CVE-2026-56857

Critical

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: Critical; worst across findings
CVSS: 9.8; base score, highest
EPSS: 0.005; 41st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,323; of 18,117 indexed, latest versions
Container images: 6,150; deployed by those charts
Fix available: 1 of 1; affected package

Root.Mkdir(All) can follow junctions out of the root on Windows in os

Carried by container images the latest versions of 5,323 of 18,117 indexed charts deploy, on 6,150 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+212 more	1.26.9	6,150

OSV records: GO-2026-6604
Trending: Rank 1 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,323 by stars

Chart

Latest

Affected images

Radar Score

pgbounceryasn77-pgbouncer

0.0.8

1 of 1 See more

pgbouncer yasn77-pgbouncer 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/yasn77/pgbouncer :v0.0.6	cc8c13550e44	stdlib@go1.18.6	1.26.9

Open the chart page →

1,883

ygdrassil-monitoringygdrassil

0.4.0

7 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

7 of the 10 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	stdlib@go1.23.5	1.26.9
prom/alertmanager :v0.28.0	d5155cfac40a	stdlib@go1.23.4	1.26.9
quay.io/prometheus-operator/prometheus-config-reloader :v0.79.2	193280a33bc1	stdlib@go1.23.4	1.26.9
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	stdlib@go1.22.5	1.26.9
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	stdlib@go1.23.4	1.26.9
quay.io/prometheus/pushgateway :v1.11.0	99392035ae99	stdlib@go1.23.4	1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.14.0	37d841299325	stdlib@go1.23.3	1.26.9

Open the chart page →

13,849

ceph-exporterygqygq2

1.0.0

1 of 1 See more

ceph-exporter ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
digitalocean/ceph_exporter :latest	19b163e3fb95	stdlib@go1.20	1.26.9

Open the chart page →

6,860

mdbygqygq2

5.0.7

1 of 1 See more

170

mod-chartygqygq2

5.1.0

1 of 1 See more

mod-chart ygqygq2 5.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
bitnami/nginx :latest	b8d42f076789	stdlib@go1.26.8	1.26.9

Open the chart page →

170

prometheusalertygqygq2

1.0.0

1 of 1 See more

prometheusalert ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
feiyu563/prometheus-alert :v4.9.1	224cfa68cbd9	stdlib@go1.20.6	1.26.9

Open the chart page →

2,366

utcookygqygq2

2.1.4

1 of 1 See more

utcook ygqygq2 2.1.4

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
bitnami/nginx :latest	b8d42f076789	stdlib@go1.26.8	1.26.9

Open the chart page →

170

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	stdlib@go1.18.1	1.26.9

Open the chart page →

2,994

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	stdlib@go1.17.8	1.26.9
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	stdlib@go1.17.9	1.26.9
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	stdlib@go1.16	1.26.9
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	stdlib@go1.16	1.26.9

Open the chart page →

12,474

nginx-vts-exporterymrs

0.1.2

1 of 1 See more

nginx-vts-exporter ymrs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
sophos/nginx-vts-exporter :latest	f1073556b29b	stdlib@go1.13.6	1.26.9

Open the chart page →

2,470

version-checkerymrs

0.2.3

1 of 1 See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	stdlib@go1.15.2	1.26.9

Open the chart page →

4,267

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	b28bae15e219	stdlib@go1.26.7	1.26.9
quay.io/prometheus/alertmanager :latest	e9733bafb1bd	stdlib@go1.26.8	1.26.9
quay.io/prometheus/prometheus :latest	efd719c99d83	stdlib@go1.27.1	1.26.9

Open the chart page →

863

ical-filter-proxyyungwood

0.3.1

1 of 1 See more

ical-filter-proxy yungwood 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
yungwood/ical-filter-proxy :0.3.1	ddc3f30ab05f	stdlib@go1.26.5	1.26.9

Open the chart page →

259

synergy-wholesale-exporteryungwood

0.1.1

1 of 1 See more

synergy-wholesale-exporter yungwood 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
yungwood/synergy-wholesale-exporter :0.1.1	054dce85989b	stdlib@go1.26.5	1.26.9

