StackRadar

CVE-2026-56857

Critical

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.005
41st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
5,323
of 18,117 indexed, latest versions
Container images
6,150
deployed by those charts
Fix available
1 of 1
affected package

Root.Mkdir(All) can follow junctions out of the root on Windows in os

Carried by container images the latest versions of 5,323 of 18,117 indexed charts deploy, on 6,150 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+212 more1.26.96,150
OSV records
GO-2026-6604
Trending
Rank 1 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,323 by stars
ChartLatestAffected imagesRadar Score
gentrace-self-hostedgentrace-self-hostedVerified publisher0.1.32 of 9See more

gentrace-self-hosted gentrace-self-hosted 0.1.3

2 of the 9 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:23.8512bb8a21483
stdlib@go1.19.10
1.26.9
library/postgres:15.38775adb39f0d
stdlib@go1.18.2
1.26.9

Open the chart page →

17,022
geo-checkergeo-checkerVerified publisher5.0.01 of 1See more

geo-checker geo-checker 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ymuski/geo-checker:5.0.05ba7fd8c7bdc
stdlib@go1.25.3
1.26.9

Open the chart page →

1,968
ghostfolioghostfolioVerified publisher0.5.41 of 3See more

ghostfolio ghostfolio 0.5.4

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
bitnami/redis:latestf4797b37502e
stdlib@go1.26.8
1.26.9

Open the chart page →

3,829
gigapipegigapipeVerified publisher0.3.01 of 1See more

gigapipe gigapipe 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/metrico/gigapipe:v4.1.6caeb2652ce5e
stdlib@go1.26.2
1.26.9

Open the chart page →

1,096
leantimegissilabs1.3.01 of 2See more

leantime gissilabs 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/mariadb:10.6.218a16204dc96c
stdlib@go1.18.2
1.26.9

Open the chart page →

7,699
gitea-sonarqube-botgitea-sonarqube-botOfficialVerified publisher0.4.01 of 1See more

gitea-sonarqube-bot gitea-sonarqube-bot 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
justusbunsi/gitea-sonarqube-bot:v0.4.018dd43b470d9
stdlib@go1.23.3
1.26.9

Open the chart page →

1,692
github-stsgithub-sts-helmVerified publisher0.1.11 of 1See more

github-sts github-sts-helm 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/depthmark/github-sts:0.1.129fda68298da
stdlib@go1.27.1
1.26.9

Open the chart page →

264
gitops-reversergitops-reverserVerified publisher0.52.01 of 1See more

gitops-reverser gitops-reverser 0.52.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/configbutler/gitops-reverser:0.52.0a44138514b30
stdlib@go1.27.1
1.26.9

Open the chart page →

213
prometheus-kafka-exportergkarthiks0.1.31 of 1See more

prometheus-kafka-exporter gkarthiks 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
danielqsj/kafka-exporter:latestd1014f41712d
stdlib@go1.27.1
1.26.9

Open the chart page →

213
temporalglasskubeVerified publisher0.45.2-gk.110 of 14See more

temporal glasskube 0.45.2-gk.1

10 of the 14 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
grafana/grafana:11.0.00dc5a246ab16
stdlib@go1.21.10
1.26.9
temporalio/admin-tools:1.25.0-tctl-1.18.1-cli-1.0.0cda4901bab53
stdlib@go1.22.3
1.26.9
temporalio/server:1.25.08a5798191dea
stdlib@go1.22.3
1.26.9
temporalio/ui:2.30.25c2a3645d09c
stdlib@go1.22.1
1.26.9
quay.io/prometheus-operator/prometheus-config-reloader:v0.74.0d55631c7a740
stdlib@go1.22.3
1.26.9
quay.io/prometheus/alertmanager:v0.27.0e13b6ed5cb92
stdlib@go1.21.7
1.26.9
quay.io/prometheus/node-exporter:v1.8.1fa7fa12a57ef
stdlib@go1.22.3
1.26.9
quay.io/prometheus/prometheus:v2.53.0075b1ba2c4eb
stdlib@go1.22.4
1.26.9
quay.io/prometheus/pushgateway:v1.8.0c159e946abf4
stdlib@go1.22.1
1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0b401fae262a5
stdlib@go1.21.8
1.26.9

Open the chart page →

23,332
daos-operatorgluesysVerified publisher0.1.61 of 1See more

daos-operator gluesys 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/gluesys/daos-operator:v0.1.0-rc.4c38bd9a7691c
stdlib@go1.26.8
1.26.9

