CVE-2026-56857
MediumAdvisory
Published 8 Oct 2026In the index since 9 Oct 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.5
- base score, highest
- EPSS
- 0.002
- 10th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 5,544
- of 18,087 indexed, latest versions
- Container images
- 6,392
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
Root.Mkdir(All) can follow junctions out of the root on Windows in os
Carried by container images the latest versions of 5,544 of 18,087 indexed charts deploy, on 6,392 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| stdlibgolang | go1.13, go1.13.1, go1.13.3, go1.13.4+212 more | 1.26.9 | 6,392 |
| ingress-nginx-controller-1.15apk | 1.15.10-r3 | no fix listed | 1 |
- OSV records
- CGA-28rp-569c-vjc3GO-2026-6604
- Also known as
- CGA-3j79-hxrj-98c9, CGA-4j4m-4mp6-xp7x, CGA-85gw-4745-j8q8, CGA-929x-9pxj-5mv4, CGA-jc7p-vgxm-j32v
- Trending
- Rank 4 in indexed charts, since 9 Oct 2026. See the ranking →
Charts affected
5,544 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| nsqbeeinventor | 1.3.0 | 1 of 1See more | 1,322 |
| frigateblakeblackshear | 7.8.0 | 1 of 1See more | 4,227 |
| kube-prometheuschoerodon | 9.3.1 | 4 of 7See more | 17,143 |
| cloudflare-ddnscloudflareVerified publisher | 1.0.3 | 1 of 1See more | 622 |
| timescaledbcloudpirates-timescaledbVerified publisher | 0.13.12 | 1 of 1See more | 1,085 |
| openstack-cinder-csicloud-provider-openstack | 2.36.5 | 7 of 7See more | 6,419 |
| csi-secrets-store-provider-azurecsi-secrets-store-provider-azureVerified publisher | 1.8.2 | 5 of 5See more | 4,813 |
| paperless-ngxfmjstudios | 0.2.8 | 3 of 5See more | 35,065 |
| minifluxgabe565Verified publisher | 0.9.2 | 1 of 2See more | 1,957 |
| cubestoregadsme | 1.2.0 | 1 of 3See more | 3,934 |
| waypointhashicorpVerified publisher | 0.1.21 | 1 of 2See more | 4,963 |
| hivemq-operatorhivemqOfficialVerified publisher | 0.11.62 | 1 of 2See more | 9,407 |
| jaeger-all-in-onejaeger-all-in-oneVerified publisher | 0.1.12 | 1 of 1See more | 1,834 |
| cassandrakubelauncherVerified publisher | 0.1.29 | 1 of 1See more | 1,545 |
| etcdkubelauncherVerified publisher | 0.4.6 | 1 of 1See more | 682 |
| kafkakubelauncherVerified publisher | 0.1.28 | 1 of 1See more | 1,406 |
| keycloakkubelauncherVerified publisher | 0.5.0 | 1 of 1See more | 655 |
| kubectlkubelauncherVerified publisher | 0.3.0 | 1 of 1See more | 981 |
| mariadbkubelauncherVerified publisher | 1.0.0 | 1 of 1See more | 1,006 |
| mongodbkubelauncherVerified publisher | 0.4.7 | 1 of 1See more | 910 |
| rabbitmqkubelauncherVerified publisher | 0.2.16 | 1 of 1See more | 1,280 |
| rediskubelauncherVerified publisher | 0.5.4 | 1 of 1See more | 610 |
| zookeeperkubelauncherVerified publisher | 0.2.12 | 1 of 1See more | 1,209 |
| minecraft-proxyminecraft-server-chartsVerified publisher | 3.10.0 | 1 of 1See more | 3,267 |
| ntfyntfyVerified publisher | 0.5.23 | 1 of 1See more | 141 |
| mauticone-acre-fundVerified publisher | 0.1.7 | 1 of 3See more | 3,701 |
| opentelemetry-kube-stackopentelemetry-helmOfficialVerified publisher | 0.24.3 | 2 of 2See more | 951 |
| purelbpurelb | 0.0.0-106-ipv6-lbip-052cedab | 1 of 2See more | 5,546 |
| dex-k8s-authenticatorsagikazarmarkVerified publisher | 0.0.3 | 1 of 1See more | 3,961 |
| thanosstevehipwellVerified publisher | 1.24.1 | 1 of 1See more | 426 |
| gatustwin | 1.5.0 | 1 of 1See more | 1,130 |
| hedgedocadfinisVerified publisher | 0.6.1 | 1 of 2See more | 4,158 |
| caddyalekcVerified publisher | 0.9.2 | 1 of 1See more | 141 |
| aspnet-corebitnamiVerified publisher | 9.5.1 | 1 of 3See more | 166 |
| yopasscloudhippieVerified publisher | 9.19.0 | 1 of 1See more | 476 |
