CVE-2026-56857

Critical

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: Critical; worst across findings
CVSS: 9.8; base score, highest
EPSS: 0.005; 41st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,276; of 18,137 indexed, latest versions
Container images: 6,115; deployed by those charts
Fix available: 1 of 1; affected package

Root.Mkdir(All) can follow junctions out of the root on Windows in os

Carried by container images the latest versions of 5,276 of 18,137 indexed charts deploy, on 6,115 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+208 more	1.26.9	6,115

OSV records: GO-2026-6604
Trending: Rank 3 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,276 by stars

Chart

Latest

Affected images

Radar Score

nfs-subdir-external-provisionerxxl-job-admin

4.0.18

1 of 1 See more

nfs-subdir-external-provisioner xxl-job-admin 4.0.18

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner :v4.0.2	63d5e04551ec	stdlib@go1.15	1.26.9

Open the chart page →

4,005

nightingalexxl-job-admin

0.2.11

4 of 6 See more

nightingale xxl-job-admin 0.2.11

4 of the 6 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	stdlib@go1.25.14	1.26.9
flashcatcloud/nightingale :8.0.0-beta.11	ea1b0aaabe09	stdlib@go1.23.9	1.26.9
library/mysql :5.7	4bc6bc963e6d	stdlib@go1.18.2	1.26.9
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	stdlib@go1.22.6	1.26.9

Open the chart page →

12,782

redisxxl-job-admin

24.1.3

1 of 1 See more

redis xxl-job-admin 24.1.3

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/dellnoantechnp/bitnami/redis :8.4.0	29064423c369	stdlib@go1.25.6	1.26.9

Open the chart page →

613

pgbounceryasn77-pgbouncer

0.0.8

1 of 1 See more

pgbouncer yasn77-pgbouncer 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/yasn77/pgbouncer :v0.0.6	cc8c13550e44	stdlib@go1.18.6	1.26.9

Open the chart page →

1,899

ygdrassil-monitoringygdrassil

0.4.0

7 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

7 of the 10 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	stdlib@go1.23.5	1.26.9
prom/alertmanager :v0.28.0	d5155cfac40a	stdlib@go1.23.4	1.26.9
quay.io/prometheus-operator/prometheus-config-reloader :v0.79.2	193280a33bc1	stdlib@go1.23.4	1.26.9
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	stdlib@go1.22.5	1.26.9
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	stdlib@go1.23.4	1.26.9
quay.io/prometheus/pushgateway :v1.11.0	99392035ae99	stdlib@go1.23.4	1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.14.0	37d841299325	stdlib@go1.23.3	1.26.9

Open the chart page →

13,875

ceph-exporterygqygq2

1.0.0

1 of 1 See more

ceph-exporter ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
digitalocean/ceph_exporter :latest	19b163e3fb95	stdlib@go1.20	1.26.9

Open the chart page →

6,880

mdbygqygq2

5.0.7

1 of 1 See more

170

mod-chartygqygq2

5.1.0

1 of 1 See more

mod-chart ygqygq2 5.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
bitnami/nginx :latest	b8d42f076789	stdlib@go1.26.8	1.26.9

Open the chart page →

170

prometheusalertygqygq2

1.0.0

1 of 1 See more

prometheusalert ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
feiyu563/prometheus-alert :v4.9.1	224cfa68cbd9	stdlib@go1.20.6	1.26.9

Open the chart page →

2,372

utcookygqygq2

2.1.4

1 of 1 See more

utcook ygqygq2 2.1.4

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
bitnami/nginx :latest	b8d42f076789	stdlib@go1.26.8	1.26.9

Open the chart page →

170

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	stdlib@go1.18.1	1.26.9

Open the chart page →

2,994

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	stdlib@go1.17.8	1.26.9
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	stdlib@go1.17.9	1.26.9
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	stdlib@go1.16	1.26.9
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	stdlib@go1.16	1.26.9

Open the chart page →

12,492

nginx-vts-exporterymrs

0.1.2

1 of 1 See more

nginx-vts-exporter ymrs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
sophos/nginx-vts-exporter :latest	f1073556b29b	stdlib@go1.13.6	1.26.9

Open the chart page →

2,470

version-checkerymrs

0.2.3

1 of 1 See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	stdlib@go1.15.2	1.26.9

Open the chart page →

4,267

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	b28bae15e219	stdlib@go1.26.7	1.26.9
quay.io/prometheus/alertmanager :latest	e9733bafb1bd	stdlib@go1.26.8	1.26.9
quay.io/prometheus/prometheus :latest	efd719c99d83	stdlib@go1.27.1	1.26.9

Open the chart page →

904

ical-filter-proxyyungwood

0.3.1

1 of 1 See more

ical-filter-proxy yungwood 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
yungwood/ical-filter-proxy :0.3.1	ddc3f30ab05f	stdlib@go1.26.5	1.26.9

