listed | 1 |
| quay.io/ | b5f5bd4efbee | github.com/ | no fix listed | 1 |
| quay.io/ | 3e010e1188f1 | github.com/ | no fix listed | 1 |
| quay.io/ | 6722d5041b47 | github.com/ | no fix listed | 1 |
| quay.io/ | 0bbe8b451fa3 | github.com/ | no fix listed | 1 |