CVE-2026-56857

Critical

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: Critical; worst across findings
CVSS: 9.8; base score, highest
EPSS: 0.005; 41st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,323; of 18,117 indexed, latest versions
Container images: 6,150; deployed by those charts
Fix available: 1 of 1; affected package

Root.Mkdir(All) can follow junctions out of the root on Windows in os

Carried by container images the latest versions of 5,323 of 18,117 indexed charts deploy, on 6,150 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+212 more	1.26.9	6,150

OSV records: GO-2026-6604
Trending: Rank 1 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,323 by stars

Chart

Latest

Affected images

Radar Score

pgbounceryasn77-pgbouncer

0.0.8

1 of 1 See more

pgbouncer yasn77-pgbouncer 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/yasn77/pgbouncer :v0.0.6	cc8c13550e44	stdlib@go1.18.6	1.26.9

Open the chart page →

1,883

ygdrassil-monitoringygdrassil

0.4.0

7 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

7 of the 10 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	stdlib@go1.23.5	1.26.9
prom/alertmanager :v0.28.0	d5155cfac40a	stdlib@go1.23.4	1.26.9
quay.io/prometheus-operator/prometheus-config-reloader :v0.79.2	193280a33bc1	stdlib@go1.23.4	1.26.9
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	stdlib@go1.22.5	1.26.9
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	stdlib@go1.23.4	1.26.9
quay.io/prometheus/pushgateway :v1.11.0	99392035ae99	stdlib@go1.23.4	1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.14.0	37d841299325	stdlib@go1.23.3	1.26.9

Open the chart page →

13,849

ceph-exporterygqygq2

1.0.0

1 of 1 See more

ceph-exporter ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
digitalocean/ceph_exporter :latest	19b163e3fb95	stdlib@go1.20	1.26.9

Open the chart page →

6,860

mdbygqygq2

5.0.7

1 of 1 See more

170

mod-chartygqygq2

5.1.0

1 of 1 See more

mod-chart ygqygq2 5.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
bitnami/nginx :latest	b8d42f076789	stdlib@go1.26.8	1.26.9

Open the chart page →

170

prometheusalertygqygq2

1.0.0

1 of 1 See more

prometheusalert ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
feiyu563/prometheus-alert :v4.9.1	224cfa68cbd9	stdlib@go1.20.6	1.26.9

Open the chart page →

2,366

utcookygqygq2

2.1.4

1 of 1 See more

utcook ygqygq2 2.1.4

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
bitnami/nginx :latest	b8d42f076789	stdlib@go1.26.8	1.26.9

Open the chart page →

170

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	stdlib@go1.18.1	1.26.9

Open the chart page →

2,994

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	stdlib@go1.17.8	1.26.9
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	stdlib@go1.17.9	1.26.9
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	stdlib@go1.16	1.26.9
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	stdlib@go1.16	1.26.9

Open the chart page →

12,474

nginx-vts-exporterymrs

0.1.2

1 of 1 See more

nginx-vts-exporter ymrs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
sophos/nginx-vts-exporter :latest	f1073556b29b	stdlib@go1.13.6	1.26.9

Open the chart page →

2,470

version-checkerymrs

0.2.3

1 of 1 See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	stdlib@go1.15.2	1.26.9

Open the chart page →

4,267

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	b28bae15e219	stdlib@go1.26.7	1.26.9
quay.io/prometheus/alertmanager :latest	e9733bafb1bd	stdlib@go1.26.8	1.26.9
quay.io/prometheus/prometheus :latest	efd719c99d83	stdlib@go1.27.1	1.26.9

Open the chart page →

863

ical-filter-proxyyungwood

0.3.1

1 of 1 See more

ical-filter-proxy yungwood 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
yungwood/ical-filter-proxy :0.3.1	ddc3f30ab05f	stdlib@go1.26.5	1.26.9

Open the chart page →

259

synergy-wholesale-exporteryungwood

0.1.1

1 of 1 See more

synergy-wholesale-exporter yungwood 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
yungwood/synergy-wholesale-exporter :0.1.1	054dce85989b	stdlib@go1.26.5	1.26.9

