StackRadar

CVE-2026-4660

High

Advisory

Published 9 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
46th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
62
of 17,781 indexed, latest versions
Container images
64
deployed by those charts
Fix available
1 of 1
affected package

HashiCorp's go-getter library may allow arbitrary file reads

Carried by container images the latest versions of 62 of 17,781 indexed charts deploy, on 64 images.

Affected packageAffected versionsFixed inImages
github.com/hashicorp/go-gettergolangv1.4.0, v1.4.1, v1.5.1, v1.5.2+16 more1.8.664
OSV records
GHSA-92mm-2pjq-r785
Also known as
GO-2026-5058

Charts affected

62 by stars
ChartLatestAffected imagesRadar Score
artifact-hubartifact-hubVerified publisher1.23.02 of 7See more

artifact-hub artifact-hub 1.23.0

2 of the 7 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
aquasec/trivy:0.69.3bcc376de8d77
github.com/hashicorp/go-getter@v1.8.3
1.8.6
artifacthub/scanner:v1.23.02d8365601f0e
github.com/hashicorp/go-getter@v1.8.3
1.8.6

Open the chart page →

10,755
atlantisatlantis6.15.01 of 1See more

atlantis atlantis 6.15.0

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/runatlantis/atlantis:v0.47.1511231955463
github.com/hashicorp/go-getter@v1.7.5
1.8.6

Open the chart page →

1,891
semaphoresemaphoreuiOfficialVerified publisher16.2.21 of 1See more

semaphore semaphoreui 16.2.2

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
semaphoreui/semaphore:v2.18.3e9260bfa8255
github.com/hashicorp/go-getter@v1.7.8
1.8.6

Open the chart page →

2,221
ansible-semaphorecloudhippieVerified publisher15.2.101 of 1See more

ansible-semaphore cloudhippie 15.2.10

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
semaphoreui/semaphore:v2.19.1498ad9bc7a2a0
github.com/hashicorp/go-getter@v1.8.2
1.8.6

Open the chart page →

1,235
waypointhashicorpVerified publisher0.1.211 of 2See more

waypoint hashicorp 0.1.21

1 of the 2 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
hashicorp/waypoint:0.11.397d521a27498
github.com/hashicorp/go-getter@v1.7.0
1.8.6

Open the chart page →

4,167
celestia-appcelestia-labsVerified publisher0.5.01 of 3See more

celestia-app celestia-labs 0.5.0

1 of the 3 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-app:v3.7.0-arabica23a9ec9b1879
github.com/hashicorp/go-getter@v1.7.4
1.8.6

Open the chart page →

1,066
steampipe-powerpipe-kubernetessteampipe-powerpipe-kubernetesVerified publisher0.13.12 of 2See more

steampipe-powerpipe-kubernetes steampipe-powerpipe-kubernetes 0.13.1

2 of the 2 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--powerpipe:latesta16ab5ca10a7
github.com/hashicorp/go-getter@v1.7.9
1.8.6
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--steampipe:latestc0c8d53df9f3
github.com/hashicorp/go-getter@v1.7.9
1.8.6

Open the chart page →

5,468
helm-dashboardbeluga-cloudVerified publisher2.4.01 of 1See more

helm-dashboard beluga-cloud 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/beluga-cloud/helm-dashboard/dashboard:1.3.39ab9a675c405
github.com/hashicorp/go-getter@v1.7.2
1.8.6

Open the chart page →

2,898
celestia-nodecelestia-node0.1.71 of 1See more

celestia-node celestia-node 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-node:v0.16.041177982c584
github.com/hashicorp/go-getter@v1.7.5
1.8.6

Open the chart page →

1,799
trivy-operatordevopstalesVerified publisher2.5.01 of 1See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
devopstales/trivy-operator:2.575136aa7a26e
github.com/hashicorp/go-getter@v1.6.2
1.8.6

Open the chart page →

5,598
dockyarddockyardVerified publisher0.4.01 of 1See more

dockyard dockyard 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/kgma74/dockyard:0.4.0b40439329191
github.com/hashicorp/go-getter@v1.7.6
1.8.6

Open the chart page →

1,542
kdiffkdiff-snapshotsVerified publisher0.0.2031 of 2See more

kdiff kdiff-snapshots 0.0.203

1 of the 2 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.2035bc5ca66d55a
github.com/hashicorp/go-getter@v1.7.9
1.8.6

