CVE-2026-56857

Critical

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: Critical; worst across findings
CVSS: 9.8; base score, highest
EPSS: 0.005; 41st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,205; of 18,131 indexed, latest versions
Container images: 6,046; deployed by those charts
Fix available: 1 of 1; affected package

Root.Mkdir(All) can follow junctions out of the root on Windows in os

Carried by container images the latest versions of 5,205 of 18,131 indexed charts deploy, on 6,046 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+209 more	1.26.9	6,046

OSV records: GO-2026-6604
Trending: Rank 1 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,205 by stars

Chart

Latest

Affected images

Radar Score

eigendap2p-avs

0.1.1

2 of 3 See more

eigenda p2p-avs 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/layr-labs/eigenda/opr-node :0.8.4	6650119a385f	stdlib@go1.21.1	1.26.9
ghcr.io/layr-labs/eigenda/opr-nodeplugin :0.8.4	e459ad3ae758	stdlib@go1.21.1	1.26.9

Open the chart page →

3,672

predicatep2p-avs

0.1.4

1 of 1 See more

predicate p2p-avs 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/predicatelabs/operator :v1.0.5	b62113fe1b27	stdlib@go1.23.5	1.26.9

Open the chart page →

1,421

p4p4

0.1.0

3 of 7 See more

p4 p4 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
codeurjc/toposervice :v1.23	9fb4c11e6a49	stdlib@go1.18.10	1.26.9
library/mongo :5.0-focal	5e15a3f014ed	stdlib@go1.25.9	1.26.9
library/mysql :8	6ea90827b110	stdlib@go1.24.6	1.26.9

Open the chart page →

31,353

myappp4-helm

0.1.0

1 of 6 See more

23,456

packetrusherpacketrusher

0.0.3

1 of 1 See more

packetrusher packetrusher 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
gradiant/packetrusher :2b26573	e9b46dc76af4	stdlib@go1.21.3	1.26.9

Open the chart page →

7,047

pacmanpacman-mh

0.1.28

1 of 2 See more

pacman pacman-mh 0.1.28

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mongo :7.0.28-jammy	88785f6f665a	stdlib@go1.24.0	1.26.9

Open the chart page →

4,299

pact-brokerpact-broker-chart

0.2.1

1 of 2 See more

pact-broker pact-broker-chart 0.2.1

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
pactfoundation/pact-broker :2.100.0.1	63801b40a4e9	stdlib@go1.14.4	1.26.9

Open the chart page →

4,046

pagespages

1.0.0

1 of 3 See more

21,421

pagespages10

1.0.0

1 of 3 See more

21,421

pagespages111

1.0.0

1 of 3 See more

21,421

pagespages2

1.0.0

1 of 3 See more

21,421

pagespages-alexchmielu

1.0.0

1 of 3 See more

pages pages-alexchmielu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-alps

1.0.0

1 of 3 See more

pages pages-alps 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-alstom

1.0.0

1 of 3 See more

pages pages-alstom 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-ambala

1.0.0

1 of 3 See more

pages pages-ambala 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-andromeda

1.0.0

1 of 3 See more

pages pages-andromeda 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespagesbadami

1.0.0

1 of 3 See more

pages pagesbadami 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-blackburn

1.0.0

1 of 3 See more

pages pages-blackburn 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-botes

1.0.0

1 of 3 See more

pages pages-botes 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-brian

1.0.0

1 of 3 See more

pages pages-brian 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-buckll

1.0.0

1 of 3 See more

pages pages-buckll 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-camden

1.0.0

1 of 3 See more

pages pages-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-camden771

1.0.0

1 of 3 See more

pages pages-camden771 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-draco

1.0.0

1 of 3 See more

pages pages-draco 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-ellora

1.0.0

1 of 3 See more

pages pages-ellora 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-finchley

1.0.0

1 of 3 See more

pages pages-finchley 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-fornax

1.0.0

1 of 3 See more

pages pages-fornax 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-harsh

1.0.0

1 of 3 See more

pages pages-harsh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespagesk

1.0.0

1 of 3 See more

21,421

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-mihai

1.0.0

1 of 3 See more

pages pages-mihai 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-nivesh

1.0.0

1 of 3 See more

pages pages-nivesh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespagessandeepgudu

1.0.0

1 of 3 See more

pages pagessandeepgudu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-shubhanker

1.0.0

1 of 3 See more

pages pages-shubhanker 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-ssharma0909

