CVE-2026-56857
MediumAdvisory
Published 8 Oct 2026In the index since 9 Oct 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.5
- base score, highest
- EPSS
- 0.005
- 41st percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 5,533
- of 18,090 indexed, latest versions
- Container images
- 6,378
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
Root.Mkdir(All) can follow junctions out of the root on Windows in os
Carried by container images the latest versions of 5,533 of 18,090 indexed charts deploy, on 6,378 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| stdlibgolang | go1.13, go1.13.1, go1.13.3, go1.13.4+212 more | 1.26.9 | 6,378 |
| ingress-nginx-controller-1.15apk | 1.15.10-r3 | 1.15.10-r8 | 1 |
- OSV records
- CGA-3j79-hxrj-98c9GO-2026-6604
- Also known as
- CGA-28rp-569c-vjc3, CGA-4j4m-4mp6-xp7x, CGA-85gw-4745-j8q8, CGA-929x-9pxj-5mv4, CGA-jc7p-vgxm-j32v
- Trending
- Rank 10 in indexed charts, since 9 Oct 2026. See the ranking →
Charts affected
5,533 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| alertmanager-botgeek-cookbookVerified publisher | 6.4.2 | 1 of 1See more | 4,811 |
| bazarrgeek-cookbookVerified publisher | 10.6.2 | 1 of 1See more | 19,154 |
| filebrowsergeek-cookbookVerified publisher | 1.4.2 | 1 of 1See more | 4,649 |
| focalboardgeek-cookbookVerified publisher | 4.4.2 | 1 of 1See more | 5,289 |
| gollumgeek-cookbookVerified publisher | 3.4.2 | 1 of 3See more | 5,444 |
| influxdb-exportergeek-cookbookVerified publisher | 1.2.2 | 1 of 1See more | 1,925 |
| network-ups-toolsgeek-cookbookVerified publisher | 6.4.2 | 1 of 1See more | 15,341 |
| otel-collectorgeek-cookbookVerified publisher | 1.2.2 | 1 of 1See more | 3,624 |
| owncastgeek-cookbookVerified publisher | 3.4.2 | 1 of 1See more | 4,382 |
| protonmail-bridgegeek-cookbookVerified publisher | 5.4.2 | 1 of 1See more | 9,504 |
| prowlarrgeek-cookbookVerified publisher | 4.5.2 | 1 of 1See more | 13,101 |
| sabnzbdgeek-cookbookVerified publisher | 9.4.2 | 1 of 1See more | 11,747 |
| sambageek-cookbookVerified publisher | 6.2.2 | 1 of 1See more | 3,271 |
| sonarrgeek-cookbookVerified publisher | 16.3.2 | 1 of 1See more | 14,427 |
| stashgeek-cookbookVerified publisher | 3.4.2 | 1 of 1See more | 17,824 |
| uptime-kumageek-cookbookVerified publisher | 1.4.2 | 1 of 1See more | 6,770 |
| valheimgeek-cookbookVerified publisher | 4.4.2 | 1 of 1See more | 2,959 |
| wireguardgeek-cookbookVerified publisher | 1.4.2 | 1 of 1See more | 8,990 |
| gentrace-self-hostedgentrace-self-hostedVerified publisher | 0.1.3 | 2 of 9See more | 16,950 |
| geo-checkergeo-checkerVerified publisher | 5.0.0 | 1 of 1See more | 1,960 |
| ghostfolioghostfolioVerified publisher | 0.5.4 | 1 of 3See more | 3,825 |
| gigapipegigapipeVerified publisher | 0.3.0 | 1 of 1See more | 1,089 |
| leantimegissilabs | 1.3.0 | 1 of 2See more | 7,635 |
| gitea-sonarqube-botgitea-sonarqube-botOfficialVerified publisher | 0.4.0 | 1 of 1See more | 1,684 |
| git-hubbygit-hubbyOfficialVerified publisher | 1.20.11 | 1 of 1See more | 254 |
| github-platform-operatorgithub-platform-operatorVerified publisher | 0.7.8 | 1 of 1See more | 260 |
| github-stsgithub-sts-helmVerified publisher | 0.1.1 | 1 of 1See more | 257 |
| gitops-reversergitops-reverserVerified publisher | 0.52.0 | 1 of 1See more | 205 |
| prometheus-kafka-exportergkarthiks | 0.1.3 | 1 of 1See more | 205 |
| temporalglasskubeVerified publisher | 0.45.2-gk.1 | 10 of 14See more | 23,259 |
| daos-operatorgluesysVerified publisher | 0.1.5 | 1 of 1See more | 208 |
| relay-proxygo-feature-flagOfficialVerified publisher | 1.56.0 | 1 of 1See more | 205 |
| go-hello-world-chartgo-hello-worldVerified publisher | 1.8.3 | 1 of 1See more | 1,238 |
| gomenhashaigomenhashaiOfficialVerified publisher | 1.3.4 | 1 of 1See more | 1,063 |