Open the chart page →

5,508
kdiff-snapshotskdiff-snapshotsVerified publisher0.0.551 of 1See more

kdiff-snapshots kdiff-snapshots 0.0.55

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.55d7f93d2182fe
github.com/hashicorp/go-getter@v1.7.5
1.8.6

Open the chart page →

5,789
artifact-hubsoftonic1.19.04 of 8See more

artifact-hub softonic 1.19.0

4 of the 8 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
aquasec/trivy:0.43.1944a04445179
github.com/hashicorp/go-getter@v1.7.1
1.8.6
artifacthub/hub:v1.19.0111918d8c399
github.com/hashicorp/go-getter@v1.7.5
1.8.6
artifacthub/scanner:v1.19.0323d026e78c3
github.com/hashicorp/go-getter@v1.7.5
1.8.6
artifacthub/tracker:v1.19.06596c8c4d955
github.com/hashicorp/go-getter@v1.7.5
1.8.6

Open the chart page →

14,491
stackradar-scannerstackradarVerified publisher0.3.01 of 1See more

stackradar-scanner stackradar 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/lockdep/stackradar-scanner:0.3.0dd8a35d50c2d
github.com/hashicorp/go-getter@v1.8.4
1.8.6

Open the chart page →

1,209
atlantistrozz3.12.111 of 1See more

atlantis trozz 3.12.11

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
runatlantis/atlantis:v0.16.145fbaf7e207c
github.com/hashicorp/go-getter@v1.5.1
1.8.6

Open the chart page →

5,280
guardrails-agent-kubernetesturbotVerified publisher0.3.01 of 1See more

guardrails-agent-kubernetes turbot 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/turbot/guardrails-agent-kubernetes:0.3.09d01bf9c9224
github.com/hashicorp/go-getter@v1.7.5
1.8.6

Open the chart page →

4,020
kubedb-provider-awsappscodeVerified publisher2026.7.101 of 1See more

kubedb-provider-aws appscode 2026.7.10

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/kubedb/provider-aws:v0.27.049b1c312e342
github.com/hashicorp/go-getter@v1.7.0
1.8.6

Open the chart page →

2,527
kubedb-provider-azureappscodeVerified publisher2026.7.101 of 1See more

kubedb-provider-azure appscode 2026.7.10

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/kubedb/provider-azure:v0.27.0aa0c8526ae5e
github.com/hashicorp/go-getter@v1.6.2
1.8.6

Open the chart page →

2,705
kubedb-provider-gcpappscodeVerified publisher2026.7.101 of 2See more

kubedb-provider-gcp appscode 2026.7.10

1 of the 2 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/kubedb/provider-gcp:v0.27.0a1d4cf8b8fe1
github.com/hashicorp/go-getter@v1.6.2
1.8.6

Open the chart page →

3,033
kubeform-provider-awsappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-aws appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-aws:v0.0.1e3d1f1302e49
github.com/hashicorp/go-getter@v1.6.2
1.8.6

Open the chart page →

2,796
kubeform-provider-azureappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-azure appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-azure:v0.0.1ac8459f70f85
github.com/hashicorp/go-getter@v1.6.2
1.8.6

Open the chart page →

2,716
kubeform-provider-gcpappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-gcp appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-gcp:v0.0.1af77073c184f
github.com/hashicorp/go-getter@v1.6.2
1.8.6

Open the chart page →

2,743
harbor-scanner-trivyaqua-helm0.17.01 of 1See more

harbor-scanner-trivy aqua-helm 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.20.07ea4aa3d2eb6
github.com/hashicorp/go-getter@v1.5.2
1.8.6

Open the chart page →

5,202
argonix-apiargonix0.2.01 of 4See more

argonix-api argonix 0.2.0

1 of the 4 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/argonix-io/argonix-api:1.0.068e17a8aaa40
github.com/hashicorp/go-getter@v1.7.5
1.8.6

Open the chart page →

4,923
celestia-localastria9.0.02 of 2See more

celestia-local astria 9.0.0

2 of the 2 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-app:v6.1.0-rc0a604aefa3fae
github.com/hashicorp/go-getter@v1.7.9
1.8.6
ghcr.io/celestiaorg/celestia-node:v0.27.5-mocha4768ea1c5fd2
github.com/hashicorp/go-getter@v1.7.9
1.8.6