1.0.0

1 of 3 See more

pages pages-ssharma0909 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-sucharitha

1.0.0

1 of 3 See more

pages pages-sucharitha 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-sudhir

1.0.0

1 of 3 See more

pages pages-sudhir 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-sushi

1.0.0

1 of 3 See more

pages pages-sushi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-vasanth5814

1.0.0

1 of 3 See more

pages pages-vasanth5814 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

pagespages-vjp

1.0.0

1 of 3 See more

pages pages-vjp 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

21,421

paguropaguro

0.1.2

1 of 3 See more

paguro paguro 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/dpicillo/paguro/paguro-node-installer :v0.1.2	526c1324e1dc	stdlib@go1.26.6	1.26.9

Open the chart page →

229

alistpanghuli

0.1.5

1 of 2 See more

alist panghuli 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
xhofe/alist :v3.24.0	33f15a31be6c	stdlib@go1.20.5	1.26.9

Open the chart page →

2,744

cloudrevepanghuli

0.1.0

1 of 1 See more

cloudreve panghuli 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
cloudreve/cloudreve :3.8.0	09093aec5a20	stdlib@go1.20	1.26.9

Open the chart page →

3,247

radarr-testpanzer1119

0.1.2

1 of 2 See more

radarr-test panzer1119 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
bitnami/kubectl :latest	f7f9e4f64d9e	stdlib@go1.26.8	1.26.9

Open the chart page →

1,592

paperclippaperclip-helm

0.4.2

1 of 3 See more

paperclip paperclip-helm 0.4.2

1 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/postgres :17-alpine	b0f9560a2de0	stdlib@go1.24.6	1.26.9

Open the chart page →

703

paperclip-operatorpaperclip-operator

0.19.1

1 of 1 See more

paperclip-operator paperclip-operator 0.19.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/paperclipinc/paperclip-operator :v0.19.1	0984b890eb38	stdlib@go1.25.0	1.26.9

Open the chart page →

805

Parpar

0.1.0

1 of 1 See more

Par par 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/jmcgrath207/par :v0.1.0	9977511cb142	stdlib@go1.19.10	1.26.9

Open the chart page →

1,597

parcaparca

4.19.0

2 of 2 See more

parca parca 4.19.0

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/parca-dev/parca :v0.20.0	0d1df8f436f7	stdlib@go1.21.1	1.26.9
ghcr.io/parca-dev/parca-agent :v0.28.0	6d6794f45f3e	stdlib@go1.21.4	1.26.9

Open the chart page →

4,799

parcaparca-chart

0.1.0

1 of 1 See more

parca parca-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/parca-dev/parca :v0.20.0	0d1df8f436f7	stdlib@go1.21.1	1.26.9