Open the chart page →

259

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	stdlib@go1.20.4	1.26.9
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	stdlib@go1.20.4	1.26.9

Open the chart page →

6,700

zahori-moonzahori

1.0.1

3 of 3 See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon :2.5.1	a8837b00ba1c	stdlib@go1.20.4	1.26.9
quay.io/aerokube/moon-conf :2.5.1	9ca307b30080	stdlib@go1.20.4	1.26.9
quay.io/aerokube/moon-ui :2.0.5	89990b146824	stdlib@go1.20.5	1.26.9

Open the chart page →

5,025

zahori-schedulerzahori

1.0.1

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	stdlib@go1.20.5	1.26.9

Open the chart page →

3,117

jenkinszanise-jenkins-helm-chart

0.1.0

1 of 1 See more

jenkins zanise-jenkins-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
jenkins/jenkins :lts	a660310e39ad	stdlib@go1.27.0	1.26.9

Open the chart page →

2,134

posthogzeet

0.23.2

2 of 9 See more

posthog zeet 0.23.2

2 of the 9 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	stdlib@go1.17.13	1.26.9
altinity/metrics-exporter :latest	a5206c713de7	stdlib@go1.26.8	1.26.9

Open the chart page →

4,799

endlessh-gozekker6

0.4.0

1 of 1 See more

endlessh-go zekker6 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/shizunge/endlessh-go :2026.0730.0	8826dad32623	stdlib@go1.26.5	1.26.9

Open the chart page →

827

karmazekker6

0.22.0

1 of 1 See more

karma zekker6 0.22.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
lmierzwa/karma :v0.133	f5d0a0ff4062	stdlib@go1.27.1	1.26.9

Open the chart page →

148

zookeeper-exporterzookeeper-exporter

0.1.0

1 of 1 See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
dabealu/zookeeper-exporter :latest	86106fec315f	stdlib@go1.14.15	1.26.9

Open the chart page →

2,294

zoo-project-druzoo-project

0.10.9

2 of 6 See more

zoo-project-dru zoo-project 0.10.9

2 of the 6 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/postgres :18.6-alpine3.24	77f585114c32	stdlib@go1.24.6	1.26.9
zooproject/zoo-project :dru-51e7d55383f24594959b69e58518961c6aa66740	da112e8d03f1	stdlib@go1.26.8	1.26.9