Open the chart page →

3,281
celestia-nodeastria0.7.11 of 1See more

celestia-node astria 0.7.1

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-node:v0.27.5-mocha4768ea1c5fd2
github.com/hashicorp/go-getter@v1.7.9
1.8.6

Open the chart page →

1,502
botkubeaveshaVerified publisher1.0.01 of 2See more

botkube avesha 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/kubeshop/botkube:v1.0.0669e27a5d1af
github.com/hashicorp/go-getter@v1.7.0
1.8.6

Open the chart page →

5,074
terraboardcamptocamp32.4.01 of 1See more

terraboard camptocamp3 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/camptocamp/terraboard:v2.3.0df53e2c8998c
github.com/hashicorp/go-getter@v1.7.3
1.8.6

Open the chart page →

1,330
ibm-toolkit-installcloud-native-toolkit0.3.01 of 1See more

ibm-toolkit-install cloud-native-toolkit 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
github.com/hashicorp/go-getter@v1.5.2
1.8.6

Open the chart page →

6,695
iteration-zerocloud-native-toolkit0.2.01 of 1See more

iteration-zero cloud-native-toolkit 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
quay.io/cloudnativetoolkit/cli-tools:v1.1-v1.8.2d6fd2a9e3273
github.com/hashicorp/go-getter@v1.5.7
1.8.6

Open the chart page →

6,921
devtron-enterprisedevtron48.0.01 of 28See more

devtron-enterprise devtron 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/hashicorp/go-getter@v1.7.2
1.8.6

Open the chart page →

68,240
devtron-enterprisedevtron-labs48.0.01 of 28See more

devtron-enterprise devtron-labs 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/hashicorp/go-getter@v1.7.2
1.8.6

Open the chart page →

68,240
fickyhelmappfickyhelmapp1.1.01 of 1See more

fickyhelmapp fickyhelmapp 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
tundeficky/nodejs-app:v1.0.03cf9a9ce54e8
github.com/hashicorp/go-getter@v1.5.4
1.8.6

Open the chart page →

3,311
apm-hubflanksourceVerified publisher0.0.471 of 2See more

apm-hub flanksource 0.0.47

1 of the 2 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
flanksource/apm-hub:v0.0.471dacc3195bf9
github.com/hashicorp/go-getter@v1.7.1
1.8.6

Open the chart page →

6,078
harborgpg-dev1.18.31 of 8See more

harbor gpg-dev 1.18.3

1 of the 8 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.14.35c6f7162804c
github.com/hashicorp/go-getter@v1.8.3
1.8.6

Open the chart page →

3,376
steampipehelm-steampipeVerified publisher2.4.11 of 1See more

steampipe helm-steampipe 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/devops-ia/steampipe:v2.4.1a982103d91d3
github.com/hashicorp/go-getter@v1.7.9
1.8.6

Open the chart page →

3,124
hetzner-dyndnsitsmethemojoVerified publisher1.4.01 of 1See more

hetzner-dyndns itsmethemojo 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
hashicorp/terraform:1.9.7b77efab1a448
github.com/hashicorp/go-getter@v1.7.5
1.8.6

Open the chart page →

1,836
jx-app-datadogjenkins-x0.0.101 of 2See more

jx-app-datadog jenkins-x 0.0.10

1 of the 2 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
datadog/agent:6aad9994de6a7
github.com/hashicorp/go-getter@v1.7.4
1.8.6

Open the chart page →

3,999
deploydefenderk8s-custom-controllerVerified publisher0.1.31 of 1See more

deploydefender k8s-custom-controller 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/manzil-infinity180/deploydefender:ea3ab0bb646cdbeddd1aca483ecf650f9ac0d0847fbc6855c8b3
github.com/hashicorp/go-getter@v1.7.5
1.8.6

Open the chart page →

1,893
pipecdkrzwiatrzyk0.39.01 of 3See more

pipecd krzwiatrzyk 0.39.0

1 of the 3 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/pipe-cd/pipecd:v0.39.00fae829caf29
github.com/hashicorp/go-getter@v1.4.0
1.8.6

