StackRadar

CVE-2026-56857

Critical

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.005
41st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
5,264
of 18,143 indexed, latest versions
Container images
6,101
deployed by those charts
Fix available
1 of 1
affected package

Root.Mkdir(All) can follow junctions out of the root on Windows in os

Carried by container images the latest versions of 5,264 of 18,143 indexed charts deploy, on 6,101 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+208 more1.26.96,101
OSV records
GO-2026-6604
Also known as
BIT-golang-2026-56857
Trending
Rank 4 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,264 by stars
ChartLatestAffected imagesRadar Score
pagessrinipages1.0.01 of 3See more

pages srinipages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.26.9

Open the chart page →

21,576
sshpipersshpiperVerified publisher0.5.11 of 1See more

sshpiper sshpiper 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
farmer1992/sshpiperd:v1.6.19ddc25422cc2
stdlib@go1.26.5
1.26.9

Open the chart page →

439
servicexssl-hep1.8.62 of 16See more

servicex ssl-hep 1.8.6

2 of the 16 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2022.12.12-debian-11-r90f7c8ac484ac
stdlib@go1.18.9
1.26.9
sslhep/servicex_app:v1.8.6c935e123030d
stdlib@go1.27.1
1.26.9

Open the chart page →

68,228
ecr-cleanersstarcherVerified publisher0.1.1+d13a1ab1 of 1See more

ecr-cleaner sstarcher 0.1.1+d13a1ab

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
sstarcher/ecr-cleaner:0.1.12d43c390cb19
stdlib@go1.14.2
1.26.9

Open the chart page →

3,705
kube-ebs-taggersstarcherVerified publisher0.1.0+7abf4f71 of 1See more

kube-ebs-tagger sstarcher 0.1.0+7abf4f7

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
sstarcher/kube-ebs-tagger:0.1.01f8cae8cfa80
stdlib@go1.13.9
1.26.9

Open the chart page →

4,373
prestashopstack-prestahop22.0.01 of 4See more

prestashop stack-prestahop 22.0.0

1 of the 4 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.23.086e8449ff8ff
stdlib@go1.18.3
1.26.9

Open the chart page →

4,170
stackrox-operatorstackroxVerified publisher4.11.51 of 1See more

stackrox-operator stackrox 4.11.5

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/stackrox-io/stackrox-operator:4.11.533900d05d026
stdlib@go1.26.7
1.26.9

Open the chart page →

343
retail-store-sample-catalog-chartstacksimplifyVerified publisher2.0.01 of 1See more

retail-store-sample-catalog-chart stacksimplify 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-catalog:1.3.0b654b266fa32
stdlib@go1.24.6
1.26.9

Open the chart page →

1,291
stageset-controllerstageset-controllerOfficialVerified publisher2026.10.50531172 of 2See more

stageset-controller stageset-controller 2026.10.5053117

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/metio/stageset-controller:2026.10.5021840c328a7a140d3
stdlib@go1.27.1
1.26.9
registry.k8s.io/kubectl:v1.34.0497d298f891e
stdlib@go1.24.6
1.26.9

Open the chart page →

1,176
allurestakaterVerified publisher1.0.11 of 1See more

allure stakater 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/eformat/jenkins-agent-graalvm:latesta3b9a07648b6
stdlib@go1.16.6
1.26.9

Open the chart page →

30,668
external-secretsstakaterVerified publisher0.3.12-40dbdfc1 of 1See more

external-secrets stakater 0.3.12-40dbdfc

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/external-secrets:v0.3.1156a1ea4490ba
stdlib@go1.17.5
1.26.9

Open the chart page →

3,194
jenkinsstakaterVerified publisher0.21.01 of 1See more

jenkins stakater 0.21.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsa660310e39ad
stdlib@go1.27.0
1.26.9

Open the chart page →

2,230
k8scostoptimizerstakaterVerified publisher0.0.51 of 1See more

k8scostoptimizer stakater 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
stakater/k8s-cost-optimizer:v0.0.5450415ce1b4e
stdlib@go1.17.8
1.26.9

Open the chart page →

2,452
konfiguratorstakaterVerified publisher0.1.391 of 1See more

konfigurator stakater 0.1.39

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
stakater/konfigurator:v0.1.393409565b1ef5
stdlib@go1.17.13
1.26.9

Open the chart page →

2,190
mongodbstakaterVerified publisher1.0.31 of 1See more

mongodb stakater 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
bitnami/mongodb:latestad05bb9a19fa
stdlib@go1.26.8
1.26.9

Open the chart page →

530
proxyinjectorstakaterVerified publisher0.0.231 of 1See more

proxyinjector stakater 0.0.23

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
stakater/proxyinjector:v0.0.2383fef483d497
stdlib@go1.13.1
1.26.9

Open the chart page →

4,190
tronadorstakaterVerified publisher0.0.11 of 1See more

tronador stakater 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
stakater/tronador:v0.0.137ce9acf2722
stdlib@go1.15.11
1.26.9

