CVE-2026-56857

Critical

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: Critical; worst across findings
CVSS: 9.8; base score, highest
EPSS: 0.005; 41st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,276; of 18,137 indexed, latest versions
Container images: 6,115; deployed by those charts
Fix available: 1 of 1; affected package

Root.Mkdir(All) can follow junctions out of the root on Windows in os

Carried by container images the latest versions of 5,276 of 18,137 indexed charts deploy, on 6,115 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+208 more	1.26.9	6,115

OSV records: GO-2026-6604
Trending: Rank 3 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,276 by stars

Chart

Latest

Affected images

Radar Score

nfs-subdir-external-provisionerxxl-job-admin

4.0.18

1 of 1 See more

nfs-subdir-external-provisioner xxl-job-admin 4.0.18

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner :v4.0.2	63d5e04551ec	stdlib@go1.15	1.26.9

Open the chart page →

4,005

nightingalexxl-job-admin

0.2.11

4 of 6 See more

nightingale xxl-job-admin 0.2.11

4 of the 6 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	stdlib@go1.25.14	1.26.9
flashcatcloud/nightingale :8.0.0-beta.11	ea1b0aaabe09	stdlib@go1.23.9	1.26.9
library/mysql :5.7	4bc6bc963e6d	stdlib@go1.18.2	1.26.9
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	stdlib@go1.22.6	1.26.9

Open the chart page →

12,782

redisxxl-job-admin

24.1.3

1 of 1 See more

redis xxl-job-admin 24.1.3

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/dellnoantechnp/bitnami/redis :8.4.0	29064423c369	stdlib@go1.25.6	1.26.9

Open the chart page →

613

pgbounceryasn77-pgbouncer

0.0.8

1 of 1 See more

pgbouncer yasn77-pgbouncer 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/yasn77/pgbouncer :v0.0.6	cc8c13550e44	stdlib@go1.18.6	1.26.9

Open the chart page →

1,899

ygdrassil-monitoringygdrassil

0.4.0

7 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

7 of the 10 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	stdlib@go1.23.5	1.26.9
prom/alertmanager :v0.28.0	d5155cfac40a	stdlib@go1.23.4	1.26.9
quay.io/prometheus-operator/prometheus-config-reloader :v0.79.2	193280a33bc1	stdlib@go1.23.4	1.26.9
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	stdlib@go1.22.5	1.26.9
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	stdlib@go1.23.4	1.26.9
quay.io/prometheus/pushgateway :v1.11.0	99392035ae99	stdlib@go1.23.4	1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.14.0	37d841299325	stdlib@go1.23.3	1.26.9

Open the chart page →

13,875

ceph-exporterygqygq2

1.0.0

1 of 1 See more

ceph-exporter ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
digitalocean/ceph_exporter :latest	19b163e3fb95	stdlib@go1.20	1.26.9

Open the chart page →

6,880

mdbygqygq2

5.0.7

1 of 1 See more

170

mod-chartygqygq2

5.1.0

1 of 1 See more

mod-chart ygqygq2 5.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
bitnami/nginx :latest	b8d42f076789	stdlib@go1.26.8	1.26.9

Open the chart page →

170

prometheusalertygqygq2

1.0.0

1 of 1 See more

prometheusalert ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
feiyu563/prometheus-alert :v4.9.1	224cfa68cbd9	stdlib@go1.20.6	1.26.9

Open the chart page →

2,372

utcookygqygq2

2.1.4

1 of 1 See more

utcook ygqygq2 2.1.4

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
bitnami/nginx :latest	b8d42f076789	stdlib@go1.26.8	1.26.9

Open the chart page →

170

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	stdlib@go1.18.1	1.26.9

Open the chart page →

2,994

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	stdlib@go1.17.8	1.26.9
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	stdlib@go1.17.9	1.26.9
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	stdlib@go1.16	1.26.9
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	stdlib@go1.16	1.26.9

