StackRadar

CVE-2026-56857

Critical

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.005
41st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
5,264
of 18,143 indexed, latest versions
Container images
6,101
deployed by those charts
Fix available
1 of 1
affected package

Root.Mkdir(All) can follow junctions out of the root on Windows in os

Carried by container images the latest versions of 5,264 of 18,143 indexed charts deploy, on 6,101 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+208 more1.26.96,101
OSV records
GO-2026-6604
Also known as
BIT-golang-2026-56857
Trending
Rank 4 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,264 by stars
ChartLatestAffected imagesRadar Score
loggensikalabs0.1.01 of 1See more

loggen sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
sikalabs/slu:v0.72.07bd267f30247
stdlib@go1.21.4
1.26.9

Open the chart page →

3,105
metrics-generatorsikalabs0.2.01 of 1See more

metrics-generator sikalabs 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
sikalabs/slu:v0.34.0fdc0c6711add
stdlib@go1.17.6
1.26.9

Open the chart page →

3,706
olmsikalabs0.3.02 of 2See more

olm sikalabs 0.3.0

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
bitnami/kubectl:latestf7f9e4f64d9e
stdlib@go1.26.8
1.26.9
quay.io/operator-framework/olmdigest-pinned40d0363f4aa6
stdlib@go1.22.3
1.26.9

Open the chart page →

2,055
signpostsikalabs0.5.01 of 1See more

signpost sikalabs 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
sikalabs/signpost:v0.7.0c8b0e21d61b4
stdlib@go1.24.6
1.26.9

Open the chart page →

698
sikalabs-harbor-master-snapshotsikalabs2023.6.201 of 8See more

sikalabs-harbor-master-snapshot sikalabs 2023.6.20

1 of the 8 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:dev72aa75db0f6c
stdlib@go1.27.1
1.26.9

Open the chart page →

1,193
vault-devsikalabs0.2.01 of 1See more

vault-dev sikalabs 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
hashicorp/vault:latestc2f666266f38
stdlib@go1.26.8
1.26.9

Open the chart page →

309
sillytavernsillytavern0.1.191 of 1See more

sillytavern sillytavern 0.1.19

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/sillytavern/sillytavern:1.19.0eef27ff0c796
stdlib@go1.25.10
1.26.9

Open the chart page →

2,150
bytesafe-cesimcube1.0.41 of 3See more

bytesafe-ce simcube 1.0.4

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
bytesafe/bytesafe-ce:v1.0.4ee287384c005
stdlib@go1.20.5
1.26.9

Open the chart page →

2,252
headscalesinextraVerified publisher0.1.21 of 1See more

headscale sinextra 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/juanfont/headscale:v0.29.5780ed2f9e857
stdlib@go1.26.8
1.26.9

Open the chart page →

613
infisicalsinextraVerified publisher0.7.11 of 1See more

infisical sinextra 0.7.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
infisical/infisical:v0.166.79db5e968aab7
stdlib@go1.25.14
1.26.9

Open the chart page →

3,172
keydbsinextraVerified publisher0.33.01 of 1See more

keydb sinextra 0.33.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/keydb:6.3.376a19ddc3626
stdlib@go1.18.10
1.26.9

Open the chart page →

3,215
mongosqldsinextraVerified publisher0.3.71 of 1See more

mongosqld sinextra 0.3.7

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/mongosqld:2.14.230b826375ed42
stdlib@go1.23.8
1.26.9

Open the chart page →

3,289
mongosyncsinextraVerified publisher0.4.01 of 1See more

mongosync sinextra 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/mongosync:1.15.0fa99ed475f03
stdlib@go1.24.4
1.26.9

Open the chart page →

3,626
pgbouncersinextraVerified publisher0.18.01 of 1See more

pgbouncer sinextra 0.18.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/pgbouncer:16.1518f1121ba0a4
stdlib@go1.24.6
1.26.9

Open the chart page →

2,668
system-upgrade-controllersinextraVerified publisher0.6.11 of 1See more

system-upgrade-controller sinextra 0.6.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
rancher/system-upgrade-controller:v0.19.234fa058fe453
stdlib@go1.25.8
1.26.9

Open the chart page →

668
tailscalesinextraVerified publisher0.19.32 of 2See more

tailscale sinextra 0.19.3

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
coredns/coredns:v1.14.77efd3c635b03
stdlib@go1.26.6
1.26.9
ghcr.io/sergelogvinov/tailscale:1.102.5591864822ac1
stdlib@go1.26.6
1.26.9

Open the chart page →

909
talos-backupsinextraVerified publisher0.1.21 of 1See more

talos-backup sinextra 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/siderolabs/talos-backup:v0.1.0-beta.203a71e140f1d
stdlib@go1.23.0
1.26.9

