StackRadar

CVE-2026-56857

Critical

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.005
41st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
5,264
of 18,143 indexed, latest versions
Container images
6,101
deployed by those charts
Fix available
1 of 1
affected package

Root.Mkdir(All) can follow junctions out of the root on Windows in os

Carried by container images the latest versions of 5,264 of 18,143 indexed charts deploy, on 6,101 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+208 more1.26.96,101
OSV records
GO-2026-6604
Also known as
BIT-golang-2026-56857
Trending
Rank 4 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,264 by stars
ChartLatestAffected imagesRadar Score
voteappvoting-app-helm-charts-repo-cloudVerified publisher1.0.01 of 5See more

voteapp voting-app-helm-charts-repo-cloud 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/postgres:latestfc973eb97c9f
stdlib@go1.24.6
1.26.9

Open the chart page →

9,771
voting-app-envvoting-example-with-env0.0.31 of 6See more

voting-app-env voting-example-with-env 0.0.3

1 of the 6 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/postgres:18.3-alpine3.2354451ecb8ab3
stdlib@go1.24.6
1.26.9

Open the chart page →

8,394
vpa-managervpa-managerVerified publisher0.4.91 of 1See more

vpa-manager vpa-manager 0.4.9

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/jcluppnow/vpa-manager:0.6.4e459d2fba277
stdlib@go1.22.7
1.26.9

Open the chart page →

1,035
vulcanvulcan0.2.21 of 2See more

vulcan vulcan 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
mitre/vulcan:latest2bc4dfb8150f
stdlib@go1.25.5
1.26.9

Open the chart page →

1,984
cert-manager-webhook-vultrvultrVerified publisher1.0.01 of 1See more

cert-manager-webhook-vultr vultr 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
vultr/cert-manager-webhook-vultr:v0.1.0541c3e0aec58
stdlib@go1.16.3
1.26.9

Open the chart page →

3,726
vultr-csivultrVerified publisher2.0.01 of 4See more

vultr-csi vultr 2.0.0

1 of the 4 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
vultr/vultr-csi:v0.3.041d26735d437
stdlib@go1.16.8
1.26.9

Open the chart page →

3,497
websitewaldo-visionVerified publisher0.33.01 of 2See more

website waldo-vision 0.33.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/waldo-vision/migrate:v0.3.6ae31923312ed
stdlib@go1.20.2
1.26.9

Open the chart page →

4,284
gateway-control-planewallarmVerified publisher0.2.02 of 2See more

gateway-control-plane wallarm 0.2.0

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
timescale/timescaledb:latest-pg17b346edcdb51a
stdlib@go1.24.6
1.26.9
wallarm/gateway-control-plane:0.2.0a321bc974a19
stdlib@go1.24.13
1.26.9

Open the chart page →

2,091
kongwallarmVerified publisher4.6.33 of 7See more

kong wallarm 4.6.3

3 of the 7 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
wallarm/ingress-python:4.6.0-15cb2ae08b40f
stdlib@go1.18.2
1.26.9
wallarm/ingress-ruby:4.6.0-1aecdb35c4def
stdlib@go1.18.3
1.26.9
wallarm/kong-kubernetes-ingress-controller:2.8b55ff6cecbd5
stdlib@go1.19.4
1.26.9

Open the chart page →

77,467
kong-previewwallarmVerified publisher4.2.32 of 5See more

kong-preview wallarm 4.2.3

2 of the 5 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
kong/kubernetes-ingress-controller:2.1.160e4102ab2da
stdlib@go1.17.5
1.26.9
wallarm/ingress-ruby:4.2.1-195ea2632326c
stdlib@go1.18.3
1.26.9

Open the chart page →

4,832
wallarm-ingress-rcwallarmVerified publisher4.8.42 of 2See more

wallarm-ingress-rc wallarm 4.8.4

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
wallarm/ingress-controller:4.8.0-1a591b9c91570
stdlib@go1.20.5
1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407543c40fd0939
stdlib@go1.20.1
1.26.9

Open the chart page →

4,147
wallarm-node-nativewallarmVerified publisher0.25.101 of 2See more

wallarm-node-native wallarm 0.25.10

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
wallarm/node-helpers:6.13.2290a87f01799
stdlib@go1.26.8
1.26.9

Open the chart page →

268
wallarm-node-nextwallarmVerified publisher0.5.32 of 2See more

wallarm-node-next wallarm 0.5.3

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
wallarm/node-helpers:5.0.2-1097cadc42336
stdlib@go1.22.7
1.26.9
wallarm/node-next:0.5.24314f3d2b918
stdlib@go1.22.7
1.26.9