Open the chart page →

12,492

nginx-vts-exporterymrs

0.1.2

1 of 1 See more

nginx-vts-exporter ymrs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
sophos/nginx-vts-exporter :latest	f1073556b29b	stdlib@go1.13.6	1.26.9

Open the chart page →

2,470

version-checkerymrs

0.2.3

1 of 1 See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	stdlib@go1.15.2	1.26.9

Open the chart page →

4,267

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	b28bae15e219	stdlib@go1.26.7	1.26.9
quay.io/prometheus/alertmanager :latest	e9733bafb1bd	stdlib@go1.26.8	1.26.9
quay.io/prometheus/prometheus :latest	efd719c99d83	stdlib@go1.27.1	1.26.9

Open the chart page →

904

ical-filter-proxyyungwood

0.3.1

1 of 1 See more

ical-filter-proxy yungwood 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
yungwood/ical-filter-proxy :0.3.1	ddc3f30ab05f	stdlib@go1.26.5	1.26.9

Open the chart page →

259

synergy-wholesale-exporteryungwood

0.1.1

1 of 1 See more

synergy-wholesale-exporter yungwood 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
yungwood/synergy-wholesale-exporter :0.1.1	054dce85989b	stdlib@go1.26.5	1.26.9

Open the chart page →

259

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	stdlib@go1.20.4	1.26.9
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	stdlib@go1.20.4	1.26.9

Open the chart page →

6,702

zahori-moonzahori

1.0.1

3 of 3 See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon :2.5.1	a8837b00ba1c	stdlib@go1.20.4	1.26.9
quay.io/aerokube/moon-conf :2.5.1	9ca307b30080	stdlib@go1.20.4	1.26.9
quay.io/aerokube/moon-ui :2.0.5	89990b146824	stdlib@go1.20.5	1.26.9

Open the chart page →

5,024

zahori-schedulerzahori

1.0.1

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	stdlib@go1.20.5	1.26.9

Open the chart page →

3,136

jenkinszanise-jenkins-helm-chart

0.1.0

1 of 1 See more

jenkins zanise-jenkins-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
jenkins/jenkins :lts	a660310e39ad	stdlib@go1.27.0	1.26.9

Open the chart page →

2,212

posthogzeet

0.23.2

2 of 9 See more

posthog zeet 0.23.2

2 of the 9 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	stdlib@go1.17.13	1.26.9
altinity/metrics-exporter :latest	a5206c713de7	stdlib@go1.26.8	1.26.9

Open the chart page →

4,840

endlessh-gozekker6

0.4.0

1 of 1 See more

endlessh-go zekker6 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/shizunge/endlessh-go :2026.0730.0	8826dad32623	stdlib@go1.26.5	1.26.9

Open the chart page →

827

karmazekker6

0.22.0

1 of 1 See more

karma zekker6 0.22.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
lmierzwa/karma :v0.133	f5d0a0ff4062	stdlib@go1.27.1	1.26.9

Open the chart page →

148

zookeeper-exporterzookeeper-exporter

0.1.0

1 of 1 See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
dabealu/zookeeper-exporter :latest	86106fec315f	stdlib@go1.14.15	1.26.9

Open the chart page →

2,294

zoo-project-druzoo-project

0.10.9

2 of 6 See more

zoo-project-dru zoo-project 0.10.9

2 of the 6 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/postgres :18.6-alpine3.24	77f585114c32	stdlib@go1.24.6	1.26.9
zooproject/zoo-project :dru-51e7d55383f24594959b69e58518961c6aa66740	da112e8d03f1	stdlib@go1.26.8	1.26.9