Open the chart page →

259

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	stdlib@go1.20.4	1.26.9
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	stdlib@go1.20.4	1.26.9

Open the chart page →

6,700

zahori-moonzahori

1.0.1

3 of 3 See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon :2.5.1	a8837b00ba1c	stdlib@go1.20.4	1.26.9
quay.io/aerokube/moon-conf :2.5.1	9ca307b30080	stdlib@go1.20.4	1.26.9
quay.io/aerokube/moon-ui :2.0.5	89990b146824	stdlib@go1.20.5	1.26.9

Open the chart page →

5,025

zahori-schedulerzahori

1.0.1

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	stdlib@go1.20.5	1.26.9

Open the chart page →

3,117

jenkinszanise-jenkins-helm-chart

0.1.0

1 of 1 See more

jenkins zanise-jenkins-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
jenkins/jenkins :lts	a660310e39ad	stdlib@go1.27.0	1.26.9

Open the chart page →

2,134

posthogzeet

0.23.2

2 of 9 See more

posthog zeet 0.23.2

2 of the 9 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	stdlib@go1.17.13	1.26.9
altinity/metrics-exporter :latest	a5206c713de7	stdlib@go1.26.8	1.26.9

Open the chart page →

4,799

endlessh-gozekker6

0.4.0

1 of 1 See more

endlessh-go zekker6 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/shizunge/endlessh-go :2026.0730.0	8826dad32623	stdlib@go1.26.5	1.26.9

Open the chart page →

827

karmazekker6

0.22.0

1 of 1 See more

karma zekker6 0.22.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
lmierzwa/karma :v0.133	f5d0a0ff4062	stdlib@go1.27.1	1.26.9

Open the chart page →

148

zookeeper-exporterzookeeper-exporter

0.1.0

1 of 1 See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
dabealu/zookeeper-exporter :latest	86106fec315f	stdlib@go1.14.15	1.26.9

Open the chart page →

2,294

zoo-project-druzoo-project

0.10.9

2 of 6 See more

zoo-project-dru zoo-project 0.10.9

2 of the 6 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/postgres :18.6-alpine3.24	77f585114c32	stdlib@go1.24.6	1.26.9
zooproject/zoo-project :dru-51e7d55383f24594959b69e58518961c6aa66740	da112e8d03f1	stdlib@go1.26.8	1.26.9

