CVE-2026-56857

Critical

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: Critical; worst across findings
CVSS: 9.8; base score, highest
EPSS: 0.005; 41st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,323; of 18,117 indexed, latest versions
Container images: 6,150; deployed by those charts
Fix available: 1 of 1; affected package

Root.Mkdir(All) can follow junctions out of the root on Windows in os

Carried by container images the latest versions of 5,323 of 18,117 indexed charts deploy, on 6,150 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+212 more	1.26.9	6,150

OSV records: GO-2026-6604
Trending: Rank 1 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,323 by stars

Chart

Latest

Affected images

Radar Score

pgbounceryasn77-pgbouncer

0.0.8

1 of 1 See more

pgbouncer yasn77-pgbouncer 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/yasn77/pgbouncer :v0.0.6	cc8c13550e44	stdlib@go1.18.6	1.26.9

Open the chart page →

1,883

ygdrassil-monitoringygdrassil

0.4.0

7 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

7 of the 10 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	stdlib@go1.23.5	1.26.9
prom/alertmanager :v0.28.0	d5155cfac40a	stdlib@go1.23.4	1.26.9
quay.io/prometheus-operator/prometheus-config-reloader :v0.79.2	193280a33bc1	stdlib@go1.23.4	1.26.9
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	stdlib@go1.22.5	1.26.9
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	stdlib@go1.23.4	1.26.9
quay.io/prometheus/pushgateway :v1.11.0	99392035ae99	stdlib@go1.23.4	1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.14.0	37d841299325	stdlib@go1.23.3	1.26.9

Open the chart page →

13,849

ceph-exporterygqygq2

1.0.0

1 of 1 See more

ceph-exporter ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
digitalocean/ceph_exporter :latest	19b163e3fb95	stdlib@go1.20	1.26.9

Open the chart page →

6,860

mdbygqygq2

5.0.7

1 of 1 See more

170

mod-chartygqygq2

5.1.0

1 of 1 See more

mod-chart ygqygq2 5.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
bitnami/nginx :latest	b8d42f076789	stdlib@go1.26.8	1.26.9

Open the chart page →

170

prometheusalertygqygq2

1.0.0

1 of 1 See more

prometheusalert ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
feiyu563/prometheus-alert :v4.9.1	224cfa68cbd9	stdlib@go1.20.6	1.26.9

Open the chart page →

2,366

utcookygqygq2

2.1.4

1 of 1 See more

utcook ygqygq2 2.1.4

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
bitnami/nginx :latest	b8d42f076789	stdlib@go1.26.8	1.26.9

Open the chart page →

170

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	stdlib@go1.18.1	1.26.9

Open the chart page →

2,994

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	stdlib@go1.17.8	1.26.9
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	stdlib@go1.17.9	1.26.9
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	stdlib@go1.16	1.26.9
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	stdlib@go1.16	1.26.9

Open the chart page →

12,474

nginx-vts-exporterymrs

0.1.2

1 of 1 See more

nginx-vts-exporter ymrs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
sophos/nginx-vts-exporter :latest	f1073556b29b	stdlib@go1.13.6	1.26.9

Open the chart page →

2,470

version-checkerymrs

0.2.3

1 of 1 See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	stdlib@go1.15.2	1.26.9

Open the chart page →

4,267

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	b28bae15e219	stdlib@go1.26.7	1.26.9
quay.io/prometheus/alertmanager :latest	e9733bafb1bd	stdlib@go1.26.8	1.26.9
quay.io/prometheus/prometheus :latest	efd719c99d83	stdlib@go1.27.1	1.26.9

Open the chart page →

863

ical-filter-proxyyungwood

0.3.1

1 of 1 See more

ical-filter-proxy yungwood 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
yungwood/ical-filter-proxy :0.3.1	ddc3f30ab05f	stdlib@go1.26.5	1.26.9

Open the chart page →

259

synergy-wholesale-exporteryungwood

0.1.1

1 of 1 See more

synergy-wholesale-exporter yungwood 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
yungwood/synergy-wholesale-exporter :0.1.1	054dce85989b	stdlib@go1.26.5	1.26.9

Open the chart page →

259

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	stdlib@go1.20.4	1.26.9
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	stdlib@go1.20.4	1.26.9

Open the chart page →

6,700

zahori-moonzahori

1.0.1

3 of 3 See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon :2.5.1	a8837b00ba1c	stdlib@go1.20.4	1.26.9
quay.io/aerokube/moon-conf :2.5.1	9ca307b30080	stdlib@go1.20.4	1.26.9
quay.io/aerokube/moon-ui :2.0.5	89990b146824	stdlib@go1.20.5	1.26.9