| gorse-enterprisegorse-io | 0.4.2 | 3 of 5See more | 6,804 |
| gotosocialgotosocialVerified publisher | 0.2.32 | 1 of 1See more | 656 |
| meta-monitoringgrafana | 1.3.0 | 2 of 2See more | 4,895 |
| phlaregrafana | 0.5.4 | 1 of 1See more | 2,887 |
| gkograviteeioVerified publisher | 4.12.21 | 1 of 1See more | 317 |
| greenkubegreenkubeVerified publisher | 0.3.0 | 1 of 3See more | 2,173 |
| gremlingremlin | 0.30.0 | 1 of 2See more | 368 |
| armada-operatorgresearch | 0.7.0 | 2 of 2See more | 2,777 |
| carettagroundcover | 0.0.16 | 3 of 3See more | 9,883 |
| ghostgroundhog2k | 0.212.16 | 1 of 1See more | 2,025 |
| growthbookgrowthbook | 5.1.0 | 1 of 2See more | 1,497 |
| IMgrycapOfficialVerified publisher | 1.8.0 | 1 of 3See more | 5,147 |
| oscargrycapOfficialVerified publisher | 4.2.0 | 1 of 2See more | 646 |
| castopodh2mVerified publisher | 1.12.10 | 1 of 3See more | 11,460 |
| haproxy-unified-gatewayhaproxytechVerified publisher | 1.2.0 | 1 of 1See more | 1,002 |
| boundary-controllerhashicorpVerified publisher | 0.2.0 | 1 of 1See more | 421 |
Container images carrying it
6,378 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| jaegertracing/ | db45c07f2e1b | stdlib | 1.26.9 | 1 |
| jaegertracing/ | f6b5d09073f1 | stdlib | 1.26.9 | 1 |
| jaegertracing/ | 3d0ac795ff98 | stdlib | 1.26.9 | 1 |
| jaegertracing/ | 46a886260e04 | stdlib | 1.26.9 | 1 |
| jaegertracing/ | e128b9adbb29 | stdlib | 1.26.9 | 1 |
| jaegertracing/ | ff81f0a9f63c | stdlib | 1.26.9 | 1 |
| jaegertracing/ | 3f036ec60e61 | stdlib | 1.26.9 | 1 |
| jaegertracing/ | b636f0f464bc | stdlib | 1.26.9 | 1 |
| jakuboskera/ | a305b8ce5bff | stdlib | 1.26.9 | 1 |
| jamesorlakin/ | 3894dc11b236 | stdlib | 1.26.9 | 1 |
| jamesread/ | af9d7c4db6dc | stdlib | 1.26.9 | 1 |
| jamesread/ | f3066e207efd | stdlib | 1.26.9 | 1 |
| jdschulze/ | fde2dfbcacc2 | stdlib | 1.26.9 | 1 |
| jdvalencia422/ | a80b6e47a7b8 | stdlib | 1.26.9 | 1 |
| jeboehm/ | e756949e537d | stdlib | 1.26.9 | 1 |
| jeboehm/ | d03fb7bae0a2 | stdlib | 1.26.9 | 1 |
| jeboehm/ | 5fb2f31c940d | stdlib | 1.26.9 | 1 |
| jeboehm/ | 9da13edf5aa8 | stdlib | 1.26.9 | 1 |
| jenkins/ | 95313257a8cd | stdlib | 1.26.9 | 1 |
| jenkins/ | c1e4c349365f | stdlib | 1.26.9 | 1 |
| jenkins/ | de4fea113221 | stdlib | 1.26.9 | 1 |
| jhaals/ | 26873480863b | stdlib | 1.26.9 | 1 |
| jhaals/ | 6bca8d5a4914 | stdlib | 1.26.9 | 1 |
| jhaals/ | 6c33d9c813f7 | stdlib | 1.26.9 | 1 |
| jhaals/ | 916a1cf45d36 | stdlib | 1.26.9 | 1 |
| jhaals/ | 934e4f2c016f | stdlib | 1.26.9 | 1 |
| jhaals/ | 9516e3b3e88c | stdlib | 1.26.9 | 1 |
| jhaals/ | b64a1a8ace1b | stdlib | 1.26.9 | 1 |
| jhidalgo3/ | 0390e155c46d | stdlib | 1.26.9 | 1 |
| jhonbrownn/ | 8f6551ecc98c | stdlib | 1.26.9 | 1 |
| jhonbrownn/ | 68d6223ea366 | stdlib | 1.26.9 | 1 |
| jitesoft/ | 7f25594d4f33 | stdlib | 1.26.9 | 1 |
| jkaninda/ | 8cfda26ecb7d | stdlib | 1.26.9 | 1 |
| jkremser/ | e35cf56ef183 | stdlib | 1.26.9 | 1 |
| jmferrer/ | 030f68ec6998 | stdlib | 1.26.9 | 1 |
| joeelliott/ | b4acd14642d0 | stdlib | 1.26.9 | 1 |
| johnblack77/ | 816f4e2fea4a | stdlib | 1.26.9 | 1 |
| juicedata/ | 3e4daf9626d5 | stdlib | 1.26.9 | 1 |
| juicedata/ | 43978fc60798 | stdlib | 1.26.9 | 1 |
| juicedata/ | d915e899e322 | stdlib | 1.26.9 | 1 |
| junktext/ | a70936c04aed | stdlib | 1.26.9 | 1 |
| jupyterhub/ | a395326989c3 | stdlib | 1.26.9 | 1 |
| justusbunsi/ | 18dd43b470d9 | stdlib | 1.26.9 | 1 |
| jwilder/ | 839cd6793d19 | stdlib | 1.26.9 | 1 |
| jwkohnen/ | 8cb711bf3bcb | stdlib | 1.26.9 | 1 |
| k8scloudprovider/ | a30c7a2a594a | stdlib | 1.26.9 | 1 |
| k8scloudprovider/ | 6ddf80b34265 | stdlib | 1.26.9 | 1 |
| kadalu/ | 3726d7a805f2 | stdlib | 1.26.9 | 1 |
| kaiso/ | e0e22b928bdd | stdlib | 1.26.9 | 1 |
| kayrosuno/ | f3bd44b29b0d | stdlib | 1.26.9 | 1 |