| connaisseurconnaisseurVerified publisher | 2.13.0 | 2 of 2See more | 4,109 |
| kubeviewcowboysysopVerified publisher | 6.0.0 | 1 of 1See more | 2,541 |
| dependabot-gitlabdependabot-gitlabVerified publisher | 6.3.0 | 3 of 3See more | 43,319 |
| code-serverdeploy-code-server | 1.0.3 | 1 of 2See more | 6,403 |
| devtron-operatordevtron | 0.23.3 | 10 of 11See more | 41,631 |
| drone-runner-kubedroneVerified publisher | 0.1.10 | 1 of 1See more | 3,026 |
| fluent-operatorfluent | 4.3.0 | 1 of 1See more | 362 |
| gatekeepergogatekeeperVerified publisher | 0.1.66 | 1 of 1See more | 131 |
| grafana-operatorgrafana | 5.25.0 | 1 of 1See more | 153 |
| kubernetes-ingresshaproxytechVerified publisher | 1.54.2 | 1 of 1See more | 524 |
| envoy-gatewayhelmforgeVerified publisher | 2.1.2 | 3 of 3See more | 3,386 |
| n8nhelmforgeVerified publisher | 2.1.3 | 1 of 2See more | 1,948 |
| ilumilumOfficialVerified publisher | 6.7.3 | 6 of 19See more | 27,560 |
| syncthingk8s-home-lab-repo | 5.2.0 | 1 of 1See more | 1,466 |
| kube-greenkube-green-officialOfficialVerified publisher | 0.7.1 | 1 of 1See more | 911 |
Container images carrying it
6,392 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ambassador/ | b7eb1be3345d | stdlib | 1.26.9 | 1 |
| ambassador/ | 5fc571509b8c | stdlib | 1.26.9 | 1 |
| ambassador/ | 7a1ea0d934fb | stdlib | 1.26.9 | 1 |
| amd64/ | e20a653e0f51 | stdlib | 1.26.9 | 1 |
| anamskenneth/ | 9ecf04f42cc3 | stdlib | 1.26.9 | 1 |
| anchore/ | bde9eedf639d | stdlib | 1.26.9 | 1 |
| anchore/ | 2b424b3b9a03 | stdlib | 1.26.9 | 1 |
| anchore/ | 8aad6d0912dd | stdlib | 1.26.9 | 1 |
| anchore/ | 1a1a374658c8 | stdlib | 1.26.9 | 1 |
| andrcuns/ | 43060f159f4c | stdlib | 1.26.9 | 1 |
| andrcuns/ | b4a8eb20581a | stdlib | 1.26.9 | 1 |
| andreacioni/ | 2938b310090a | stdlib | 1.26.9 | 1 |
| andrewmackrodt/ | 33f9080470c9 | stdlib | 1.26.9 | 1 |
| ankane/ | d3a9d8ac27bb | stdlib | 1.26.9 | 1 |
| anonaddy/ | 957a95565166 | stdlib | 1.26.9 | 1 |
| ansgroup/ | cd6b0ef2b309 | stdlib | 1.26.9 | 1 |
| ansiblesemaphore/ | 03d1f8684027 | stdlib | 1.26.9 | 1 |
| antrea/ | c10bc45c6272 | stdlib | 1.26.9 | 1 |
| antrea/ | f1373d39217c | stdlib | 1.26.9 | 1 |
| antrea/ | 19f3c0113330 | stdlib | 1.26.9 | 1 |
| antrea/ | 065193e7572f | stdlib | 1.26.9 | 1 |
| anujarosha/ | ed60e46870b6 | stdlib | 1.26.9 | 1 |
| anujdatar/ | 685df04a643b | stdlib | 1.26.9 | 1 |
| apache/ | 64e58748b6b9 | stdlib | 1.26.9 | 1 |
| apache/ | adf7260c2c5f | stdlib | 1.26.9 | 1 |
| apache/ | ce90bdc3d2af | stdlib | 1.26.9 | 1 |
| apache/ | e5560ad0b86e | stdlib | 1.26.9 | 1 |
| apache/ | a0d71b0e30a5 | stdlib | 1.26.9 | 1 |
| apache/ | c010ea7d1694 | stdlib | 1.26.9 | 1 |
| apache/ | 412f92cde0b3 | stdlib | 1.26.9 | 1 |
| apache/ | 3bb13d14f64a | stdlib | 1.26.9 | 1 |
| apache/ | d173e7efe258 | stdlib | 1.26.9 | 1 |
| apache/ | ffe68d6b99c0 | stdlib | 1.26.9 | 1 |
| apache/ | 133d35d2c263 | stdlib | 1.26.9 | 1 |
| apache/ | b4ec8c18d079 | stdlib | 1.26.9 | 1 |
| apache/ | 4db34508137f | stdlib | 1.26.9 | 1 |
| apache/ | 90b7fa1dc018 | stdlib | 1.26.9 | 1 |
| apache/ | ab9cc988828c | stdlib | 1.26.9 | 1 |
| apache/ | 49fc54894fdf | stdlib | 1.26.9 | 1 |
| apache/ | 90e6a62a578a | stdlib | 1.26.9 | 1 |
| apache/ | 95c6b951f38a | stdlib | 1.26.9 | 1 |
| apecloud/ | d48bcbd38066 | stdlib | 1.26.9 | 1 |
| apecloud/ | 5832d1a9097a | stdlib | 1.26.9 | 1 |
| apecloud/ | 98abc64aa985 | stdlib | 1.26.9 | 1 |
| apecloud/ | c93655ccb2d7 | stdlib | 1.26.9 | 1 |
| apecloud/ | 32bd92c7f7fa | stdlib | 1.26.9 | 1 |
| apecloud/ | dbca95a15bc1 | stdlib | 1.26.9 | 1 |
| apecloud/ | ff2858eab9cc | stdlib | 1.26.9 | 1 |
| appwrite/ | 1aaa70127114 | stdlib | 1.26.9 | 1 |
| appwrite/ | 34ef77fb6e87 | stdlib | 1.26.9 | 1 |