StackRadar

CVE-2026-56857

Critical

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.005
41st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
5,264
of 18,143 indexed, latest versions
Container images
6,101
deployed by those charts
Fix available
1 of 1
affected package

Root.Mkdir(All) can follow junctions out of the root on Windows in os

Carried by container images the latest versions of 5,264 of 18,143 indexed charts deploy, on 6,101 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+208 more1.26.96,101
OSV records
GO-2026-6604
Also known as
BIT-golang-2026-56857
Trending
Rank 4 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,264 by stars
ChartLatestAffected imagesRadar Score
tranquil-pdsrubxkubeVerified publisher0.2.01 of 2See more

tranquil-pds rubxkube 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/postgres:18-alpine77f585114c32
stdlib@go1.24.6
1.26.9

Open the chart page →

720
trmnl-serverrubxkubeVerified publisher0.1.01 of 2See more

trmnl-server rubxkube 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
alpine/git:2.47.2062a01ad7a0e
stdlib@go1.23.9
1.26.9

Open the chart page →

3,362
uptime-kumarubxkubeVerified publisher1.2.11 of 1See more

uptime-kuma rubxkube 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.4.091e963bfda56
stdlib@go1.20.5
1.26.9

Open the chart page →

37,484
your-spotifyrubxkubeVerified publisher1.0.11 of 3See more

your-spotify rubxkube 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:latestb0652af9c8d0
stdlib@go1.23.8
1.26.9

Open the chart page →

6,698
gha-runner-scale-set-controllerrunner-scale-set-controller0.15.01 of 1See more

gha-runner-scale-set-controller runner-scale-set-controller 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/actions/gha-runner-scale-set-controller:0.15.0162dfb5bfbda
stdlib@go1.27.1
1.26.9

Open the chart page →

227
runwhen-localrunwhen-contribVerified publisher0.7.32 of 3See more

runwhen-local runwhen-contrib 0.7.3

2 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
otel/opentelemetry-collector:0.153.06ed874ea083d
stdlib@go1.26.3
1.26.9
ghcr.io/runwhen-contrib/runwhen-local:0.12.4914e75d9f445
stdlib@go1.25.5
1.26.9

Open the chart page →

4,472
rybbitrybbit-helm1.3.23 of 7See more

rybbit rybbit-helm 1.3.2

3 of the 7 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
stdlib@go1.25.7
1.26.9
library/postgres:15-alpinef7d23353e1b1
stdlib@go1.24.6
1.26.9
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
stdlib@go1.20.7
1.26.9

Open the chart page →

8,909
janitorrryuunosukeds30.1.31 of 1See more

janitorr ryuunosukeds3 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/schaka/janitorr:native-stable7cfe1e0c41da
stdlib@go1.24.6
1.26.9

Open the chart page →

1,471
nadekobotryuunosukeds30.1.21 of 2See more

nadekobot ryuunosukeds3 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/ubuntu:latestf144425ff09b
stdlib@go1.26.7
1.26.9

Open the chart page →

9,814
orbitalryuunosukeds30.2.01 of 1See more

orbital ryuunosukeds3 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ryuunosukeds3/orbital:latest0879f7261b10
stdlib@go1.23.9
1.26.9

Open the chart page →

3,455
housekeepersaashousekeeper1.0.01 of 14See more

housekeeper saashousekeeper 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.26.9

Open the chart page →

4,894
sagawisesagawiseVerified publisher0.1.02 of 3See more

sagawise sagawise 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
venturenox/redis:latest83b471c193ba
stdlib@go1.22.9
1.26.9
venturenox/sagawise:latestc11d32f18718
stdlib@go1.22.2
1.26.9

Open the chart page →

4,393
caddysagikazarmarkVerified publisher0.0.141 of 1See more

caddy sagikazarmark 0.0.14

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/caddy:2.4.5874405536b3e
stdlib@go1.17
1.26.9

Open the chart page →

4,177
tusdsagikazarmarkVerified publisher0.1.21 of 1See more

tusd sagikazarmark 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
tusproject/tusd:v1.10.01e457b59fd5b
stdlib@go1.19.2
1.26.9