Open the chart page →

259

synergy-wholesale-exporteryungwood

0.1.1

1 of 1 See more

synergy-wholesale-exporter yungwood 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
yungwood/synergy-wholesale-exporter :0.1.1	054dce85989b	stdlib@go1.26.5	1.26.9

Open the chart page →

259

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	stdlib@go1.20.4	1.26.9
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	stdlib@go1.20.4	1.26.9

Open the chart page →

6,702

zahori-moonzahori

1.0.1

3 of 3 See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon :2.5.1	a8837b00ba1c	stdlib@go1.20.4	1.26.9
quay.io/aerokube/moon-conf :2.5.1	9ca307b30080	stdlib@go1.20.4	1.26.9
quay.io/aerokube/moon-ui :2.0.5	89990b146824	stdlib@go1.20.5	1.26.9

Open the chart page →

5,024

zahori-schedulerzahori

1.0.1

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	stdlib@go1.20.5	1.26.9

Open the chart page →

3,136

jenkinszanise-jenkins-helm-chart

0.1.0

1 of 1 See more

jenkins zanise-jenkins-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
jenkins/jenkins :lts	a660310e39ad	stdlib@go1.27.0	1.26.9

Open the chart page →

2,212

posthogzeet

0.23.2

2 of 9 See more

posthog zeet 0.23.2

2 of the 9 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	stdlib@go1.17.13	1.26.9
altinity/metrics-exporter :latest	a5206c713de7	stdlib@go1.26.8	1.26.9

Open the chart page →

4,840

endlessh-gozekker6

0.4.0

1 of 1 See more

endlessh-go zekker6 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/shizunge/endlessh-go :2026.0730.0	8826dad32623	stdlib@go1.26.5	1.26.9

Open the chart page →

827

karmazekker6

0.22.0

1 of 1 See more

karma zekker6 0.22.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
lmierzwa/karma :v0.133	f5d0a0ff4062	stdlib@go1.27.1	1.26.9

Open the chart page →

148

zookeeper-exporterzookeeper-exporter

0.1.0

1 of 1 See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
dabealu/zookeeper-exporter :latest	86106fec315f	stdlib@go1.14.15	1.26.9

Open the chart page →

2,294

zoo-project-druzoo-project

0.10.9

2 of 6 See more

zoo-project-dru zoo-project 0.10.9

2 of the 6 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/postgres :18.6-alpine3.24	77f585114c32	stdlib@go1.24.6	1.26.9
zooproject/zoo-project :dru-51e7d55383f24594959b69e58518961c6aa66740	da112e8d03f1	stdlib@go1.26.8	1.26.9