Open the chart page →

5,025

zahori-schedulerzahori

1.0.1

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	stdlib@go1.20.5	1.26.9

Open the chart page →

3,117

jenkinszanise-jenkins-helm-chart

0.1.0

1 of 1 See more

jenkins zanise-jenkins-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
jenkins/jenkins :lts	a660310e39ad	stdlib@go1.27.0	1.26.9

Open the chart page →

2,134

posthogzeet

0.23.2

2 of 9 See more

posthog zeet 0.23.2

2 of the 9 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	stdlib@go1.17.13	1.26.9
altinity/metrics-exporter :latest	a5206c713de7	stdlib@go1.26.8	1.26.9

Open the chart page →

4,799

endlessh-gozekker6

0.4.0

1 of 1 See more

endlessh-go zekker6 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/shizunge/endlessh-go :2026.0730.0	8826dad32623	stdlib@go1.26.5	1.26.9

Open the chart page →

827

karmazekker6

0.22.0

1 of 1 See more

karma zekker6 0.22.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
lmierzwa/karma :v0.133	f5d0a0ff4062	stdlib@go1.27.1	1.26.9

Open the chart page →

148

zookeeper-exporterzookeeper-exporter

0.1.0

1 of 1 See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
dabealu/zookeeper-exporter :latest	86106fec315f	stdlib@go1.14.15	1.26.9

Open the chart page →

2,294

zoo-project-druzoo-project

0.10.9

2 of 6 See more

zoo-project-dru zoo-project 0.10.9

2 of the 6 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/postgres :18.6-alpine3.24	77f585114c32	stdlib@go1.24.6	1.26.9
zooproject/zoo-project :dru-51e7d55383f24594959b69e58518961c6aa66740	da112e8d03f1	stdlib@go1.26.8	1.26.9