Open the chart page →

3,812
kubecheckskubechecks3.0.01 of 1See more

kubechecks kubechecks 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/zapier/kubechecks:latest60cea46ce830
github.com/hashicorp/go-getter@v1.8.3
1.8.6

Open the chart page →

548
kubeclaritykubeclarity2.23.31 of 5See more

kubeclarity kubeclarity 2.23.3

1 of the 5 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/openclarity/grype-server:v0.6.079412399f301
github.com/hashicorp/go-getter@v1.7.2
1.8.6

Open the chart page →

5,496
harborkubesphereVerified publisher1.9.31 of 11See more

harbor kubesphere 1.9.3

1 of the 11 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
github.com/hashicorp/go-getter@v1.6.2
1.8.6

Open the chart page →

17,798
kusionkusionstackVerified publisher0.14.11 of 3See more

kusion kusionstack 0.14.1

1 of the 3 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
kusionstack/kusion:v0.14.0126c8f0b0976
github.com/hashicorp/go-getter@v1.7.6
1.8.6

Open the chart page →

6,824
cachelavaOfficialVerified publisher1.1.11 of 1See more

cache lava 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/lavanet/lava/lavap:v2.5.089028adefcff
github.com/hashicorp/go-getter@v1.7.5
1.8.6

Open the chart page →

1,378
trivy-serverlemontechVerified publisher0.1.01 of 1See more

trivy-server lemontech 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
aquasec/trivy:0.32.0973d0df16189
github.com/hashicorp/go-getter@v1.6.2
1.8.6

Open the chart page →

4,271
m9sweeperm9sweeperVerified publisher1.6.01 of 6See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/m9sweeper/trawler:1.6.0df917c5a7e54
github.com/hashicorp/go-getter@v1.7.2
1.8.6

Open the chart page →

9,774
myhelmappmyhelmapp0.1.11 of 1See more

myhelmapp myhelmapp 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
tobirachel/node-project3:v17d9f37154994
github.com/hashicorp/go-getter@v1.5.4
1.8.6

Open the chart page →

3,359
cosmoshub-rpcnodeifyVerified publisher1.0.71 of 2See more

cosmoshub-rpc nodeify 1.0.7

1 of the 2 container images this version deploys carry CVE-2026-4660.

Container imageDigestPackageFixed in
ghcr.io/cosmos/gaia:v25.1.0f115777d1112
github.com/hashicorp/go-getter@v1.7.8
1.8.6

Open the chart page →

2,006

Container images carrying it

64 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/manzil-infinity180/deploydefender:ea3ab0bb646cdbeddd1aca483ecf650f9ac0d0847fbc6855c8b3
github.com/hashicorp/go-getter@v1.7.5
1.8.6
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.2035bc5ca66d55a
github.com/hashicorp/go-getter@v1.7.9
1.8.6
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.55d7f93d2182fe
github.com/hashicorp/go-getter@v1.7.5
1.8.6
1
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--powerpipe:latesta16ab5ca10a7
github.com/hashicorp/go-getter@v1.7.9
1.8.6
1
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--steampipe:latestc0c8d53df9f3
github.com/hashicorp/go-getter@v1.7.9
1.8.6
1
ghcr.io/openclarity/grype-server:v0.6.079412399f301
github.com/hashicorp/go-getter@v1.7.2
1.8.6
1
ghcr.io/pipe-cd/pipecd:v0.39.00fae829caf29
github.com/hashicorp/go-getter@v1.4.0
1.8.6
1
ghcr.io/runatlantis/atlantis:v0.47.1511231955463
github.com/hashicorp/go-getter@v1.7.5
1.8.6
1
ghcr.io/turbot/guardrails-agent-kubernetes:0.3.09d01bf9c9224
github.com/hashicorp/go-getter@v1.7.5
1.8.6
1
ghcr.io/zapier/kubechecks:latest60cea46ce830
github.com/hashicorp/go-getter@v1.8.3
1.8.6
1
quay.io/cloudnativetoolkit/cli-tools:v1.1-v1.8.2d6fd2a9e3273
github.com/hashicorp/go-getter@v1.5.7
1.8.6
1
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
github.com/hashicorp/go-getter@v1.5.2
1.8.6
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
github.com/hashicorp/go-getter@v1.5.10
1.8.6
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
github.com/hashicorp/go-getter@v1.5.2
1.8.6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.