Open the chart page →

7,310

Container images carrying it

6,115 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/appscode/auditor :v0.0.1	c62c89ee706d	stdlib@go1.19.4	1.26.9	1
ghcr.io/appscode/aws-credential-manager :v0.1.0	0511bbe501c3	stdlib@go1.25.9	1.26.9	1
ghcr.io/appscode/azure-credential-manager :v0.1.0	f5c797f7fbe7	stdlib@go1.25.9	1.26.9	1
ghcr.io/appscode/b3 :v2023.03.23	5f5a40fc1702	stdlib@go1.20.2	1.26.9	1
ghcr.io/appscode/capa-vpc-peering-operator :v0.0.4	b1557553a2b3	stdlib@go1.21.5	1.26.9	1
ghcr.io/appscode/capi-ops-manager :v0.0.5	7465f35b684c	stdlib@go1.23.2	1.26.9	1
ghcr.io/appscode/catalog-manager :v0.14.0	5e9a05238ed5	stdlib@go1.25.13	1.26.9	1
ghcr.io/appscode/cattleset :v0.0.1	45554a03e448	stdlib@go1.25.11	1.26.9	1
ghcr.io/appscode/cert-manager-webhook-ace :v0.0.2	dc6b5fdcec06	stdlib@go1.25.5	1.26.9	1
ghcr.io/appscode/cloudflare-dns-proxy :v0.0.5	dfbef0285e14	stdlib@go1.25.5	1.26.9	1
ghcr.io/appscode/cluster-connector :v0.0.14	0efd9d9ef6ca	stdlib@go1.25.5	1.26.9	1
ghcr.io/appscode/cluster-presets :v0.0.12	8fbdd2479645	stdlib@go1.25.11	1.26.9	1
ghcr.io/appscode/config-syncer :v0.15.5	1858a68944cb	stdlib@go1.25.13	1.26.9	1
ghcr.io/appscode/csi-driver-cacerts :v0.6.0	ab213b156017	stdlib@go1.25.13	1.26.9	1
ghcr.io/appscode/docker-machine-operator :v0.0.4	81f6007abb4e	stdlib@go1.22.4	1.26.9	1
ghcr.io/appscode/external-dns-operator :v0.4.0	5605f97e636d	stdlib@go1.25.12	1.26.9	1
ghcr.io/appscode/falco-ui-server :v0.0.6	6ec488d89b56	stdlib@go1.25.5	1.26.9	1
ghcr.io/appscode/fileserver :v0.0.2	b1857871e06c	stdlib@go1.25.4	1.26.9	1
ghcr.io/appscode/gcp-credential-manager :v0.1.0	b58345fe8209	stdlib@go1.25.8	1.26.9	1
ghcr.io/appscode/gh-ci-webhook :v0.0.20	36ce246d884e	stdlib@go1.24.0	1.26.9	1
ghcr.io/appscode/gotenberg :8.25	f9104080d9a7	stdlib@go1.25.4	1.26.9	1
ghcr.io/appscode/grafana :v2025.2.3	67d18880448c	stdlib@go1.17.1	1.26.9	1
ghcr.io/appscode/grafana-tools :v0.0.2	2c7b9b0a9101	stdlib@go1.20.2	1.26.9	1
ghcr.io/appscode-images/postgres :18.3-bookworm	8d320c6facbc	stdlib@go1.24.6	1.26.9	1
ghcr.io/appscode/inbox-agent :v0.0.6	f630e47772c9	stdlib@go1.25.13	1.26.9	1
ghcr.io/appscode/kube-bind-server :v0.0.1	1762f3f6bb71	stdlib@go1.20.2	1.26.9	1
ghcr.io/appscode/kubectl-nonroot :v1.24	8ee5bdd68977	stdlib@go1.20.7	1.26.9	1
ghcr.io/appscode/kube-rbac-proxy :v0.18.2	7de54b6dedc8	stdlib@go1.23.3	1.26.9	1
ghcr.io/appscode/kube-rbac-proxy :v0.15.0	d8cc6ffb9819	stdlib@go1.21.3	1.26.9	1
ghcr.io/appscode/kube-ui-server :v0.0.13	40775d6850b5	stdlib@go1.19.5	1.26.9	1
ghcr.io/appscode/license-proxyserver :v0.0.3	72a5c874d854	stdlib@go1.19.6	1.26.9	1
ghcr.io/appscode/license-proxyserver :v0.0.8	d6c2532ea386	stdlib@go1.22.1	1.26.9	1
ghcr.io/appscode/offline-license-server :v0.0.76	e4b66308d8f6	stdlib@go1.25.5	1.26.9	1
ghcr.io/appscode/operator-shard-manager :v0.0.6	4a16c6ccecb8	stdlib@go1.25.11	1.26.9	1
ghcr.io/appscode/outboxsyncer :v0.6.0	c52861c4669f	stdlib@go1.25.13	1.26.9	1
ghcr.io/appscode/panopticon :v0.0.6	2cdae231ed8a	stdlib@go1.19.4	1.26.9	1
ghcr.io/appscode/panopticon :v0.0.24	3ea0e226a86d	stdlib@go1.25.13	1.26.9	1
ghcr.io/appscode/petset :v0.2.0	913f0858eb24	stdlib@go1.25.13	1.26.9	1
ghcr.io/appscode/petset :v0.2.0	acf407bb57d7	stdlib@go1.25.13	1.26.9	1
ghcr.io/appscode/pgoutbox :v0.0.4	a96e06ec5e9f	stdlib@go1.25.12	1.26.9	1
ghcr.io/appscode/scanner :v0.0.21	16907aae5de1	stdlib@go1.25.5	1.26.9	1
ghcr.io/appscode/secrets-store-csi-driver-provider-virtual-secrets :v0.2.0	7afb394f9f97	stdlib@go1.25.12	1.26.9	1
ghcr.io/appscode/sidekick :v0.0.16	d8d2a3c22ee7	stdlib@go1.25.12	1.26.9	1
ghcr.io/appscode/smtprelay :v0.0.4	79c9c76a78e6	stdlib@go1.23.2	1.26.9	1
ghcr.io/appscode/storage-metrics-server :v0.1.0	9cb4acb742a9	stdlib@go1.25.12	1.26.9	1
ghcr.io/appscode/supervisor :v0.0.2	1a58f56724da	stdlib@go1.19.4	1.26.9	1
ghcr.io/appscode/supervisor :v0.0.12	23affde10a92	stdlib@go1.25.12	1.26.9	1
ghcr.io/appscode/taskqueue :v0.0.3	6877c958a3c6	stdlib@go1.25.5	1.26.9	1
ghcr.io/appscode/trickster :v2.0.0	cdbbed831f28	stdlib@go1.25.5	1.26.9	1
ghcr.io/appscode/trivydb :0.0.3	67ffb0309acb	stdlib@go1.20.2	1.26.9	1