Open the chart page →

7,286

Container images carrying it

6,150 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
bitnamilegacy/mariadb :10.6.12-debian-11-r16	78847062532a	stdlib@go1.19.7	1.26.9	1
bitnamilegacy/mariadb :11.4.3-debian-12-r0	8b3778160e34	stdlib@go1.22.6	1.26.9	1
bitnamilegacy/mariadb :11.4.5-debian-12-r12	8bc50a0961a7	stdlib@go1.23.8	1.26.9	1
bitnamilegacy/mariadb :11.4.7-debian-12-r2	90dc6acb7b2e	stdlib@go1.23.10	1.26.9	1
bitnamilegacy/mariadb :latest	bbd4e17f1ef8	stdlib@go1.24.5	1.26.9	1
bitnamilegacy/mariadb-galera :10.6.12-debian-11-r16	43a70df0e7c6	stdlib@go1.19.7	1.26.9	1
bitnamilegacy/mariadb-galera :11.3.2-debian-12-r9	aee9c668098f	stdlib@go1.22.5	1.26.9	1
bitnamilegacy/mariadb-galera :11.4.3-debian-12-r0	cb8beb6dbb58	stdlib@go1.22.6	1.26.9	1
bitnamilegacy/matomo :5.3.2-debian-12-r13	f02c000c54b1	stdlib@go1.25.0	1.26.9	1
bitnamilegacy/minio :2023.12.23	0b60b6565ab2	stdlib@go1.20.13	1.26.9	1
bitnamilegacy/minio :2022.12.12-debian-11-r9	0f7c8ac484ac	stdlib@go1.18.9	1.26.9	1
bitnamilegacy/minio :2024.8.3-debian-12-r1	5501c419f42e	stdlib@go1.22.5	1.26.9	1
bitnamilegacy/minio :2023.12.23-debian-11-r2	5bb0aa825d16	stdlib@go1.21.5	1.26.9	1
bitnamilegacy/minio :2025.7.23-debian-12-r5	6dabb4a2088c	stdlib@go1.24.6	1.26.9	1
bitnamilegacy/minio :2025.7.23-debian-12-r0	8935e75fa5d1	stdlib@go1.24.2	1.26.9	1
bitnamilegacy/minio :2024.7.4-debian-12-r0	952f86d1116c	stdlib@go1.21.12	1.26.9	1
bitnamilegacy/minio :2025.3.12-debian-12-r0	ba9f3b4b0b00	stdlib@go1.23.7	1.26.9	1
bitnamilegacy/minio :2024.12.18-debian-12-r1	c0ede65eb88e	stdlib@go1.22.11	1.26.9	1
bitnamilegacy/minio :2024.12.18-debian-12-r0	cce234b4381a	stdlib@go1.22.10	1.26.9	1
bitnamilegacy/minio :2025.4.22-debian-12-r1	d7cd0e172c4c	stdlib@go1.24.2	1.26.9	1
bitnamilegacy/mongodb :7.0.14-debian-12-r3	21e8f8baa432	stdlib@go1.21.12	1.26.9	1
bitnamilegacy/mongodb :8.0.13-debian-12-r0	2579e968033e	stdlib@go1.25.0	1.26.9	1
bitnamilegacy/mongodb :7.0.8-debian-12-r2	3163c3842bfd	stdlib@go1.20.12	1.26.9	1
bitnamilegacy/mongodb :5.0.10	3bb1deeaf9d0	stdlib@go1.18.4	1.26.9	1
bitnamilegacy/mongodb :3.6.21	3e51da56fc54	stdlib@go1.15.1	1.26.9	1
bitnamilegacy/mongodb :7.0.5-debian-11-r6	6fe59ed5d79f	stdlib@go1.20.12	1.26.9	1
bitnamilegacy/mongodb :latest	b0652af9c8d0	stdlib@go1.23.8	1.26.9	1
bitnamilegacy/mongodb :4.4.5	e3c9d6b4bc92	stdlib@go1.15.8	1.26.9	1
bitnamilegacy/mongodb-exporter :0.39.0-debian-11-r106	de7256c7adcd	stdlib@go1.20.7	1.26.9	1
bitnamilegacy/mysql :8.4.5-debian-12-r0	7089d796fc9b	stdlib@go1.23.8	1.26.9	1
bitnamilegacy/mysql :8.0.36-debian-11-r3	8aad73aa0c6d	stdlib@go1.21.6	1.26.9	1
bitnamilegacy/mysql :8.0.35-debian-11-r2	be03e8ea6129	stdlib@go1.21.5	1.26.9	1
bitnamilegacy/mysqld-exporter :0.14.0-debian-11-r103	04768b637c94	stdlib@go1.17.8	1.26.9	1
bitnamilegacy/mysqld-exporter :0.15.1-debian-12-r26	11a5f0b79e79	stdlib@go1.21.12	1.26.9	1
bitnamilegacy/mysqld-exporter :0.13.0	a7e14cc919cb	stdlib@go1.16.4	1.26.9	1
bitnamilegacy/nats :2.11.8-debian-12-r0	fa0cfba6034a	stdlib@go1.24.6	1.26.9	1
bitnamilegacy/nginx :1.27.1	934d1acd5ca8	stdlib@go1.22.7	1.26.9	1
bitnamilegacy/nginx :1.28.0-debian-12-r0	eaf9066e86f6	stdlib@go1.23.8	1.26.9	1
bitnamilegacy/opensearch :2.18.0-debian-12-r0	d8440eb6b290	stdlib@go1.22.8	1.26.9	1
bitnamilegacy/os-shell :12-debian-12-r32	17444b4b2c96	stdlib@go1.22.8	1.26.9	1
bitnamilegacy/os-shell :11-debian-11-r96	8643af4facff	stdlib@go1.21.6	1.26.9	1
bitnamilegacy/os-shell :12-debian-12-r43	9ba5d16f9c64	stdlib@go1.23.8	1.26.9	1
bitnamilegacy/os-shell :12-debian-12-r16	d24925821dd2	stdlib@go1.21.7	1.26.9	1
bitnamilegacy/os-shell :12-debian-12-r50	e328cff6e450	stdlib@go1.24.6	1.26.9	1
bitnamilegacy/pgbouncer :1.23.1	92356da09704	stdlib@go1.22.10	1.26.9	1
bitnamilegacy/postgres-exporter :0.17.1-debian-12-r2	0cca9d93a617	stdlib@go1.23.7	1.26.9	1
bitnamilegacy/postgres-exporter :0.15.0-debian-12-r44	e7e1b3a90682	stdlib@go1.22.8	1.26.9	1
bitnamilegacy/postgresql :15.2.0-debian-11-r11	3e65a6b89e38	stdlib@go1.18.2	1.26.9	1
bitnamilegacy/prometheus :2.54.1-debian-12-r4	08b1b7cb6a5b	stdlib@go1.22.7	1.26.9	1
bitnamilegacy/rabbitmq :3.10.8	8f7161d8ce19	stdlib@go1.16.7	1.26.9	1