CVE-2026-56857
MediumAdvisory
Published 8 Oct 2026In the index since 9 Oct 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.5
- base score, highest
- EPSS
- 0.002
- 10th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 5,511
- of 18,087 indexed, latest versions
- Container images
- 6,327
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Root.Mkdir(All) can follow junctions out of the root on Windows in os
Carried by container images the latest versions of 5,511 of 18,087 indexed charts deploy, on 6,327 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| stdlibgolang | go1.13, go1.13.1, go1.13.3, go1.13.4+212 more | 1.26.9 | 6,327 |
- OSV records
- GO-2026-6604
- Trending
- Rank 4 in indexed charts, since 9 Oct 2026. See the ranking →
Charts affected
5,511 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| netbird-api-exporternetbird-api-exporterVerified publisher | 0.2.17 | 1 of 1See more | 232 |
| netbird-operatornetbird-operator | 0.8.0 | 1 of 1See more | 192 |
| keycloak-operatornewsaktuell | 0.1.7 | 1 of 1See more | 6,280 |
| mstreamnicholaswildeVerified publisher | 2.1.2 | 1 of 1See more | 5,749 |
| gateway-apinicklasfrahm-gateway-apiVerified publisher | 0.2.0 | 1 of 1See more | 1,664 |
| observalobservalVerified publisher | 1.14.0 | 2 of 8See more | 6,380 |
| aws-xrayokgoloveVerified publisher | 5.0.0 | 1 of 1See more | 538 |
| olivetinolivetinOfficialVerified publisher | 4.0.0 | 1 of 1See more | 620 |
| flagsmithone-acre-fundVerified publisher | 0.1.5 | 1 of 6See more | 7,970 |
| kobotoolboxone-acre-fundVerified publisher | 0.7.4 | 2 of 9See more | 23,855 |
| secrets-injectoronepassword-connect | 1.2.0 | 1 of 1See more | 1,453 |
| opentelemetry-ebpfopentelemetry-helmOfficialVerified publisher | 0.1.7 | 1 of 4See more | 3,628 |
| opentelemetry-ebpf-instrumentationopentelemetry-helmOfficialVerified publisher | 0.14.3 | 1 of 1See more | 76 |
| oesopsmxVerified publisher | 4.0.32 | 8 of 25See more | 110,685 |
| pacto-operatorpacto-operatorOfficialVerified publisher | 5.4.2 | 1 of 1See more | 99 |
| ipfs-clusterparadeum-teamVerified publisher | 0.0.19 | 2 of 2See more | 5,472 |
| permifypermifyVerified publisher | 0.5.0 | 1 of 1See more | 1,456 |
| persespersesOfficialVerified publisher | 0.23.3 | 1See more | — |
| platzioplatz-ioVerified publisher | 0.6.5 | 1 of 2See more | 3,548 |
| plecopleco | 0.24.0 | 1 of 1See more | 1,923 |
| ipmi-exporterpnnl-miscscripts | 0.1.15 | 1 of 1See more | 4,287 |
| pomeriumpomerium | 34.0.1 | 1 of 1See more | 2,777 |
| prometheus-memcached-exporterprometheus-communityVerified publisher | 0.6.0 | 1 of 1See more | 113 |
| prometheus-pgbouncer-exporterprometheus-communityVerified publisher | 0.10.1 | 1 of 1See more | 449 |
| prometheus-systemd-exporterprometheus-communityVerified publisher | 0.5.2 | 1 of 1See more | 1,127 |
| prometheus-yet-another-cloudwatch-exporterprometheus-communityVerified publisher | 0.48.0 | 1 of 1See more | 52 |
| kube-prometheus-stackprometheus-worawutchan | 12.8.0 | 4 of 6See more | 16,682 |
| qgis-serverqgis-serverVerified publisher | 0.1.10 | 1 of 3See more | 6,243 |
| nfs-server-provisionerraphaelVerified publisher | 1.3.0 | 1 of 1See more | 3,837 |
| repoflowrepoflow-helm-public | 0.9.1 | 1 of 8See more | 14,419 |
| wordpress-hardenedriotkit-org | 2.0.0 | 2 of 2See more | 8,265 |
| backrestrobertobochetVerified publisher | 0.7.0 | 1 of 1See more | 1,200 |
| supabaserock8sVerified publisher | 0.0.6 | 1 of 1See more | 607 |
| rqliterqliteOfficialVerified publisher | 2.0.0 | 1 of 1See more | 1,682 |
| qbittorrent-vpnrtomik-helm-chartsVerified publisher | 0.0.2 | 1 of 2See more | 1,654 |
| sabliersablier-helm-chartsOfficialVerified publisher | 1.8.1 | 1 of 1See more | 336 |
