StackRadar

CVE-2026-50163

High

Advisory

Published 1 Jul 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.1
base score, highest
EPSS
0.003
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
132
of 17,781 indexed, latest versions
Container images
124
deployed by those charts
Fix available
1 of 1
affected package

`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution

Carried by container images the latest versions of 132 of 17,781 indexed charts deploy, on 124 images.

Affected packageAffected versionsFixed inImages
oras.land/oras-go/v2golangv2.0.0, v2.0.2, v2.2.0, v2.3.0+5 more2.6.2124
OSV records
GHSA-fxhp-mv3v-67qp
Also known as
GO-2026-5880

Charts affected

132 by stars
ChartLatestAffected imagesRadar Score
argocd-extra-app-info-exportermikejohVerified publisher0.1.121 of 1See more

argocd-extra-app-info-exporter mikejoh 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
mikejoh/argocd-extra-app-info-exporter:0.2.05c5a3b734271
oras.land/oras-go/v2@v2.5.0
2.6.2

Open the chart page →

1,334
agent-controlnewrelic0.0.921 of 1See more

agent-control newrelic 0.0.92

1 of the 1 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
newrelic/newrelic-agent-control-cli:0.48.01a448492b55a
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

3,843
agent-control-bootstrapnewrelic1.8.161 of 1See more

agent-control-bootstrap newrelic 1.8.16

1 of the 1 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
newrelic/newrelic-agent-control-cli:1.24.047520b65d6b2
oras.land/oras-go/v2@v2.6.1
2.6.2

Open the chart page →

920
agent-control-cdnewrelic1.0.01 of 3See more

agent-control-cd newrelic 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
ghcr.io/fluxcd/source-controller:v1.5.000cd9316a379
oras.land/oras-go/v2@v2.5.0
2.6.2

Open the chart page →

5,034
gpu-operatornvidia-gpu-operator26.7.01 of 2See more

gpu-operator nvidia-gpu-operator 26.7.0

1 of the 2 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
registry.k8s.io/nfd/node-feature-discovery:v0.19.02fa1c99ad09b
oras.land/oras-go/v2@v2.6.1
2.6.2

Open the chart page →

207
lensoci-ai-incubations0.1.141 of 16See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
alpine/k8s:1.31.106dbe6f391eda
oras.land/oras-go/v2@v2.5.0
2.6.2

Open the chart page →

17,070
argocd-agent-addonocm-helm-chartsVerified publisher0.29.01 of 2See more

argocd-agent-addon ocm-helm-charts 0.29.0

1 of the 2 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-operator:v0.18.0a09814522a72
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

626
octantoctant0.1.861 of 1See more

octant octant 0.1.86

1 of the 1 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
ghcr.io/mydecisive/octant:0.1.86ebbd44abae6c
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

535
opa-nginxopa-nginx0.0.31 of 2See more

opa-nginx opa-nginx 0.0.3

1 of the 2 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
openpolicyagent/opa:0.53.16a58dea59933
oras.land/oras-go/v2@v2.2.0
2.6.2

Open the chart page →

2,167
harikubeopenshift0.16.31 of 3See more

harikube openshift 0.16.3

1 of the 3 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
oras.land/oras-go/v2@v2.5.0
2.6.2

Open the chart page →

2,525
kb-cloud-installeropenshift2.1.351 of 1See more

kb-cloud-installer openshift 2.1.35

1 of the 1 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

4,127
redhat-trusted-application-pipelineopenshift1.0.21 of 2See more

redhat-trusted-application-pipeline openshift 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
oras.land/oras-go/v2@v2.3.0
2.6.2

Open the chart page →

8,599
operator-lifecycle-manageroperator-lifecycle-manager1.2.22 of 2See more

operator-lifecycle-manager operator-lifecycle-manager 1.2.2

2 of the 2 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
quay.io/operator-framework/catalogd:v1.8.06ff40fa6257f
oras.land/oras-go/v2@v2.6.0
2.6.2
quay.io/operator-framework/operator-controller:v1.8.0bca5dfcc67ca
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

1,821
planectlplanectlVerified publisher0.7.01 of 10See more

planectl planectl 0.7.0

1 of the 10 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.14.115fc69e31c755
oras.land/oras-go/v2@v2.5.0
2.6.2

Open the chart page →

25,934
tenant-namespace-operatorpnnl-miscscripts0.1.281 of 1See more

tenant-namespace-operator pnnl-miscscripts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

12,754
prismeai-appsprismeai0.7.11 of 4See more

prismeai-apps prismeai 0.7.1

1 of the 4 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

2,751
prismeai-coreprismeai1.12.11 of 7See more

prismeai-core prismeai 1.12.1

1 of the 7 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

3,270
headlampradar-baseVerified publisher1.0.01 of 1See more

headlamp radar-base 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
ghcr.io/headlamp-k8s/headlamp:v0.43.05d03caa26df7
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

613
rancher-auto-registerrancher-auto-registerVerified publisher0.1.01 of 1See more

rancher-auto-register rancher-auto-register 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

1,837
devtron-enterpriseromholdings48.0.04 of 28See more

devtron-enterprise romholdings 48.0.0

4 of the 28 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
quay.io/devtron/chart-sync:94237c18-1021-3941960566529446a
oras.land/oras-go/v2@v2.6.0
2.6.2
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
oras.land/oras-go/v2@v2.6.0
2.6.2
quay.io/devtron/kubelink:94237c18-314-394179d25865295af
oras.land/oras-go/v2@v2.6.0
2.6.2
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