Open the chart page →

2,719

Container images carrying it

6,046 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
udhos/sqs-to-sns :2.0.15	cf7979da82e1	stdlib@go1.26.3	1.26.9	1
udhos/token-server :1.0.9	728013f2fac1	stdlib@go1.25.1	1.26.9	1
uffizzi/uffizzi-cluster-operator :v1.4.5	14e528bbd926	stdlib@go1.19.13	1.26.9	1
uffizzi/uffizzi-cluster-operator :v1.6.5	5ca448a08783	stdlib@go1.19.13	1.26.9	1
uptrace/uptrace :2.0.2	34a02c3b2d12	stdlib@go1.24.10	1.26.9	1
utho/utho-app-operator :0.1.4	6e8a690e8b7a	stdlib@go1.22.8	1.26.9	1
utkuozdemir/nvidia_gpu_exporter :0.3.0	149f9e7e7aa3	stdlib@go1.17	1.26.9	1
utkuozdemir/nvidia_gpu_exporter :1.15.1	7aee2d42836a	stdlib@go1.27.1	1.26.9	1
v2fly/v2fly-core :latest	d06727b221fe	stdlib@go1.24.2	1.26.9	1
vdaas/vald-operator :latest	0c3dcd4974f6	stdlib@go1.26.6	1.26.9	1
vearch/vearch :3.3.4	0768af33f9d9	stdlib@go1.19.9	1.26.9	1
veecode/devportal	e5c84f744994	stdlib@go1.26.7	1.26.9	1
veecode/devportal-admin-ui :0.4.30	c69fd286b489	stdlib@go1.22.3	1.26.9	1
velero/velero :v1.9.0	277fbfaf8dcf	stdlib@go1.18	1.26.9	1
velero/velero :v1.8.1	8d784580931c	stdlib@go1.16.6	1.26.9	1
velero/velero :v1.18.4	c89fb5b6d1fd	stdlib@go1.26.8	1.26.9	1
velero/velero :v1.18.0	e4d1e79be2ee	stdlib@go1.25.7	1.26.9	1
velero/velero-plugin-for-aws :v1.5.0	3d2ea7aab32d	stdlib@go1.17.11	1.26.9	1
velero/velero-plugin-for-aws :v1.14.0	7e82f717f44e	stdlib@go1.25.7	1.26.9	1
venturenox/redis :latest	83b471c193ba	stdlib@go1.22.9	1.26.9	1
venturenox/sagawise :latest	c11d32f18718	stdlib@go1.22.2	1.26.9	1
versity/versitygw :v1.8.0	30292fc2eeac	stdlib@go1.27.1	1.26.9	1
versity/versitygw :v1.0.14	5192635d0353	stdlib@go1.24.3	1.26.9	1
versity/versitygw :v1.1.0	f730e0dbc1ef	stdlib@go1.25.5	1.26.9	1
vespaengine/vespa :8.526.15	69b160f58211	stdlib@go1.24.2	1.26.9	1
victoriametrics/operator :v0.65.0	716b89a3ed79	stdlib@go1.25.3	1.26.9	1
victoriametrics/operator :v0.47.2	71be93cfafb6	stdlib@go1.23.0	1.26.9	1
victoriametrics/operator :v0.68.3	f52e1bd679cb	stdlib@go1.25.8	1.26.9	1
victoriametrics/victoria-logs :v1.15.0-victorialogs	d7435244eb19	stdlib@go1.24.0	1.26.9	1
victoriametrics/victoria-metrics :v1.93.5	77a9815d0640	stdlib@go1.21.1	1.26.9	1
victoriametrics/victoria-metrics :v1.120.0	a1cb2f3dfd45	stdlib@go1.24.4	1.26.9	1
victoriametrics/victoria-metrics :v1.34.7	b50d5c0153f9	stdlib@go1.14.1	1.26.9	1
victoriametrics/victoria-metrics :v1.95.1	f52723a08a44	stdlib@go1.21.4	1.26.9	1
victoriametrics/vmalert :v1.96.0	150cd08fde94	stdlib@go1.21.5	1.26.9	1
victoriametrics/vmestimator :v0.1.16	ccf603552de2	stdlib@go1.26.6	1.26.9	1
vientoprojects/kubernetes-monitoring-telegram-bot :latest	eb2a71531741	stdlib@go1.16.4	1.26.9	1
vikunja/api :0.17.1	8cba0520bf8c	stdlib@go1.16.5	1.26.9	1
vineyardcloudnative/vineyard-operator :latest	9d419aa18faa	stdlib@go1.19.13	1.26.9	1
vmware/kube-fluentd-operator :latest	f028c138a5f4	stdlib@go1.21.7	1.26.9	1
voidxmh/golang :1.19-alpine-dev	423c6195fab2	stdlib@go1.19	1.26.9	1
voidxmh/xmh-auther :v1	93e42a569ca8	stdlib@go1.16.5	1.26.9	1
voidxmh/xmh-cacher :v1	1b7397412320	stdlib@go1.16.5	1.26.9	1
voidxmh/xmh-ui :v1	2ff3f2146547	stdlib@go1.16.5	1.26.9	1
volantmq/volantmq :v0.4.0-rc.6	9bfe7857ebc3	stdlib@go1.13.6	1.26.9	1
volcanosh/vc-controller-manager :v1.12.1	3815883c32f6	stdlib@go1.23.7	1.26.9	1
volcanosh/vc-scheduler :v1.12.1	b24ea8af2d16	stdlib@go1.23.7	1.26.9	1
volcanosh/vc-webhook-manager :v1.12.1	f8b50088a732	stdlib@go1.23.7	1.26.9	1
voltha/bbsim :1.16.7	d90403d58016	stdlib@go1.13.8	1.26.9	1
voltha/bbsim-sadis-server :0.3.5	259fc3a03f4e	stdlib@go1.16.3	1.26.9	1
voltha/bbsim-sadis-server :0.4.0	762b272d439e	stdlib@go1.16.3	1.26.9	1