Open the chart page →

3,397
vaultstakaterVerified publisher0.8.42 of 2See more

vault stakater 0.8.4

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
hashicorp/vault:1.8.4dfc3500beb0e
stdlib@go1.16.7
1.26.9
hashicorp/vault-k8s:0.14.0aff47b5ba39c
stdlib@go1.17.2
1.26.9

Open the chart page →

8,249
whitelisterstakaterVerified publisher0.0.161 of 1See more

whitelister stakater 0.0.16

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
stakater/whitelister:v0.0.1639107924063e
stdlib@go1.13.1
1.26.9

Open the chart page →

3,901
workshop-operatorstakaterVerified publisher0.0.381 of 2See more

workshop-operator stakater 0.0.38

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
stakater/workshop-operator:v0.0.3897bf456cc97c
stdlib@go1.16.13
1.26.9

Open the chart page →

8,016
my-appstakefish0.1.01 of 3See more

my-app stakefish 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:latestefd719c99d83
stdlib@go1.27.1
1.26.9

Open the chart page →

283
stakefishstakefish0.1.06 of 8See more

stakefish stakefish 0.1.0

6 of the 8 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
prom/prometheus:v2.52.05c435642ca4d
stdlib@go1.22.3
1.26.9
quay.io/prometheus-operator/prometheus-config-reloader:v0.73.2706cde441321
stdlib@go1.22.2
1.26.9
quay.io/prometheus/alertmanager:v0.27.0e13b6ed5cb92
stdlib@go1.21.7
1.26.9
quay.io/prometheus/node-exporter:v1.8.08a57af80a4c7
stdlib@go1.22.2
1.26.9
quay.io/prometheus/pushgateway:v1.8.0c159e946abf4
stdlib@go1.22.1
1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0b401fae262a5
stdlib@go1.21.8
1.26.9

Open the chart page →

25,637
erigonstakewise2.61.21 of 3See more

erigon stakewise 2.61.2

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
erigontech/erigon:v2.61.288706754b627
stdlib@go1.22.12
1.26.9

Open the chart page →

3,787
ipfsstakewise2.2.01 of 2See more

ipfs stakewise 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ipfs/kubo:v0.33.21a30f5ed8579
stdlib@go1.23.6
1.26.9

Open the chart page →

2,023
lodestar-validatorstakewise1.2.01 of 1See more

lodestar-validator stakewise 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
chainsafe/lodestar:v1.27.07b9fe4aa8073
stdlib@go1.20.12
1.26.9

Open the chart page →

5,120
mev-booststakewise1.7.41 of 1See more

mev-boost stakewise 1.7.4

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
flashbots/mev-boost:1.8.07c486b5789da
stdlib@go1.22.6
1.26.9

Open the chart page →

1,725
operatorstakewise2.1.11 of 5See more

operator stakewise 2.1.1

1 of the 5 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ethereum/client-go:v1.10.15d99fbb9585c7
stdlib@go1.17.5
1.26.9

Open the chart page →

8,147
ssv-nodestakewise2.2.01 of 2See more

ssv-node stakewise 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
bloxstaking/ssv-node:v2.2.0bf6d7d2fdc93
stdlib@go1.22.11
1.26.9

Open the chart page →

8,102
v3-backendstakewise3.6.01 of 5See more

v3-backend stakewise 3.6.0

1 of the 5 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ipfs/kubo:v0.33.21a30f5ed8579
stdlib@go1.23.6
1.26.9

Open the chart page →

2,023
mediamtxstartechnicaVerified publisher0.1.11 of 1See more

mediamtx startechnica 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
bluenviron/mediamtx:1.17.19e39256d1ba3
stdlib@go1.25.8
1.26.9

Open the chart page →

980
multus-cnistartechnicaVerified publisher0.1.41 of 1See more

multus-cni startechnica 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/k8snetworkplumbingwg/multus-cni:latest-thick08b1bc4d7148
stdlib@go1.26.8
1.26.9

Open the chart page →

1,047
open-appsec-injectorstartechnicaVerified publisher1.1.22 of 3See more

open-appsec-injector startechnica 1.1.2

2 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/openappsec/smartsync:latest580d68c50cc7
stdlib@go1.18.10
1.26.9
ghcr.io/openappsec/smartsync-shared-files:latest30c1daa0b33e
stdlib@go1.18.10
1.26.9

Open the chart page →

6,056
unifistartechnicaVerified publisher0.1.31 of 2See more

unifi startechnica 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
jacobalberty/unifi:v7.1.664a3616625dda
stdlib@go1.18
1.26.9

Open the chart page →

16,355
argocd-operatorstatcan0.5.01 of 1See more

argocd-operator statcan 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-operator:v0.4.0cf8faa986789
stdlib@go1.18.4
1.26.9

Open the chart page →

2,945
cost-analyzerstatcan1.82.24 of 9See more

cost-analyzer statcan 1.82.2

4 of the 9 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
grafana/grafana:7.5.609bb407e26ab
stdlib@go1.16.1
1.26.9
prom/prometheus:v2.22.2f7ffebdd428b
stdlib@go1.15.5
1.26.9
gcr.io/kubecost1/cost-model:prod-1.82.2989a60847416
stdlib@go1.16.5
1.26.9
gcr.io/kubecost1/server:prod-1.82.22b1a3d08caac
stdlib@go1.16.5
1.26.9