| satisfactory-serversatisfactoryVerified publisher | 0.1.6 | 1 of 1See more | 4,455 |
| seaweedfs-csi-driverseaweedfs-csi-driver | 0.2.40 | 7 of 7See more | 8,130 |
| seldon-core-operatorseldon | 1.19.0 | 1 of 1See more | 1,228 |
| bentoself-hosters-by-nightVerified publisher | 0.9.1 | 1 of 1See more | 1,642 |
| lldapself-hosters-by-nightVerified publisher | 0.5.2 | 2 of 2See more | 4,787 |
| appshini4iVerified publisher | 0.4.0 | 1 of 1See more | 973 |
| skypilotskypilotOfficialVerified publisher | 0.14.0 | 3 of 3See more | 5,717 |
| corednssoftizyVerified publisher | 0.2.0 | 1 of 1See more | 2,415 |
| knative-servingsoftonic | 3.0.0 | 5 of 5See more | 18,189 |
| forecastlestakaterVerified publisher | 2.1.3 | 1 of 1See more | 976 |
| ingressmonitorcontrollerstakaterVerified publisher | 2.2.13 | 1 of 1See more | 863 |
| tigera-operatorstevehipwellVerified publisher | 2.15.0 | 1 of 1See more | 76 |
| vertical-pod-autoscalerstevehipwell-helm-charts-vertical-pod-autoscalerVerified publisher | 1.12.1 | 3 of 3See more | 642 |
| sn-platformstreamnative | 1.11.46 | 6 of 9See more | 77,633 |
Container images carrying it
6,327 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| library/ | 44a366dd7724 | stdlib | 1.26.9 | 2 |
| library/ | b8d940ca9376 | stdlib | 1.26.9 | 2 |
| library/ | 0abf60f81588 | stdlib | 1.26.9 | 2 |
| library/ | 1292844148b3 | stdlib | 1.26.9 | 2 |
| library/ | 23616f0bd3af | stdlib | 1.26.9 | 2 |
| library/ | 2bdff1534a7e | stdlib | 1.26.9 | 2 |
| library/ | 334b315c10e5 | stdlib | 1.26.9 | 2 |
| library/ | 607835cd628b | stdlib | 1.26.9 | 2 |
| library/ | e101f9db3191 | stdlib | 1.26.9 | 2 |
| library/ | 098862b1339f | stdlib | 1.26.9 | 2 |
| library/ | 1f995ad6fdb9 | stdlib | 1.26.9 | 2 |
| library/ | 41108d183e97 | stdlib | 1.26.9 | 2 |
| library/ | f71f6d0913c9 | stdlib | 1.26.9 | 2 |
| library/ | 0744ee5ef89c | stdlib | 1.26.9 | 2 |
| library/ | 212fe73edca5 | stdlib | 1.26.9 | 2 |
| library/ | ac80b6e09e5b | stdlib | 1.26.9 | 2 |
| library/ | 1a7b320b2942 | stdlib | 1.26.9 | 2 |
| library/ | 1bcddab51b80 | stdlib | 1.26.9 | 2 |
| library/ | 85319e5e541b | stdlib | 1.26.9 | 2 |
| library/ | 88fe8e0e09d6 | stdlib | 1.26.9 | 2 |
| library/ | 988010f74b61 | stdlib | 1.26.9 | 2 |
| library/ | c0d27f305460 | stdlib | 1.26.9 | 2 |
| library/ | 09f23e02d766 | stdlib | 1.26.9 | 2 |
| library/ | 1090bc3a8ccf | stdlib | 1.26.9 | 2 |
| library/ | 3645570cccdf | stdlib | 1.26.9 | 2 |
| library/ | 4aea012537ed | stdlib | 1.26.9 | 2 |
| library/ | 54451ecb8ab3 | stdlib | 1.26.9 | 2 |
| library/ | 6f3e42ad37de | stdlib | 1.26.9 | 2 |
| library/ | aadf2c0696f5 | stdlib | 1.26.9 | 2 |
| library/ | c6222b54873a | stdlib | 1.26.9 | 2 |
| library/ | ca0bd484cb98 | stdlib | 1.26.9 | 2 |
| library/ | caddd35b05cd | stdlib | 1.26.9 | 2 |
| library/ | e62fbf9d3e2b | stdlib | 1.26.9 | 2 |
| library/ | fb9065b6e3e2 | stdlib | 1.26.9 | 2 |
| library/ | 8dd6e3570dda | stdlib | 1.26.9 | 2 |
| library/ | 935b3f84c1e4 | stdlib | 1.26.9 | 2 |
| library/ | 148bb5411c18 | stdlib | 1.26.9 | 2 |
| library/ | a7cee7c8178f | stdlib | 1.26.9 | 2 |
| library/ | f474a901faec | stdlib | 1.26.9 | 2 |
| library/ | 6606553b5019 | stdlib | 1.26.9 | 2 |
| library/ | 6b9cbca6fac4 | stdlib | 1.26.9 | 2 |
| library/ | 7d5a6ae66572 | stdlib | 1.26.9 | 2 |
| library/ | eda951fd29a8 | stdlib | 1.26.9 | 2 |
| library/ | f5af5a5ce17f | stdlib | 1.26.9 | 2 |
| library/ | e6b279d01350 | stdlib | 1.26.9 | 2 |
| lightninglabs/ | f86bbec4dfb3 | stdlib | 1.26.9 | 2 |
| linuxserver/ | 45c5fe102ff3 | stdlib | 1.26.9 | 2 |
| listmonk/ | d2eac77ddfad | stdlib | 1.26.9 | 2 |
| listmonk/ | f535d59e1499 | stdlib | 1.26.9 | 2 |
| localstack/ | 801a3dff7f6a | stdlib | 1.26.9 | 2 |