Open the chart page →

215
go-hello-world-chartgo-hello-worldVerified publisher1.8.31 of 1See more

go-hello-world-chart go-hello-world 1.8.3

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/wasilak/go-hello-world:1.8.366d353e7693f
stdlib@go1.25.4
1.26.9

Open the chart page →

1,245
gomenhashaigomenhashaiOfficialVerified publisher1.3.41 of 1See more

gomenhashai gomenhashai 1.3.4

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/gomenhashai/gomenhashai:v1.3.36f031172a5ec
stdlib@go1.26.0
1.26.9

Open the chart page →

1,070
gorse-enterprisegorse-io0.4.23 of 5See more

gorse-enterprise gorse-io 0.4.2

3 of the 5 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
zhenghaoz/gorse-master:0.4.12033046b432ec
stdlib@go1.20.1
1.26.9
zhenghaoz/gorse-server:0.4.1239c565685b01
stdlib@go1.20.1
1.26.9
zhenghaoz/gorse-worker:0.4.12f7739f64c9b0
stdlib@go1.20.1
1.26.9

Open the chart page →

6,830
gotosocialgotosocialVerified publisher0.2.321 of 1See more

gotosocial gotosocial 0.2.32

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
superseriousbusiness/gotosocial:0.22.10078ca451dda
stdlib@go1.25.12
1.26.9

Open the chart page →

664
meta-monitoringgrafana1.3.02 of 2See more

meta-monitoring grafana 1.3.0

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
grafana/alloy:v1.4.306bdcbb51fc2
stdlib@go1.22.7
1.26.9
ghcr.io/jimmidyson/configmap-reload:v0.12.0a7c754986900
stdlib@go1.21.1
1.26.9

Open the chart page →

4,960
phlaregrafana0.5.41 of 1See more

phlare grafana 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
grafana/phlare:0.5.1330f990cdad9
stdlib@go1.19.6
1.26.9

Open the chart page →

2,895
gkograviteeioVerified publisher4.12.211 of 1See more

gko graviteeio 4.12.21

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
graviteeio/kubernetes-operator:4.12.2182548747c6c5
stdlib@go1.26.8
1.26.9

Open the chart page →

324
greenkubegreenkubeVerified publisher0.3.01 of 3See more

greenkube greenkube 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/postgres:18-alpine77f585114c32
stdlib@go1.24.6
1.26.9

Open the chart page →

2,178
gremlingremlin0.30.01 of 2See more

gremlin gremlin 0.30.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
gremlin/chao:latest298100e062b8
stdlib@go1.25.13
1.26.9

Open the chart page →

376
armada-operatorgresearch0.7.02 of 2See more

armada-operator gresearch 0.7.0

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
gresearch/armada-operator:latest6c43743e2b2d
stdlib@go1.24.0
1.26.9
kubebuilder/kube-rbac-proxy:v0.16.03c4f708c6204
stdlib@go1.21.7
1.26.9

Open the chart page →

2,791
carettagroundcover0.0.163 of 3See more

caretta groundcover 0.0.16

3 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/groundcover/caretta:v0.0.16ed8f5118e3a4
stdlib@go1.18
1.26.9
quay.io/groundcover/grafana:9.3.18c65b333a3d3
stdlib@go1.19.3
1.26.9
quay.io/groundcover/victoria-metrics:v1.85.380ddeb90d18d
stdlib@go1.19.4
1.26.9

Open the chart page →

9,907
ghostgroundhog2k0.212.161 of 1See more

ghost groundhog2k 0.212.16

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/ghost:6.69.055131b90d48c
stdlib@go1.24.6
1.26.9

Open the chart page →

2,028
growthbookgrowthbook5.1.01 of 2See more

growthbook growthbook 5.1.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
bitnami/mongodb:latestad05bb9a19fa
stdlib@go1.26.8
1.26.9

Open the chart page →

1,501
IMgrycapOfficialVerified publisher1.8.01 of 3See more

IM grycap 1.8.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/mysql:8.46ea90827b110
stdlib@go1.24.6
1.26.9

Open the chart page →

5,270
oscargrycapOfficialVerified publisher4.2.01 of 2See more

oscar grycap 4.2.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/grycap/oscar:latest1afdce33dacf
stdlib@go1.25.14
1.26.9

