CVE-2026-56857
MediumAdvisory
Published 8 Oct 2026In the index since 9 Oct 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.5
- base score, highest
- EPSS
- 0.002
- 10th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 5,544
- of 18,087 indexed, latest versions
- Container images
- 6,392
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
Root.Mkdir(All) can follow junctions out of the root on Windows in os
Carried by container images the latest versions of 5,544 of 18,087 indexed charts deploy, on 6,392 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| stdlibgolang | go1.13, go1.13.1, go1.13.3, go1.13.4+212 more | 1.26.9 | 6,392 |
| ingress-nginx-controller-1.15apk | 1.15.10-r3 | no fix listed | 1 |
- OSV records
- CGA-28rp-569c-vjc3GO-2026-6604
- Also known as
- CGA-3j79-hxrj-98c9, CGA-4j4m-4mp6-xp7x, CGA-85gw-4745-j8q8, CGA-929x-9pxj-5mv4, CGA-jc7p-vgxm-j32v
- Trending
- Rank 4 in indexed charts, since 9 Oct 2026. See the ranking →
Charts affected
5,544 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| mortalgpumortalgpuOfficialVerified publisher | 1.3.7 | 1 of 1See more | 711 |
| move2kubemove2kube | 0.3.15 | 1 of 1See more | 4,795 |
| mycelmycelOfficialVerified publisher | 3.10.0 | 1 of 1See more | 323 |
| nacknatsVerified publisher | 0.35.0 | 1 of 1See more | 444 |
| ndb-operatorndb-operatorOfficialVerified publisher | 0.5.11 | 1 of 1See more | 154 |
| nebraskanebraska | 3.0.0 | 1 of 2See more | 4,923 |
| netbird-api-exporternetbird-api-exporterVerified publisher | 0.2.17 | 1 of 1See more | 269 |
| netbird-operatornetbird-operator | 0.8.0 | 1 of 1See more | 245 |
| keycloak-operatornewsaktuell | 0.1.7 | 1 of 1See more | 6,328 |
| mstreamnicholaswildeVerified publisher | 2.1.2 | 1 of 1See more | 5,807 |
| gateway-apinicklasfrahm-gateway-apiVerified publisher | 0.2.0 | 1 of 1See more | 1,702 |
| observalobservalVerified publisher | 1.14.0 | 2 of 8See more | 6,591 |
| aws-xrayokgoloveVerified publisher | 5.0.0 | 1 of 1See more | 590 |
| olivetinolivetinOfficialVerified publisher | 4.0.0 | 1 of 1See more | 672 |
| flagsmithone-acre-fundVerified publisher | 0.1.5 | 1 of 6See more | 8,027 |
| kobotoolboxone-acre-fundVerified publisher | 0.7.4 | 2 of 9See more | 23,953 |
| secrets-injectoronepassword-connect | 1.2.0 | 1 of 1See more | 1,506 |
| opentelemetry-ebpfopentelemetry-helmOfficialVerified publisher | 0.1.7 | 1 of 4See more | 3,680 |
| opentelemetry-ebpf-instrumentationopentelemetry-helmOfficialVerified publisher | 0.14.3 | 1 of 1See more | 128 |
| oesopsmxVerified publisher | 4.0.32 | 8 of 25See more | 110,976 |
| pacto-operatorpacto-operatorOfficialVerified publisher | 5.4.2 | 1 of 1See more | 152 |
| ipfs-clusterparadeum-teamVerified publisher | 0.0.19 | 2 of 2See more | 5,577 |
| permifypermifyVerified publisher | 0.5.0 | 1 of 1See more | 1,509 |
| persespersesOfficialVerified publisher | 0.23.3 | 1 of 1See more | 377 |
| platzioplatz-ioVerified publisher | 0.6.5 | 1 of 2See more | 3,571 |
| plecopleco | 0.24.0 | 1 of 1See more | 1,975 |
| ipmi-exporterpnnl-miscscripts | 0.1.15 | 1 of 1See more | 4,317 |
| pomeriumpomerium | 34.0.1 | 1 of 1See more | 2,830 |
| prometheus-memcached-exporterprometheus-communityVerified publisher | 0.6.0 | 1 of 1See more | 166 |
| prometheus-pgbouncer-exporterprometheus-communityVerified publisher | 0.10.1 | 1 of 1See more | 502 |
| prometheus-systemd-exporterprometheus-communityVerified publisher | 0.5.2 | 1 of 1See more | 1,180 |
| prometheus-yet-another-cloudwatch-exporterprometheus-communityVerified publisher | 0.48.0 | 1 of 1See more | 89 |
| kube-prometheus-stackprometheus-worawutchan | 12.8.0 | 4 of 6See more | 16,893 |
| qgis-serverqgis-serverVerified publisher | 0.1.10 | 1 of 3See more | 6,339 |
| nfs-server-provisionerraphaelVerified publisher | 1.3.0 | 1 of 1See more | 3,890 |
| repoflowrepoflow-helm-public | 0.9.1 | 1 of 8See more | 14,455 |