Open the chart page →

7,286

Container images carrying it

6,150 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
appwrite/appwrite :2.3.0	34ef77fb6e87	stdlib@go1.26.8	1.26.9	1
aquasec/harbor-scanner-trivy :0.31.2	6e790e233872	stdlib@go1.22.3	1.26.9	1
aquasec/harbor-scanner-trivy :0.20.0	7ea4aa3d2eb6	stdlib@go1.16.4	1.26.9	1
aquasec/kube-bench :v0.6.17	6672264accce	stdlib@go1.20.4	1.26.9	1
aquasec/kube-bench :v0.15.0	7a8fa32dce21	stdlib@go1.26.0	1.26.9	1
aquasec/kube-bench :v0.6.9	c329d73fea58	stdlib@go1.19	1.26.9	1
aquasec/postee :2.12.0-amd64	0795cba777e7	stdlib@go1.18.10	1.26.9	1
aquasec/postee-ui :2.12.0-amd64	c0467c3941dc	stdlib@go1.18.10	1.26.9	1
aquasec/starboard-operator :0.15.4	be34f709e1ce	stdlib@go1.17.8	1.26.9	1
aquasec/starboard-operator :0.15.38	e0b1c7ddc843	stdlib@go1.26.3	1.26.9	1
aquasec/tracee :0.24.1	cfbbfee972e6	stdlib@go1.24.9	1.26.9	1
aquasec/trivy :0.74.0	62b1e65e8869	stdlib@go1.26.6-X:jsonv2	1.26.9	1
aquasec/trivy :0.43.1	944a04445179	stdlib@go1.19.10	1.26.9	1
aquasec/trivy :0.32.0	973d0df16189	stdlib@go1.19	1.26.9	1
aquasec/trivy :0.75.0	af6acf9a6b85	stdlib@go1.27.1	1.26.9	1
aquasec/trivy :0.69.3	bcc376de8d77	stdlib@go1.25.7	1.26.9	1
arangodb/kube-arangodb :1.2.41	08d1720cec3b	stdlib@go1.22.3	1.26.9	1
arbuzov/claude-code-api :0.1.0	2d7dd8070610	stdlib@go1.23.10	1.26.9	1
arconixforge/mongodb-secure-backup :v1.1	c08d7c438966	stdlib@go1.22.10	1.26.9	1
arigaio/atlas-operator :0.7.11	1c4caa13c92b	stdlib@go1.24.5	1.26.9	1
aristidetm/basic-notebook :3.6.5	469dbc951224	stdlib@go1.22.5	1.26.9	1
articomio/articom-cx-operator :v1.2.3	89efda334136	stdlib@go1.25.14	1.26.9	1
artifacthub/db-migrator :v1.23.0	28c13565ac5c	stdlib@go1.26.4	1.26.9	1
artifacthub/db-migrator :v1.19.0	2a746b289fcd	stdlib@go1.22.4	1.26.9	1
artifacthub/hub :v1.19.0	111918d8c399	stdlib@go1.22.4	1.26.9	1
artifacthub/hub :v1.23.0	7d3a91c539dc	stdlib@go1.26.4	1.26.9	1
artifacthub/scanner :v1.23.0	2d8365601f0e	stdlib@go1.25.7	1.26.9	1
artifacthub/scanner :v1.19.0	323d026e78c3	stdlib@go1.21.8	1.26.9	1
artifacthub/tracker :v1.23.0	5368d21a6e5c	stdlib@go1.24.4	1.26.9	1
artifacthub/tracker :v1.19.0	6596c8c4d955	stdlib@go1.22.4	1.26.9	1
artur9010/wait-for :v1.0.0	6b4de3ce8b0e	stdlib@go1.22.4	1.26.9	1
arunvelsriram/utils :latest	655ad18fd8d6	stdlib@go1.23.8	1.26.9	1
ashupednekar535/litefunctions-operator :latest	80ad0954b9d9	stdlib@go1.24.13	1.26.9	1
ashupednekar535/litefunctions-portal :latest	460f010659fe	stdlib@go1.26.1	1.26.9	1
assistiot/authorization_db :latest	c3adbab6a3e7	stdlib@go1.18.2	1.26.9	1
assistiot/cybersecurity-monitoring_id-wzh :latest	0aacefac9677	stdlib@go1.14.12	1.26.9	1
assistiot/cybersecurity-monitoring_ir-cas :latest	6a107f224c34	stdlib@go1.18.2	1.26.9	1
assistiot/data_integrity_verification :1.0.0	eb7f5d765ab6	stdlib@go1.17.13	1.26.9	1
assistiot/distributed_broker :1.0.0	33e02dad168f	stdlib@go1.17.13	1.26.9	1
assistiot/dlt_based_fl :1.1.0	4bc3d92788ed	stdlib@go1.17.13	1.26.9	1
assistiot/fl_orchestrator :dbmongo4-latest	d157fbe150e3	stdlib@go1.17.10	1.26.9	1
assistiot/identity-manager_db :latest	0d3e6d35f168	stdlib@go1.18.2	1.26.9	1
assistiot/logging_auditing :1.0.0	790dbb198e86	stdlib@go1.17.13	1.26.9	1
assistiot/open_api_backend :1.1.2	30812ba93555	stdlib@go1.18.6	1.26.9	1
assistiot/smart-orchestrator_helm :latest	9bb46ea14e8e	stdlib@go1.22.1	1.26.9	1
astarte/astarte-kubernetes-operator :26.5.1	e3ff1b3c0c98	stdlib@go1.24.13	1.26.9	1
atlassian/bamboo :12.1.12	eb98d6fbeee7	stdlib@go1.22.2	1.26.9	1
atlassian/bamboo-agent-base :12.1.12	a8d7b10b667a	stdlib@go1.22.2	1.26.9	1
authelia/authelia :4.39.28	bd97cff4fcbf	stdlib@go1.27.1	1.26.9	1
authzed/spicedb :latest	aa96009a0477	stdlib@go1.26.6	1.26.9	1