Open the chart page →

653
castopodh2mVerified publisher1.12.101 of 3See more

castopod h2m 1.12.10

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
castopod/castopod:1.12.101fd37280cbb2
stdlib@go1.21.13
1.26.9

Open the chart page →

11,470
haproxy-unified-gatewayhaproxytechVerified publisher1.2.01 of 1See more

haproxy-unified-gateway haproxytech 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
haproxytech/haproxy-unified-gateway:1.0.7b9bffe2d0fd1
stdlib@go1.26.5
1.26.9

Open the chart page →

1,009
boundary-controllerhashicorpVerified publisher0.2.01 of 1See more

boundary-controller hashicorp 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
hashicorp/boundary-enterprise:1.0.2-ent3a8061968ee4
stdlib@go1.26.7
1.26.9

Open the chart page →

428
boundary-workerhashicorpVerified publisher0.2.01 of 1See more

boundary-worker hashicorp 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
hashicorp/boundary-enterprise:1.0.2-ent3a8061968ee4
stdlib@go1.26.7
1.26.9

Open the chart page →

428
terraform-cloud-operatorhashicorpVerified publisher2.5.02 of 2See more

terraform-cloud-operator hashicorp 2.5.0

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
hashicorp/terraform-cloud-operator:2.5.0c2f78a575a8a
stdlib@go1.22.4
1.26.9
quay.io/brancz/kube-rbac-proxy:v0.18.0754ab2a723c8
stdlib@go1.22.4
1.26.9

Open the chart page →

2,618
hawkhawk1.1.53 of 4See more

hawk hawk 1.1.5

3 of the 4 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
grafana/grafana:8.5.042d3e6bc1865
stdlib@go1.17.9
1.26.9
library/postgres:16.109f23e02d766
stdlib@go1.18.2
1.26.9
ghcr.io/privacyengineering/hawk-service:latestbfedf47bb5e0
stdlib@go1.20.11
1.26.9

Open the chart page →

17,645
hcloud-cloud-controller-managerhcloud1.39.01 of 1See more

hcloud-cloud-controller-manager hcloud 1.39.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
hetznercloud/hcloud-cloud-controller-manager:v1.39.0d6fee5698759
stdlib@go1.26.8
1.26.9

Open the chart page →

322
clickstackhdx-oss-v21.1.11 of 5See more

clickstack hdx-oss-v2 1.1.1

1 of the 5 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/mongo:5.0.32-focal3b6c281e1c08
stdlib@go1.24.0
1.26.9

Open the chart page →

5,554
guacamolehelmforgeVerified publisher1.5.32 of 5See more

guacamole helmforge 1.5.3

2 of the 5 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/postgres:18.6-trixie74935e722416
stdlib@go1.24.6
1.26.9
library/postgres:17.5-bookwormfbcea1bd13b6
stdlib@go1.18.2
1.26.9

Open the chart page →

10,665
mariadbhelmforgeVerified publisher2.1.21 of 1See more

mariadb helmforge 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/mariadb:13.0.2f1bba652ba57
stdlib@go1.26.7
1.26.9

Open the chart page →

1,905
matomohelmforgeVerified publisher2.3.21 of 3See more

matomo helmforge 2.3.2

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/mysql:26.7.0893418c8a7a3
stdlib@go1.24.6
1.26.9

Open the chart page →

3,249
opencloudhelmforgeVerified publisher1.0.01 of 1See more

opencloud helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
opencloudeu/opencloud:7.2.46d992ccc5f1c
stdlib@go1.25.11
1.26.9

Open the chart page →

1,176
uptime-kumahelmforgeVerified publisher1.5.151 of 1See more

uptime-kuma helmforge 1.5.15

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.5c74379ac4509
stdlib@go1.20.5
1.26.9

Open the chart page →

36,648
velerohelmforgeVerified publisher1.4.122 of 2See more

velero helmforge 1.4.12

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
velero/velero:v1.18.4c89fb5b6d1fd
stdlib@go1.26.8
1.26.9
velero/velero-plugin-for-aws:v1.14.07e82f717f44e
stdlib@go1.25.7
1.26.9

Open the chart page →

1,905
uptimekumahelm-l3st86Verified publisher0.1.101 of 1See more

uptimekuma helm-l3st86 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.1396510915e6be
stdlib@go1.19.6
1.26.9