Open the chart page →

2,424
fmtok8s-agenda-servicesalaboy0.1.21 of 2See more

fmtok8s-agenda-service salaboy 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/salaboy/fmtok8s-agenda-service:v0.0.1-native6c5efe150958
stdlib@go1.18.10
1.26.9

Open the chart page →

3,392
fmtok8s-c4p-servicesalaboy0.1.11 of 2See more

fmtok8s-c4p-service salaboy 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/salaboy/fmtok8s-c4p-service:v0.0.1-native3f7cc45fd20b
stdlib@go1.19.7
1.26.9

Open the chart page →

3,392
fmtok8s-conference-chartsalaboy0.1.43 of 6See more

fmtok8s-conference-chart salaboy 0.1.4

3 of the 6 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/salaboy/fmtok8s-agenda-service:v0.0.1-native6c5efe150958
stdlib@go1.18.10
1.26.9
ghcr.io/salaboy/fmtok8s-c4p-service:v0.0.1-native3f7cc45fd20b
stdlib@go1.19.7
1.26.9
ghcr.io/salaboy/fmtok8s-email-service:v0.1.0-nativecf28472bc460
stdlib@go1.17.11
1.26.9

Open the chart page →

19,320
fmtok8s-email-servicesalaboy0.2.01 of 1See more

fmtok8s-email-service salaboy 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/salaboy/fmtok8s-email-service:v0.2.0-nativeb52d5dbac2ca
stdlib@go1.17.11
1.26.9

Open the chart page →

3,872
knative-helm-operatorsalaboy1.9.02 of 2See more

knative-helm-operator salaboy 1.9.0

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
gcr.io/knative-releases/knative.dev/operator/cmd/webhookdigest-pinned6c5c90cdf707
stdlib@go1.19.5
1.26.9
gcr.io/knative-releases/knative.dev/serving/cmd/default-domaindigest-pinned5e0429b70299
stdlib@go1.19.5
1.26.9

Open the chart page →

4,026
pagessamanvithkaranth1.0.01 of 3See more

pages samanvithkaranth 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.26.9

Open the chart page →

21,576
hellowsamarthya2.0.01 of 1See more

hellow samarthya 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
samarthya/spinnaker:v1.0ef06d81036af
stdlib@go1.17.6
1.26.9

Open the chart page →

3,382
saml-exportersaml-exporter0.5.02 of 2See more

saml-exporter saml-exporter 0.5.0

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/doodlescheduling/saml-exporter:v0.5.03d5a99841bc2
stdlib@go1.22.3
1.26.9
quay.io/brancz/kube-rbac-proxy:v0.19.19f21034731c7
stdlib@go1.24.2
1.26.9

Open the chart page →

2,545
samplesample0.1.01 of 2See more

sample sample 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/mongo:noble61dd87ff554d
stdlib@go1.26.8
1.26.9

Open the chart page →

2,528
sample-applicationsample-application1.0.61 of 1See more

sample-application sample-application 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/patricklaabs/sample-application:0.0.1f0935fa2eee3
stdlib@go1.22.0
1.26.9

Open the chart page →

1,059
speedtestsantisbon0.1.02 of 3See more

speedtest santisbon 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
grafana/grafana:latestb28bae15e219
stdlib@go1.26.7
1.26.9
library/influxdb:2.7b8d940ca9376
stdlib@go1.18.2
1.26.9

Open the chart page →

14,439
uptime-kumasarab97Verified publisher0.1.51 of 1See more

uptime-kuma sarab97 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.22.10b55bcb83a1c
stdlib@go1.19.6
1.26.9

Open the chart page →

6,189
pagessarubits-pages1.0.01 of 3See more

pages sarubits-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.26.9

Open the chart page →

21,576
grafanasaurabh6-grafana0.2.01 of 1See more

grafana saurabh6-grafana 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
saurabh6/grafana_setup:v15c140fda7486
stdlib@go1.16.1
1.26.9

Open the chart page →

3,689
prometheussaurabh6-prometheus0.2.01 of 1See more

prometheus saurabh6-prometheus 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
saurabh6/prometheus_setup:v19d4dbe7c1815
stdlib@go1.16.5
1.26.9