Open the chart page →

7,310

Container images carrying it

6,115 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
public.ecr.aws/aktosecurity/akto-agent-guard-service :latest	5c6ff17c5849	stdlib@go1.25.5	1.26.9	1
public.ecr.aws/aktosecurity/akto-api-security-mini-runtime :1.75.1_local	49c88519dc19	stdlib@go1.26.7	1.26.9	1
public.ecr.aws/aktosecurity/akto-api-security-mini-runtime :1.74.7_local :latest	6b75164ae737	stdlib@go1.26.7	1.26.9	1
public.ecr.aws/aktosecurity/akto-api-security-mini-runtime :latest	eeff3738d708	stdlib@go1.26.7	1.26.9	1
public.ecr.aws/aktosecurity/akto-api-security-mini-testing :1.74.7_local	500745200425	stdlib@go1.26.7	1.26.9	1
public.ecr.aws/aktosecurity/akto-api-security-mini-testing :1.75.1_local	8eff42336169	stdlib@go1.26.7	1.26.9	1
public.ecr.aws/aktosecurity/akto-threat-detection :1.18.7	55b1bd20ef02	stdlib@go1.26.7	1.26.9	1
public.ecr.aws/aktosecurity/akto-threat-detection :latest	a1fe1ef75a55	stdlib@go1.26.7	1.26.9	1
public.ecr.aws/aktosecurity/akto-threat-detection :latest	f14d68a2b1cf	stdlib@go1.26.7	1.26.9	1
public.ecr.aws/aktosecurity/confluentinc-cp-kafka :8.1.0-1-ubi9	9026dbbf280d	stdlib@go1.24.6	1.26.9	1
public.ecr.aws/aktosecurity/mirror-api-logging :k8s_ebpf_core_imp	d94ce715f051	stdlib@go1.25.9	1.26.9	1
public.ecr.aws/aws-containers/retail-store-sample-catalog :1.3.0	b654b266fa32	stdlib@go1.24.6	1.26.9	1
public.ecr.aws/aws-ec2/amazon-ec2-metadata-mock :v1.11.2	dd02d3569da0	stdlib@go1.17.13	1.26.9	1
public.ecr.aws/aws-ec2/aws-node-termination-handler :v1.19.0	844478ebd5b8	stdlib@go1.19.5	1.26.9	1
public.ecr.aws/aws-ec2/aws-node-termination-handler :v1.25.6	9ad31fb4e5be	stdlib@go1.25.8	1.26.9	1
public.ecr.aws/aws-ec2/aws-node-termination-handler-2/controller :v2.0.0-beta	9637c80dd23f	stdlib@go1.19.3	1.26.9	1
public.ecr.aws/aws-ec2/aws-node-termination-handler-2/webhook :v2.0.0-beta	86b0f7243250	stdlib@go1.19.3	1.26.9	1
public.ecr.aws/aws-observability/aws-for-fluent-bit :3.2.1	a480a1241720	stdlib@go1.25.6	1.26.9	1
public.ecr.aws/aws-observability/aws-for-fluent-bit :stable	aee01ceceb6c	stdlib@go1.27.1	1.26.9	1
public.ecr.aws/aws-observability/aws-otel-collector :v0.50.0	7968fb60db6a	stdlib@go1.26.7	1.26.9	1
public.ecr.aws/aws-observability/aws-otel-collector :v0.43.3	8aa9ea5f67b8	stdlib@go1.24.3	1.26.9	1
public.ecr.aws/aws-observability/aws-sigv4-proxy-admission-controller :1.0	67b89ae52240	stdlib@go1.15.3	1.26.9	1
public.ecr.aws/aws-secrets-manager/secrets-store-csi-driver-provider-aws :1.0.r2-2021.08.13.20.34-linux-amd64	02aed3370fce	stdlib@go1.15.12	1.26.9	1
public.ecr.aws/aws-secrets-manager/secrets-store-csi-driver-provider-aws :1.0.r2-35-g41dc61e-2022.12.16.20.38	363bd65cd707	stdlib@go1.18.8	1.26.9	1