Open the chart page →

7,286

Container images carrying it

6,150 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
defactops/defactops-ui :1.0.16	825cdf9ba706	stdlib@go1.21.10	1.26.9	1
deimosfr/dnsmasq-k8s :1.4.1	284c4040fc6d	stdlib@go1.25.5	1.26.9	1
dellemc/csm-application-mobility-controller :v0.1.0	148ada9060a9	stdlib@go1.18.5	1.26.9	1
dellemc/csm-application-mobility-velero-plugin :v0.1.0	660cabd6d929	stdlib@go1.18.5	1.26.9	1
dellnoantechnp/cloudeye-exporter :v2.0.31	6873356c882d	stdlib@go1.19.6	1.26.9	1
deluan/navidrome :0.49.3	11a24da08977	stdlib@go1.19.5	1.26.9	1
deluan/navidrome :0.50.0	2cf4442b0099	stdlib@go1.21.0	1.26.9	1
deluan/navidrome :0.64.2	38dc2727bfcf	stdlib@go1.27.1	1.26.9	1
deluan/navidrome :0.43.0	4e9ae3bff6aa	stdlib@go1.16.4	1.26.9	1
deluan/navidrome :0.61.2	9fa40b3d8dec	stdlib@go1.25.9	1.26.9	1
deluan/navidrome :0.41.1	fc4d8b6ad9f9	stdlib@go1.16.2	1.26.9	1
denniswitt/yas3p :0.2.4	88a235619af6	stdlib@go1.26.1	1.26.9	1
derailed/popeye :v0.21.3	63b2d2a8f674	stdlib@go1.21.8	1.26.9	1
devopsfaith/krakend :2.6.3	4c678c224f67	stdlib@go1.22.3	1.26.9	1
devopsfaith/krakend :2.7.0	9219cda867e2	stdlib@go1.22.5	1.26.9	1
devopstales/trivy-operator :2.5	75136aa7a26e	stdlib@go1.18.10	1.26.9	1
devsecurely/cview-issuer :0.0.43	35675bd31bfd	stdlib@go1.26.8	1.26.9	1
devspacecloud/manager :0.3.3	49c397413f7b	stdlib@go1.13.8	1.26.9	1
deyaeddin/cert-manager-webhook-hetzner :latest	797b0d06210a	stdlib@go1.16.7	1.26.9	1
dgraph/dgraph :v24.1.4	b57fa31f9b7f	stdlib@go1.22.12	1.26.9	1
dgraph/ratel :v25.0.3	4cae1ff95027	stdlib@go1.23.10	1.26.9	1
digitalocean/ceph_exporter :latest	19b163e3fb95	stdlib@go1.20	1.26.9	1
digitalocean/do-operator :v0.1.6	5e5deb4db76e	stdlib@go1.18.10	1.26.9	1
dipugodocker/pdf-editor :1.0-backend-rotate	316e203b8bf5	stdlib@go1.18.7	1.26.9	1
dipugodocker/pdf-editor :1.0-backend-merge	70b07544a604	stdlib@go1.18.7	1.26.9	1
dirathea/pipelinewise-operator :v0.5.0	8d4c9f773ae1	stdlib@go1.15.8	1.26.9	1
directus/directus :12.0.2	9c8470ea465c	stdlib@go1.23.12	1.26.9	1
directus/directus :11.1.0	e3c8bb975350	stdlib@go1.20.7	1.26.9	1
distribution/distribution :3.1.1	bca24727f400	stdlib@go1.25.9	1.26.9	1
distribution/distribution :2.8.3	f84b2078238f	stdlib@go1.20.8	1.26.9	1
djjudas21/nova-exporter :0.0.10	e9094580885c	stdlib@go1.24.4	1.26.9	1
djkormo/adcs-issuer :2.1.2	9f34e87e7586	stdlib@go1.22.6	1.26.9	1
dnsforge/xteve :latest	4d9a685c8c28	stdlib@go1.16.2	1.26.9	1
dobtc/bitcoin :25.1	a870f7cb1105	stdlib@go1.19.8	1.26.9	1
dockerdaemon0901/rolldice :v1	4e5bfe179c7e	stdlib@go1.21.0	1.26.9	1
documenso/documenso :v1.8.1	7f16a9449f18	stdlib@go1.20.12	1.26.9	1
dollarshaveclub/furan2 :master	14a257836529	stdlib@go1.17.2	1.26.9	1
dollarshaveclub/thermite :0.0.31	663cbf25fcfe	stdlib@go1.17.1	1.26.9	1
don616/k8s-file-explorer-backend :v1.8.1	3e228fadb3a8	stdlib@go1.26.8	1.26.9	1
donetick/donetick :v0.1.79	a1cc21dd5a37	stdlib@go1.24.13	1.26.9	1
dongjiang1989/cosign-webhook :v1.1.0	2a3ead6a55dc	stdlib@go1.19.12	1.26.9	1
dongjiang1989/cpusets-controller :v1.1.1	dc5bd483874c	stdlib@go1.19.10	1.26.9	1
dongjiang1989/cpusets-device-plugin :v1.1.1	923085c65123	stdlib@go1.19.10	1.26.9	1
dongjiang1989/crane-scheduler-controller :main	f0055c05dbee	stdlib@go1.19.9	1.26.9	1
dongjiang1989/lxcfs-webhook :latest	c1f19557bdcb	stdlib@go1.26.0	1.26.9	1
dongjiang1989/node-metrics :latest	3f1f266190bb	stdlib@go1.26.7	1.26.9	1
dongjiang1989/ns-node-affinity :latest	451f7823723c	stdlib@go1.18.5	1.26.9	1
dongjiang1989/pingmesh-agent :latest	355fa4be8e97	stdlib@go1.22.9	1.26.9	1
dongjiang1989/pingmesh-agent :v1.2.2	c82de0272da0	stdlib@go1.22.9	1.26.9	1
doorcloud/apim-operator :v3.0.4	4e6ef8d72c3e	stdlib@go1.22.12	1.26.9	1