Open the chart page →

21,554
fluentd-operatorstatcan0.5.11 of 1See more

fluentd-operator statcan 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
vmware/kube-fluentd-operator:latestf028c138a5f4
stdlib@go1.21.7
1.26.9

Open the chart page →

2,666
ingress-istio-controllerstatcan1.4.01 of 1See more

ingress-istio-controller statcan 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
statcan/ingress-istio-controller:1.4.0d7d6bd180c46
stdlib@go1.18.10
1.26.9

Open the chart page →

2,457
minio-operatorstatcan4.1.01 of 2See more

minio-operator statcan 4.1.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
minio/operator:v4.1.02adc5be088f5
stdlib@go1.16.3
1.26.9

Open the chart page →

8,036
prometheus-operatorstatcan0.2.24 of 7See more

prometheus-operator statcan 0.2.2

4 of the 7 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
grafana/grafana:7.0.3d72946c8e5d5
stdlib@go1.14.3
1.26.9
jettech/kube-webhook-certgen:v1.2.1c42098c8d855
stdlib@go1.13.11
1.26.9
squareup/ghostunnel:v1.5.270f4cf270425
stdlib@go1.13.4
1.26.9
quay.io/prometheus/node-exporter:v1.0.08a3a33cad0bd
stdlib@go1.14.3
1.26.9

Open the chart page →

17,563
sidecar-terminatorstatcan1.3.51 of 1See more

sidecar-terminator statcan 1.3.5

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
statcan/kubernetes-sidecar-terminator:2.0.2bc361ee7748f
stdlib@go1.19.10
1.26.9

Open the chart page →

2,057
starboard-operatorstatcan0.10.41 of 1See more

starboard-operator statcan 0.10.4

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
aquasec/starboard-operator:0.15.4be34f709e1ce
stdlib@go1.17.8
1.26.9

Open the chart page →

2,887
vaultstatcan0.1.81 of 2See more

vault statcan 0.1.8

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
hashicorp/vault-k8s:0.6.05697b85bc69a
stdlib@go1.13.5
1.26.9

Open the chart page →

5,551
anna-nginxstatic-nginx1.31.111 of 2See more

anna-nginx static-nginx 1.31.11

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:latest39923a8e431b
stdlib@go1.26.8
1.26.9

Open the chart page →

752
hesselinkme-nginxstatic-nginx1.31.111 of 2See more

hesselinkme-nginx static-nginx 1.31.11

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:latest39923a8e431b
stdlib@go1.26.8
1.26.9

Open the chart page →

752
static-src-people-detector-appstatic-src-people-detector-chartVerified publisher1.5.51 of 6See more

static-src-people-detector-app static-src-people-detector-chart 1.5.5

1 of the 6 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/mongo:4.4.18d23ec07162ca
stdlib@go1.17.10
1.26.9

Open the chart page →

15,277
steadybit-agentsteadybit3.1.1833 of 6See more

steadybit-agent steadybit 3.1.183

3 of the 6 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
ghcr.io/steadybit/extension-container:v1.8.309378098cdb3
stdlib@go1.25.12
1.26.9
ghcr.io/steadybit/extension-host:v1.8.59871b0534ac0
stdlib@go1.25.12
1.26.9
ghcr.io/steadybit/extension-kubernetes:v2.6.38e2ff1560c375
stdlib@go1.26.8
1.26.9

Open the chart page →

5,087
pagesstephendillondell1.0.01 of 3See more

pages stephendillondell 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.26.9

Open the chart page →

21,576
snapshot-controllerstevehipwellVerified publisher0.1.01 of 1See more

snapshot-controller stevehipwell 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/snapshot-controller:v8.2.09dade8f2f3ab
stdlib@go1.23.1
1.26.9

Open the chart page →

1,046
vertical-pod-autoscalerstevehipwellVerified publisher1.12.13 of 3See more

vertical-pod-autoscaler stevehipwell 1.12.1

3 of the 3 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
registry.k8s.io/autoscaling/vpa-admission-controller:1.7.1be29624f7f12
stdlib@go1.26.5
1.26.9
registry.k8s.io/autoscaling/vpa-recommender:1.7.189cea705535f
stdlib@go1.26.5
1.26.9
registry.k8s.io/autoscaling/vpa-updater:1.7.1feb42a526970
stdlib@go1.26.5
1.26.9

Open the chart page →

1,092
snapshot-controllerstevehipwell-helm-charts-snapshot-controllerVerified publisher0.1.01 of 1See more

snapshot-controller stevehipwell-helm-charts-snapshot-controller 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/snapshot-controller:v8.2.09dade8f2f3ab
stdlib@go1.23.1
1.26.9

Open the chart page →

1,046

Container images carrying it

6,101 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

No deployed image carries CVE-2026-56857.

syft 1.42.1 · advisories as of 17 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.