| wordpress-hardenedriotkit-org | 2.0.0 | 2 of 2See more | 8,355 |
| backrestrobertobochetVerified publisher | 0.7.0 | 1 of 1See more | 1,252 |
| supabaserock8sVerified publisher | 0.0.6 | 1 of 1See more | 644 |
| rqliterqliteOfficialVerified publisher | 2.0.0 | 1 of 1See more | 1,720 |
| qbittorrent-vpnrtomik-helm-chartsVerified publisher | 0.0.2 | 1 of 2See more | 1,690 |
| sabliersablier-helm-chartsOfficialVerified publisher | 1.8.1 | 1 of 1See more | 389 |
| satisfactory-serversatisfactoryVerified publisher | 0.1.6 | 1 of 1See more | 4,472 |
| seaweedfs-csi-driverseaweedfs-csi-driver | 0.2.40 | 7 of 7See more | 8,501 |
| seldon-core-operatorseldon | 1.19.0 | 1 of 1See more | 1,276 |
| bentoself-hosters-by-nightVerified publisher | 0.9.1 | 1 of 1See more | 1,699 |
| lldapself-hosters-by-nightVerified publisher | 0.5.2 | 2 of 2See more | 4,910 |
| appshini4iVerified publisher | 0.4.0 | 1 of 1See more | 1,026 |
| skypilotskypilotOfficialVerified publisher | 0.14.0 | 3 of 3See more | 5,921 |
| corednssoftizyVerified publisher | 0.2.0 | 1 of 1See more | 2,468 |
Container images carrying it
6,392 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| automatischio/ | 3bace7a12d5f | stdlib | 1.26.9 | 1 |
| avaprotocol/ | c430ea5c37d6 | stdlib | 1.26.9 | 1 |
| aveshasystems/ | 53fc6d009e04 | stdlib | 1.26.9 | 1 |
| axllent/ | 98b916bd3c8d | stdlib | 1.26.9 | 1 |
| axllent/ | c96991d9bef7 | stdlib | 1.26.9 | 1 |
| ayushsobti/ | fc181870c60f | stdlib | 1.26.9 | 1 |
| b3log/ | 95c0d129bc19 | stdlib | 1.26.9 | 1 |
| b3log/ | d740a1d3ed6b | stdlib | 1.26.9 | 1 |
| basa/ | 34cadcaa29c4 | stdlib | 1.26.9 | 1 |
| baserow/ | af9aa6fe8482 | stdlib | 1.26.9 | 1 |
| baserow/ | e0b3c8130b91 | stdlib | 1.26.9 | 1 |
| baserow/ | df0c42eb67e8 | stdlib | 1.26.9 | 1 |
| bbernhard/ | 2cf09d66a86f | stdlib | 1.26.9 | 1 |
| bbernhard/ | 549ad08d7e14 | stdlib | 1.26.9 | 1 |
| beanbag/ | 6b840f546e1c | stdlib | 1.26.9 | 1 |
| bedag/ | 447a88598f4c | stdlib | 1.26.9 | 1 |
| beopenit/ | d24c323fe7c3 | stdlib | 1.26.9 | 1 |
| beopenit/ | d3999cb8d026 | stdlib | 1.26.9 | 1 |
| beopenit/ | b4d9f9bee224 | stdlib | 1.26.9 | 1 |
| beopenit/ | 75a48144e682 | stdlib | 1.26.9 | 1 |
| berkeleyskypilot/ | a8362d205365 | stdlib | 1.26.9 | 1 |
| berkeleyskypilot/ | 8da2f3cda472 | stdlib | 1.26.9 | 1 |
| betterdb/ | 97dcd2d2192f | stdlib | 1.26.9 | 1 |
| bicarus/ | b1dab0721e1c | stdlib | 1.26.9 | 1 |
| bicarus/ | bed688d16762 | stdlib | 1.26.9 | 1 |
| bicarus/ | 06cab48e9334 | stdlib | 1.26.9 | 1 |
| binhex/ | fb8952921ab6 | stdlib | 1.26.9 | 1 |
| binrc/ | e199c334b957 | stdlib | 1.26.9 | 1 |
| binwiederhier/ | 6ef4b819f722 | stdlib | 1.26.9 | 1 |
| binwiederhier/ | 83e2e43d9956 | stdlib | 1.26.9 | 1 |
| bitnamilegacy/ | 33ae872fc99d | stdlib | 1.26.9 | 1 |
| bitnamilegacy/ | 15d4647fd491 | stdlib | 1.26.9 | 1 |
| bitnamilegacy/ | 9cfd2df1294d | stdlib | 1.26.9 | 1 |
| bitnamilegacy/ | e6f6ddcce2f1 | stdlib | 1.26.9 | 1 |
| bitnamilegacy/ | 4b08d0c5af8d | stdlib | 1.26.9 | 1 |
| bitnamilegacy/ | cb8ab5515676 | stdlib | 1.26.9 | 1 |
| bitnamilegacy/ | 8657bb93a581 | stdlib | 1.26.9 | 1 |
| bitnamilegacy/ | ac64829e45b3 | stdlib | 1.26.9 | 1 |
| bitnamilegacy/ | b6e381ffd6ae | stdlib | 1.26.9 | 1 |
| bitnamilegacy/ | e527fbf75dce | stdlib | 1.26.9 | 1 |
| bitnamilegacy/ | cb04e49e6eb1 | stdlib | 1.26.9 | 1 |
| bitnamilegacy/ | cc599cbd15ff | stdlib | 1.26.9 | 1 |
| bitnamilegacy/ | da3df0976a9f | stdlib | 1.26.9 | 1 |
| bitnamilegacy/ | 1249fc292e84 | stdlib | 1.26.9 | 1 |
| bitnamilegacy/ | 64614ef8290f | stdlib | 1.26.9 | 1 |
| bitnamilegacy/ | 744f84cf7493 | stdlib | 1.26.9 | 1 |
| bitnamilegacy/ | f5fc0d561d9e | stdlib | 1.26.9 | 1 |
| bitnamilegacy/ | 04a3044b384b | stdlib | 1.26.9 | 1 |
| bitnamilegacy/ | 15edb5643b73 | stdlib | 1.26.9 | 1 |
| bitnamilegacy/ | 320c70dfd914 | stdlib | 1.26.9 | 1 |