Open the chart page →

1,484
teamcitysinextraVerified publisher1.1.01 of 3See more

teamcity sinextra 1.1.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/docker:26.1-dinddd43b430341a
stdlib@go1.21.11
1.26.9

Open the chart page →

3,151
mariadbsitepilot1.0.31 of 1See more

mariadb sitepilot 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/mariadb:10.623616f0bd3af
stdlib@go1.24.6
1.26.9

Open the chart page →

3,382
sk8lsk8lVerified publisher0.24.01 of 1See more

sk8l sk8l 0.24.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
danroux/sk8l-api:v0.20.024d3b96fdcb2
stdlib@go1.27.1-X:loopvar
1.26.9

Open the chart page →

236
skupperskupperVerified publisher2.2.31 of 1See more

skupper skupper 2.2.3

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/skupper/controller:2.2.3735568990038
stdlib@go1.25.14
1.26.9

Open the chart page →

249
network-observerskupper-network-observerVerified publisher2.2.32 of 3See more

network-observer skupper-network-observer 2.2.3

2 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v3.11.3c0b857aead0d
stdlib@go1.26.2
1.26.9
quay.io/skupper/network-observer:2.2.33c20bd40b918
stdlib@go1.25.14
1.26.9

Open the chart page →

1,243
skyhook-agentskyhookVerified publisher1.3.151 of 1See more

skyhook-agent skyhook 1.3.15

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/skyhook-io/skyhook-connector:v2.3.23deb8e4b1aaa
stdlib@go1.26.0
1.26.9

Open the chart page →

735
skyhook-connectorskyhookVerified publisher1.3.251 of 1See more

skyhook-connector skyhook 1.3.25

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/skyhook-io/skyhook-connector:v2.5.56c4e3336600d
stdlib@go1.26.4
1.26.9

Open the chart page →

455
mimirskyloud-helm-chartsVerified publisher5.5.12 of 5See more

mimir skyloud-helm-charts 5.5.1

2 of the 5 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
grafana/mimir:r292-5f018727476e456c738
stdlib@go1.22.3
1.26.9
grafana/rollout-operator:v0.14.03409edfb45c7
stdlib@go1.22.1
1.26.9

Open the chart page →

4,330
tailscale-operatorskyloud-helm-chartsVerified publisher1.70.31 of 1See more

tailscale-operator skyloud-helm-charts 1.70.3

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
tailscale/k8s-operator:v1.70.08edd06cf5bac
stdlib@go1.22.5
1.26.9

Open the chart page →

1,630
skypilot-prometheus-serverskypilotVerified publisher0.11.13 of 3See more

skypilot-prometheus-server skypilot 0.11.1

3 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/prometheus-operator/prometheus-config-reloader:v0.83.078aec597d87a
stdlib@go1.24.3
1.26.9
quay.io/prometheus/prometheus:v3.4.19abc6cf6aea7
stdlib@go1.24.3
1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0db384bf43222
stdlib@go1.23.5
1.26.9

Open the chart page →

3,966
pritunl-zerosky-sailVerified publisher0.3.31 of 1See more

pritunl-zero sky-sail 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
pritunl/pritunl-zero:1.0.3648.460f2943e0d41b
stdlib@go1.25.4
1.26.9

Open the chart page →

1,130
yopasssky-sailVerified publisher1.3.11 of 2See more

yopass sky-sail 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
jhaals/yopass:12.5.0916a1cf45d36
stdlib@go1.25.5
1.26.9

Open the chart page →

3,765
config-connector-templaterslamdev0.0.51 of 1See more

config-connector-templater slamdev 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
slamdev/config-connector-templater:0.0.3a234541c9fa8
stdlib@go1.16.5
1.26.9

Open the chart page →

3,291
flux-notifierslamdev0.0.71 of 1See more

flux-notifier slamdev 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
slamdev/flux-notifier:v0.0.8b173d809132d
stdlib@go1.13.11
1.26.9

Open the chart page →

3,107
gitlab-runnerslamdev0.0.11 of 1See more

gitlab-runner slamdev 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
gitlab/gitlab-runner:v15.3.0860d4a3fec7a
stdlib@go1.17.9
1.26.9

Open the chart page →

10,871
gke-preemptible-notifierslamdev0.0.61 of 1See more

gke-preemptible-notifier slamdev 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
slamdev/gke-preemptible-notifier:v0.0.3d5d6430108a3
stdlib@go1.13.11
1.26.9

Open the chart page →

4,134
octavia-ingress-controllerslamdev0.0.71 of 1See more

octavia-ingress-controller slamdev 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
k8scloudprovider/octavia-ingress-controller:v1.20.26ddf80b34265
stdlib@go1.15
1.26.9