Open the chart page →

3,852
wallarm-oobwallarmVerified publisher0.23.03 of 3See more

wallarm-oob wallarm 0.23.0

3 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
wallarm/ebpf-agent:0.11.0-rc0c8920e60c726
stdlib@go1.22.1
1.26.9
wallarm/node-helpers:6.10.1aecd88b24c51
stdlib@go1.25.7
1.26.9
wallarm/node-native-processing:0.23.07db2da8fce0b
stdlib@go1.26.0
1.26.9

Open the chart page →

4,436
pageswalter1.0.01 of 3See more

pages walter 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.26.9

Open the chart page →

21,576
wardnwardnVerified publisher0.1.02 of 3See more

wardn wardn 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
stdlib@go1.24.6
1.26.9
ghcr.io/happymooguild/wardn-backend:0.1.023ee1b8cfc3c
stdlib@go1.26.5
1.26.9

Open the chart page →

1,091
consulwarjiang1.3.02 of 2See more

consul warjiang 1.3.0

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
hashicorp/consul:1.17.0712fe02d2f84
stdlib@go1.20.10
1.26.9
hashicorp/consul-k8s-control-plane:1.3.00e4452f0f265
stdlib@go1.20.10
1.26.9

Open the chart page →

5,714
eth-validatorwateim1.4.52 of 3See more

eth-validator wateim 1.4.5

2 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ethereum/client-go:latest5ab9a76153b0
stdlib@go1.27.1
1.26.9
wateim/lighthouse-launch:latest2520149ee574
stdlib@go1.23.8
1.26.9

Open the chart page →

5,988
prometheus-storage-adapterwavefront0.1.61 of 2See more

prometheus-storage-adapter wavefront 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
wavefronthq/prometheus-storage-adapter:latestded77b38c7c6
stdlib@go1.18
1.26.9

Open the chart page →

2,335
wavefront-hpa-adapterwavefront0.2.101 of 1See more

wavefront-hpa-adapter wavefront 0.2.10

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
wavefronthq/wavefront-hpa-adapter:0.9.12af5fef9a4768
stdlib@go1.18
1.26.9

Open the chart page →

2,762
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.14.45a065930682d
stdlib@go1.14.12
1.26.9

Open the chart page →

7,460
wazuh-manager-filebeatwazuh-manager-filebeat0.1.0-gamma1 of 1See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
iosifache/wazuh-manager-filebeat:latest85df3f04b5da
stdlib@go1.14.12
1.26.9

Open the chart page →

13,021
wazuh-operatorwazuh-operator2026.10.21 of 1See more

wazuh-operator wazuh-operator 2026.10.2

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/maximewewer/wazuh-operator:2026.10.2aad30dd2e645
stdlib@go1.27.1
1.26.9

Open the chart page →

227
anubiswbstack0.1.01 of 1See more

anubis wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/techarohq/anubis:v1.21.3940ac71ef6fc
stdlib@go1.24.5
1.26.9

Open the chart page →

991
istio-service-meshwbstack0.0.11 of 1See more

istio-service-mesh wbstack 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
istio/pilot:1.17.1ce9d87606701
stdlib@go1.20.1
1.26.9

Open the chart page →

7,362
drillwearefrank1.3.61 of 3See more

drill wearefrank 1.3.6

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
bitnamilegacy/zookeeper:3.9.0-debian-11-r1110ed1ea3c8d1
stdlib@go1.19.12
1.26.9

Open the chart page →

10,893
myweatherhelmwebapp11.3.501 of 8See more

myweatherhelm webapp1 1.3.50

1 of the 8 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/rabbitmq:3-managemente582c0bc7766
stdlib@go1.22.2
1.26.9

Open the chart page →

10,794
myweatherhelm-schedulingwebapp11.3.921 of 9See more

myweatherhelm-scheduling webapp1 1.3.92

1 of the 9 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/rabbitmq:3-managemente582c0bc7766
stdlib@go1.22.2
1.26.9

Open the chart page →

10,794
azure-janitorwebdevopsVerified publisher1.0.131 of 1See more

azure-janitor webdevops 1.0.13

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
webdevops/azure-janitor:24.9.02446baee7b69
stdlib@go1.23.1
1.26.9

Open the chart page →

1,368
azure-keyvault-exporterwebdevopsVerified publisher1.0.121 of 1See more

azure-keyvault-exporter webdevops 1.0.12

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
webdevops/azure-keyvault-exporter:24.9.1f333704ecd60
stdlib@go1.23.1
1.26.9

Open the chart page →

1,367
azure-loganalytics-exporterwebdevopsVerified publisher1.0.131 of 1See more

azure-loganalytics-exporter webdevops 1.0.13

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
webdevops/azure-loganalytics-exporter:25.12.0051845d06d85
stdlib@go1.25.5
1.26.9

Open the chart page →

954
azure-resourcegraph-exporterwebdevopsVerified publisher1.1.51 of 1See more

azure-resourcegraph-exporter webdevops 1.1.5

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
webdevops/azure-resourcegraph-exporter:24.9.0381136dda026
stdlib@go1.23.1
1.26.9