Open the chart page →

3,880
airflowsb-helm-charts0.3.01 of 1See more

airflow sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
apache/airflow:2.8.1e5560ad0b86e
stdlib@go1.19.8
1.26.9

Open the chart page →

11,862
grafanasb-helm-charts0.4.01 of 1See more

grafana sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
grafana/grafana:12.2.22ebef928d7e5
stdlib@go1.25.3
1.26.9

Open the chart page →

2,434
harborsb-helm-charts0.3.02 of 2See more

harbor sb-helm-charts 0.3.0

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
goharbor/harbor-core:v2.11.1c017dd84ee96
stdlib@go1.22.6
1.26.9
goharbor/registry-photon:v2.11.15645d459af2b
stdlib@go1.22.6
1.26.9

Open the chart page →

2,732
keycloaksb-helm-charts0.3.01 of 2See more

keycloak sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
stdlib@go1.24.6
1.26.9

Open the chart page →

3,085
lokisb-helm-charts0.4.01 of 1See more

loki sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
grafana/loki:3.6.192bd5700577b
stdlib@go1.24.10
1.26.9

Open the chart page →

1,326
mimirsb-helm-charts0.3.01 of 1See more

mimir sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
grafana/mimir:2.15.085f55510e0d3
stdlib@go1.23.2
1.26.9

Open the chart page →

1,463
mongodbsb-helm-charts0.4.01 of 1See more

mongodb sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/mongo:7.0.140032d2ca20db
stdlib@go1.21.12
1.26.9

Open the chart page →

5,260
mysqlsb-helm-charts0.4.01 of 1See more

mysql sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/mysql:8.4.3106d5197fd8e
stdlib@go1.18.2
1.26.9

Open the chart page →

1,983
nextcloudsb-helm-charts0.4.01 of 2See more

nextcloud sb-helm-charts 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
stdlib@go1.24.6
1.26.9

Open the chart page →

11,818
opentelemetry-collectorsb-helm-charts0.3.01 of 1See more

opentelemetry-collector sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
stdlib@go1.21.7
1.26.9

Open the chart page →

2,455
postgresqlsb-helm-charts0.4.01 of 1See more

postgresql sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/postgres:16.11468e1f126ca5
stdlib@go1.24.6
1.26.9

Open the chart page →

3,177
promtailsb-helm-charts0.4.01 of 1See more

promtail sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
grafana/promtail:3.6.18dcfdf466da0
stdlib@go1.24.10
1.26.9

Open the chart page →

2,991
pushgatewaysb-helm-charts0.3.01 of 1See more

pushgateway sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/prometheus/pushgateway:v1.6.2979a69ab4a40
stdlib@go1.21.1
1.26.9

Open the chart page →

1,881
redissb-helm-charts0.4.01 of 1See more

redis sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/redis:7.4.1-alpinec1e88455c852
stdlib@go1.18.2
1.26.9

Open the chart page →

2,195
temposb-helm-charts0.4.01 of 1See more

tempo sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
grafana/tempo:2.9.065a578975943
stdlib@go1.25.1
1.26.9

Open the chart page →

1,492
thanos-compactorsb-helm-charts0.3.01 of 1See more

thanos-compactor sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
stdlib@go1.23.4
1.26.9

Open the chart page →

1,551
thanos-querysb-helm-charts0.3.01 of 1See more

thanos-query sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
stdlib@go1.23.4
1.26.9

Open the chart page →

1,551
thanos-query-frontendsb-helm-charts0.3.01 of 1See more

thanos-query-frontend sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
stdlib@go1.23.4
1.26.9

Open the chart page →

1,551
thanos-receivesb-helm-charts0.3.01 of 1See more

thanos-receive sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
stdlib@go1.23.4
1.26.9

Open the chart page →

1,551
thanos-rulersb-helm-charts0.3.01 of 1See more

thanos-ruler sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
stdlib@go1.23.4
1.26.9

Open the chart page →

1,551
thanos-sidecarsb-helm-charts0.3.01 of 1See more

thanos-sidecar sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
stdlib@go1.23.4
1.26.9

Open the chart page →

1,551

Container images carrying it

6,101 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

No deployed image carries CVE-2026-56857.

syft 1.42.1 · advisories as of 17 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.