Open the chart page →

4,040
weblateslamdev0.0.111 of 2See more

weblate slamdev 0.0.11

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
weblate/weblate:3.11.3-182848df56ecd
stdlib@go1.13.5
1.26.9

Open the chart page →

11,898
crashloop-operatorslauger-crashloop-operatorVerified publisher0.1.01 of 1See more

crashloop-operator slauger-crashloop-operator 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/slauger/crashloop-operator:0.1.076e0216124b7
stdlib@go1.27.1
1.26.9

Open the chart page →

250
slothsloth0.16.02 of 2See more

sloth sloth 0.16.0

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/slok/sloth:v0.16.0f0f0075b0d45
stdlib@go1.26.1
1.26.9
registry.k8s.io/git-sync/git-sync:v4.5.00e64aedb0d0a
stdlib@go1.25.1
1.26.9

Open the chart page →

5,291
slurm-bridgeslurm-bridge1.2.33 of 3See more

slurm-bridge slurm-bridge 1.2.3

3 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/slinkyproject/slurm-bridge-admission:1.2.3042e3827a68f
stdlib@go1.26.8
1.26.9
ghcr.io/slinkyproject/slurm-bridge-controllers:1.2.3e2e3e2c82d2c
stdlib@go1.26.8
1.26.9
ghcr.io/slinkyproject/slurm-bridge-scheduler:1.2.353db9c40f2b9
stdlib@go1.26.8
1.26.9

Open the chart page →

949
oi-slurm-cluster-chartslurm-cluster-chart0.25.12 of 4See more

oi-slurm-cluster-chart slurm-cluster-chart 0.25.1

2 of the 4 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
bitnami/kubectl:latestf7f9e4f64d9e
stdlib@go1.26.8
1.26.9
library/mariadb:10.10334b315c10e5
stdlib@go1.18.2
1.26.9

Open the chart page →

5,775
slurm-cluster-chartslurm-cluster-chart0.25.02 of 4See more

slurm-cluster-chart slurm-cluster-chart 0.25.0

2 of the 4 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
bitnami/kubectl:latest999d5eb28f40
stdlib@go1.26.8
1.26.9
library/mariadb:10.10334b315c10e5
stdlib@go1.18.2
1.26.9

Open the chart page →

5,775
slurm-operatorslurm-operator1.2.32 of 2See more

slurm-operator slurm-operator 1.2.3

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/slinkyproject/slurm-operator:1.2.3b35e76c09e58
stdlib@go1.26.8
1.26.9
ghcr.io/slinkyproject/slurm-operator-webhook:1.2.368a4460abaa1
stdlib@go1.26.8
1.26.9

Open the chart page →

560
deconzsmall-hack0.1.01 of 1See more

deconz small-hack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
deconzcommunity/deconz:2.26.123c86008d73f
stdlib@go1.19.8
1.26.9

Open the chart page →

14,720
home-assistantsmall-hack2.1.01 of 1See more

home-assistant small-hack 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
stdlib@go1.23.3
1.26.9

Open the chart page →

5,146
smarter-k3s-edgesmarterVerified publisher0.0.121 of 2See more

smarter-k3s-edge smarter 0.0.12

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
rancher/k3s:v1.25.3-k3s1eaa270df79cc
stdlib@go1.19.2
1.26.9

Open the chart page →

4,418
smarter-device-managersmarter-device-manager0.0.101 of 1See more

smarter-device-manager smarter-device-manager 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/smarter-project/smarter-device-manager:v1.20.12228f7f44594a
stdlib@go1.19.3
1.26.9

Open the chart page →

2,001
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
stdlib@go1.19.8
1.26.9

Open the chart page →

6,742
smtp-gotifysmtp-gotifyVerified publisher0.1.41 of 1See more

smtp-gotify smtp-gotify 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/reiml/smtp-gotify:latest80ffa9d2044a
stdlib@go1.23.9
1.26.9

Open the chart page →

1,086
snaprsnapr0.1.01 of 2See more

snapr snapr 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
snapr/app:v0.1.0e9eb8287bfe1
stdlib@go1.23.12
1.26.9

Open the chart page →

2,609
sneakerssneakers1.0.01 of 4See more

sneakers sneakers 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
helga09/my_sql_shoes:v1.1.1a03657d97897
stdlib@go1.18.2
1.26.9

Open the chart page →

10,125
echobotsngular0.3.51 of 1See more

echobot sngular 0.3.5

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/sngular/gitops-echobot:v0.2.23cde2e04b739
stdlib@go1.16.5
1.26.9

Open the chart page →

3,516

Container images carrying it

6,101 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

No deployed image carries CVE-2026-56857.

syft 1.42.1 · advisories as of 17 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.