Open the chart page →

5,451
helm-operatorhelm-operatorVerified publisher0.0.21 of 1See more

helm-operator helm-operator 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
bsgrigorov/helm-operator:latest45ab095f09c8
stdlib@go1.15.12
1.26.9

Open the chart page →

8,358
spirehelm-spireVerified publisher0.30.37 of 10See more

spire helm-spire 0.30.3

7 of the 10 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/spiffe/oidc-discovery-provider:1.15.3bb95f13c2b4e
stdlib@go1.26.6
1.26.9
ghcr.io/spiffe/spiffe-csi-driver:0.2.79dfe4f0caff0
stdlib@go1.24.0
1.26.9
ghcr.io/spiffe/spiffe-helper:0.11.01c92e5998ad3
stdlib@go1.25.3
1.26.9
ghcr.io/spiffe/spire-agent:1.15.341b0dcd8b258
stdlib@go1.26.6
1.26.9
ghcr.io/spiffe/spire-controller-manager:0.8.019e418e9d7f2
stdlib@go1.27.1
1.26.9
ghcr.io/spiffe/spire-server:1.15.34082f30d3e0d
stdlib@go1.26.6
1.26.9
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.15.011f199f6bec4
stdlib@go1.24.6
1.26.9

Open the chart page →

3,947
helmuphelmupVerified publisher0.1.01 of 3See more

helmup helmup 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
stdlib@go1.20.4
1.26.9

Open the chart page →

18,914
buildbarnhermetiq-buildbarnVerified publisher0.9.52 of 4See more

buildbarn hermetiq-buildbarn 0.9.5

2 of the 4 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/buildbarn/bb-scheduler:20260908T142432Z-77f7642f627ab242890
stdlib@go1.27.1
1.26.9
ghcr.io/buildbarn/bb-storage:20260908T142448Z-db6204132ebc54b769b
stdlib@go1.27.1
1.26.9

Open the chart page →

700
hivemq-platform-operatorhivemqOfficialVerified publisher0.2.261 of 1See more

hivemq-platform-operator hivemq 0.2.26

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
hivemq/hivemq-platform-operator:2.2.2a919f990141b
stdlib@go1.26.5
1.26.9

Open the chart page →

1,481
hivemq-swarmhivemqOfficialVerified publisher0.2.711 of 1See more

hivemq-swarm hivemq 0.2.71

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
hivemq/hivemq-swarm:4.56.08d5f6a6f48b0
stdlib@go1.26.7
1.26.9

Open the chart page →

735
hiverhiverVerified publisher0.1.459 of 10See more

hiver hiver 0.1.45

9 of the 10 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
hiversh/antigravity:0.1.45-microvm0e36d98402bc
stdlib@go1.26.5
1.26.9
hiversh/browser:0.1.45-microvmb5048c6342ce
stdlib@go1.26.5
1.26.9
hiversh/claude:0.1.45-microvm2fbf9f264498
stdlib@go1.26.5
1.26.9
hiversh/codex:0.1.45-microvm4f43130f51e5
stdlib@go1.26.5
1.26.9
hiversh/controller:0.1.45b0b85f8942c7
stdlib@go1.19.8
1.26.9
hiversh/copilot:0.1.45-microvm50c07b84f298
stdlib@go1.26.5
1.26.9
hiversh/node:0.1.45-alpine-microvm836a37641941
stdlib@go1.26.5
1.26.9
hiversh/openclaw:0.1.45-microvm958b7ebb4eb4
stdlib@go1.19.8
1.26.9
hiversh/python:0.1.45-3.13-alpine-microvm63a5ae179a9f
stdlib@go1.19.8
1.26.9

Open the chart page →

30,850
cratedb-adapter-v2hmdmph0.2.11 of 1See more

cratedb-adapter-v2 hmdmph 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
crate/crate_adapter:latestb8d89fa5d19b
stdlib@go1.16.3
1.26.9

Open the chart page →

4,129
holoinsightholoinsight0.2.53 of 6See more

holoinsight holoinsight 0.2.5

3 of the 6 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
holoinsight/otelcontribcol:latest42ba8dc3113c
stdlib@go1.19
1.26.9
library/mysql:86ea90827b110
stdlib@go1.24.6
1.26.9
quay.io/prometheus/prometheus:latestefd719c99d83
stdlib@go1.27.1
1.26.9

Open the chart page →

30,287

Container images carrying it

6,150 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

No deployed image carries CVE-2026-56857.

syft 1.42.1 · advisories as of 14 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.