68,240
devtron-operatorromholdings0.23.33 of 11See more

devtron-operator romholdings 0.23.3

3 of the 11 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
quay.io/devtron/chart-sync:3b3d6d0e-836-39296721b5c9634d4
oras.land/oras-go/v2@v2.6.0
2.6.2
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
oras.land/oras-go/v2@v2.6.0
2.6.2
quay.io/devtron/kubelink:09867a9c-564-39289ea6dd1e4ce71
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

32,902
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

5,819
orbitalryuunosukeds30.2.01 of 1See more

orbital ryuunosukeds3 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
ryuunosukeds3/orbital:latest0879f7261b10
oras.land/oras-go/v2@v2.5.0
2.6.2

Open the chart page →

2,620
semaphoresemaphore-light1.0.01 of 1See more

semaphore semaphore-light 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
semaphoreui/semaphore:latest3996804607eb
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

1,674
loggensikalabs0.1.01 of 1See more

loggen sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
sikalabs/slu:v0.72.07bd267f30247
oras.land/oras-go/v2@v2.3.0
2.6.2

Open the chart page →

2,314
orchestratremolo3.1.551 of 5See more

orchestra tremolo 3.1.55

1 of the 5 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
ghcr.io/headlamp-k8s/headlamp:v0.42.0c9754bae1d79
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

7,637
trident-protecttrident-protect100.2606.01 of 2See more

trident-protect trident-protect 100.2606.0

1 of the 2 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
netapp/trident-protect-utils:v2.0.0cd0c18d8f9ec
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

1,331
trident-protect-consoletrident-protect100.2608.0-console1 of 3See more

trident-protect-console trident-protect 100.2608.0-console

1 of the 3 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
netapp/trident-protect-utils:v2.0.0cd0c18d8f9ec
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

1,322
vals-operatorvals-operatorVerified publisher0.8.11 of 1See more

vals-operator vals-operator 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
ghcr.io/digitalis-io/vals-operator:v0.8.17c776499b8c9
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

696
harborwenerme1.19.21 of 8See more

harbor wenerme 1.19.2

1 of the 8 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

1,650
mesherywenerme1.0.691 of 1See more

meshery wenerme 1.0.69

1 of the 1 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
meshery/meshery:stable-latest9b68e81d392e
oras.land/oras-go/v2@v2.6.0
2.6.2

Open the chart page →

1,407
rancherwenerme2.15.11 of 2See more

rancher wenerme 2.15.1

1 of the 2 container images this version deploys carry CVE-2026-50163.

Container imageDigestPackageFixed in
rancher/shell:v0.8.1f293af9c635f
oras.land/oras-go/v2@v2.6.1
2.6.2

Open the chart page →

1,456

Container images carrying it

124 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/peak-scale/capsule-argo-addon:0.7.5087a80163971
oras.land/oras-go/v2@v2.6.0
2.6.2
1
ghcr.io/runatlantis/atlantis:v0.47.1511231955463
oras.land/oras-go/v2@v2.6.0
2.6.2
1
ghcr.io/zapier/kubechecks:latest60cea46ce830
oras.land/oras-go/v2@v2.6.1
2.6.2
1
quay.io/argoproj/argocd:v3.5.10deb1a1c9176
oras.land/oras-go/v2@v2.6.1
2.6.2
1
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
oras.land/oras-go/v2@v2.5.0
2.6.2
1
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
oras.land/oras-go/v2@v2.6.0
2.6.2
1
quay.io/argoproj/argocd:v2.8.6acaf37352569
oras.land/oras-go/v2@v2.2.0
2.6.2
1
quay.io/argoprojlabs/argocd-image-updater:v1.2.13c56f354fac5
oras.land/oras-go/v2@v2.6.0
2.6.2
1
quay.io/argoprojlabs/argocd-operator:v0.18.0a09814522a72
oras.land/oras-go/v2@v2.6.0
2.6.2
1
quay.io/argoprojlabs/argocd-rbac-operator:v0.2.451dded00137a
oras.land/oras-go/v2@v2.5.0
2.6.2
1
quay.io/fiware/waltid:1.14.1-SNAPSHOT93889c3d8a34
oras.land/oras-go/v2@v2.0.0
2.6.2
1
quay.io/gogatekeeper/gatekeeper:4.9.0dcf583aba224
oras.land/oras-go/v2@v2.6.0
2.6.2
1
quay.io/go-skynet/local-ai:latestd78cd113b2bc
oras.land/oras-go/v2@v2.6.0
2.6.2
1
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
oras.land/oras-go/v2@v2.5.0
2.6.2
1
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
oras.land/oras-go/v2@v2.2.0
2.6.2
1
quay.io/manusa/kubernetes_mcp_server:v0.0.47150f76e844d9
oras.land/oras-go/v2@v2.6.0
2.6.2
1
quay.io/operator-framework/catalogd:v1.8.06ff40fa6257f
oras.land/oras-go/v2@v2.6.0
2.6.2
1
quay.io/operator-framework/operator-controller:v1.8.0bca5dfcc67ca
oras.land/oras-go/v2@v2.6.0
2.6.2
1
quay.io/opsmxpublic/opa:1.12.084fb1af7401c
oras.land/oras-go/v2@v2.6.0
2.6.2
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
oras.land/oras-go/v2@v2.3.0
2.6.2
1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator:3.3.242dd426130a9
oras.land/oras-go/v2@v2.6.1
2.6.2
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
oras.land/oras-go/v2@v2.6.0
2.6.2
1
registry.gitlab.com/xrow-public/developer-operator/developer-operator-controller:2.1.2301847adfe16
oras.land/oras-go/v2@v2.6.0
2.6.2
1
registry.gitlab.com/xrow-public/helm-openclaw/openclaw:1.91.3ed44d81a65de
oras.land/oras-go/v2@v2.6.0
2.6.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.