public.ecr.aws/aws-secrets-manager/secrets-store-csi-driver-provider-aws :1.0.r1-10-g1942553-2021.06.04.00.07-linux-amd64	b32c99e7bc45	stdlib@go1.15.8	1.26.9	1
public.ecr.aws/boundless-software/switchblade :release-v0.0.19-lcm	01d8413d5075	stdlib@go1.23.9	1.26.9	1
public.ecr.aws/buildkite/agent-metrics :v5.11.0	16e7f5c7161e	stdlib@go1.25.1	1.26.9	1
public.ecr.aws/cloudnatix/llmariner/database-creator :1.19.1	62375abc3c56	stdlib@go1.23.12	1.26.9	1
public.ecr.aws/cloudnatix/llmariner/database-creator :1.17.0	97065ced2942	stdlib@go1.23.11	1.26.9	1
public.ecr.aws/cloudnatix/llmariner/inference-manager-server :1.46.0	0bbb5f5ddf71	stdlib@go1.25.9	1.26.9	1
public.ecr.aws/cloudnatix/llmariner/inference-manager-server :1.45.0	90b890f800ab	stdlib@go1.23.12	1.26.9	1
public.ecr.aws/cloudnatix/llmariner/job-manager-syncer :1.27.0	86957bbeeff5	stdlib@go1.23.12	1.26.9	1
public.ecr.aws/cloudnatix/llmariner/session-manager-server :0.1.0-gfu-dev	b9537499ff9e	stdlib@go1.23.7	1.26.9	1
public.ecr.aws/cloudnatix/llmariner/session-manager-server :1.9.0	f24ecd37fbaa	stdlib@go1.23.11	1.26.9	1
public.ecr.aws/cloudnatix/llmariner/vector-store-manager-server :1.8.0	ced619de4c6d	stdlib@go1.25.8	1.26.9	1
public.ecr.aws/cloudnatix/llmariner/vector-store-manager-server :1.7.0	f1f6b884b325	stdlib@go1.23.11	1.26.9	1
public.ecr.aws/cloudpilotai/gcp/karpenter :v0.7.0	1a907c29920f	stdlib@go1.27.0	1.26.9	1
public.ecr.aws/csi-components/csi-node-driver-registrar :v2.16.0-eksbuild.3	592d7034d6c7	stdlib@go1.26.1	1.26.9	1
public.ecr.aws/csi-components/livenessprobe :v2.18.0-eksbuild.3	8e307f4e5820	stdlib@go1.26.1	1.26.9	1
public.ecr.aws/datadog/agent :7.73.0	f4925b15ce94	stdlib@go1.24.9	1.26.9	1
public.ecr.aws/datadog/cloudprem :v0.1.34	1cb9c5446621	stdlib@go1.26.7-X:loopvar	1.26.9	1
public.ecr.aws/decisiveai/mdai-s3-logs-reader :0.0.8	d1e35167eec5	stdlib@go1.24.10	1.26.9	1
public.ecr.aws/diagrid-dev/diagrid-dashboard :latest	f1348a65664a	stdlib@go1.26.4	1.26.9	1
public.ecr.aws/docker/library/caddy :2.6.3	87cbd356af2e	stdlib@go1.20	1.26.9	1
public.ecr.aws/dynatrace/dynatrace-operator :v1.11.0	5b772cfaad48	stdlib@go1.27.1	1.26.9	1
public.ecr.aws/dynatrace/dynatrace-operator :v1.3.0	f68901a54664	stdlib@go1.22.5	1.26.9	1
public.ecr.aws/eks/amazon-eks-pod-identity-webhook :v0.6.17	3071570e8e8c	stdlib@go1.26.3	1.26.9	1
public.ecr.aws/eks-distro/kubernetes/kube-scheduler :v1.29.14-eks-1-29-latest	e7e1db003e6a	stdlib@go1.22.12	1.26.9	1
public.ecr.aws/g4a0y2u8/unifie-store :staging-19925	a2057fabc948	stdlib@go1.20.12	1.26.9	1
public.ecr.aws/gravitational/teleport-plugin-datadog :18.11.4	7426de85aa4a	stdlib@go1.26.8	1.26.9	1