Open the chart page →

1,352
azure-resourcemanager-exporterwebdevopsVerified publisher1.3.61 of 1See more

azure-resourcemanager-exporter webdevops 1.3.6

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
webdevops/azure-resourcemanager-exporter:26.1.0d3e1842ad419
stdlib@go1.25.5
1.26.9

Open the chart page →

984
azure-scheduledevents-managerwebdevopsVerified publisher1.0.171 of 1See more

azure-scheduledevents-manager webdevops 1.0.17

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
webdevops/azure-scheduledevents-manager:24.9.0-kubernetes7acd46a8a972
stdlib@go1.22.5
1.26.9

Open the chart page →

1,705
kube-pool-managerwebdevopsVerified publisher1.0.161 of 1See more

kube-pool-manager webdevops 1.0.16

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
webdevops/kube-pool-manager:24.9.04fad7e14ad67
stdlib@go1.23.1
1.26.9

Open the chart page →

1,052
pagerduty-exporterwebdevopsVerified publisher1.1.81 of 1See more

pagerduty-exporter webdevops 1.1.8

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
webdevops/pagerduty-exporter:25.12.183b95faf10a0
stdlib@go1.25.5
1.26.9

Open the chart page →

954
web-dvwaweb-dvwa1.16.01 of 2See more

web-dvwa web-dvwa 1.16.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/mariadb:107db29378d4fd
stdlib@go1.24.6
1.26.9

Open the chart page →

11,239
jenkinswebencryptor1.9.181 of 1See more

jenkins webencryptor 1.9.18

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsa660310e39ad
stdlib@go1.27.0
1.26.9

Open the chart page →

2,230
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
stdlib@go1.21.12
1.26.9

Open the chart page →

30,750
generic-webhookwebhooks0.1.11 of 1See more

generic-webhook webhooks 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/thecatlady/webhook:2.8.0f04718704dab
stdlib@go1.20.1
1.26.9

Open the chart page →

2,689
webresourcecataloguswebresourcecatalogus1.1.01 of 4See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/webresourcecatalogus-php:latest8f1bbd5cda85
stdlib@go1.13.10
1.26.9

Open the chart page →

9,650
alertmanagerwener2.1.12 of 2See more

alertmanager wener 2.1.1

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/prometheus-operator/prometheus-config-reloader:v0.94.106b52bd4dbe3
stdlib@go1.26.8
1.26.9
quay.io/prometheus/alertmanager:v0.34.1e9733bafb1bd
stdlib@go1.26.8
1.26.9

Open the chart page →

530
ambassadorwener6.9.51 of 2See more

ambassador wener 6.9.5

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
stdlib@go1.15
1.26.9

Open the chart page →

5,676
apisixwener2.18.21 of 3See more

apisix wener 2.18.2

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
bitnamilegacy/etcd:latest99b408c15272
stdlib@go1.23.10
1.26.9

Open the chart page →

3,722
apisix-ingress-controllerwener1.4.01 of 2See more

apisix-ingress-controller wener 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
apache/apisix-ingress-controller:2.2.05c5efa4c7f2a
stdlib@go1.26.5
1.26.9

Open the chart page →

2,356
argo-cdwener10.10.52 of 3See more

argo-cd wener 10.10.5

2 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.46.0933fcd3f5233
stdlib@go1.27.1
1.26.9
quay.io/argoproj/argocd:v3.5.513db7b10db23
stdlib@go1.26.2
1.26.9

Open the chart page →

2,707
argocd-image-updaterwener1.3.21 of 1See more

argocd-image-updater wener 1.3.2

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-image-updater:v1.3.1a578e328e8cb
stdlib@go1.26.8
1.26.9

Open the chart page →

421
argo-eventswener2.4.271 of 1See more

argo-events wener 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
stdlib@go1.25.6
1.26.9

Open the chart page →

1,624
argo-workflowswener2.0.133 of 3See more

argo-workflows wener 2.0.13

3 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-workflows-crdinstaller:v4.1.593534a0d0ba3
stdlib@go1.26.5
1.26.9
quay.io/argoproj/argocli:v4.1.5e0824b55297b
stdlib@go1.26.5
1.26.9
quay.io/argoproj/workflow-controller:v4.1.5328307c9436f
stdlib@go1.26.5
1.26.9

Open the chart page →

996
athens-proxywener0.5.22 of 2See more

athens-proxy wener 0.5.2

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
gomods/athens:v0.11.0efb811df7844
stdlib@go1.13.10
1.26.9
jaegertracing/all-in-one:latestab6f1a1f0fb4
stdlib@go1.25.4
1.26.9

Open the chart page →

6,785

Container images carrying it

6,101 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

No deployed image carries CVE-2026-56857.

syft 1.42.1 · advisories as of 17 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.