CVE-2026-56857

Critical

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: Critical; worst across findings
CVSS: 9.8; base score, highest
EPSS: 0.005; 41st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,276; of 18,137 indexed, latest versions
Container images: 6,115; deployed by those charts
Fix available: 1 of 1; affected package

Root.Mkdir(All) can follow junctions out of the root on Windows in os

Carried by container images the latest versions of 5,276 of 18,137 indexed charts deploy, on 6,115 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+208 more	1.26.9	6,115

OSV records: GO-2026-6604
Trending: Rank 3 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,276 by stars

Chart

Latest

Affected images

Radar Score

nfs-subdir-external-provisionerxxl-job-admin

4.0.18

1 of 1 See more

nfs-subdir-external-provisioner xxl-job-admin 4.0.18

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner :v4.0.2	63d5e04551ec	stdlib@go1.15	1.26.9

Open the chart page →

4,005

nightingalexxl-job-admin

0.2.11

4 of 6 See more

nightingale xxl-job-admin 0.2.11

4 of the 6 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	stdlib@go1.25.14	1.26.9
flashcatcloud/nightingale :8.0.0-beta.11	ea1b0aaabe09	stdlib@go1.23.9	1.26.9
library/mysql :5.7	4bc6bc963e6d	stdlib@go1.18.2	1.26.9
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	stdlib@go1.22.6	1.26.9

Open the chart page →

12,782

redisxxl-job-admin

24.1.3

1 of 1 See more

redis xxl-job-admin 24.1.3

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/dellnoantechnp/bitnami/redis :8.4.0	29064423c369	stdlib@go1.25.6	1.26.9

Open the chart page →

613

pgbounceryasn77-pgbouncer

0.0.8

1 of 1 See more

pgbouncer yasn77-pgbouncer 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/yasn77/pgbouncer :v0.0.6	cc8c13550e44	stdlib@go1.18.6	1.26.9

Open the chart page →

1,899

ygdrassil-monitoringygdrassil

0.4.0

7 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

7 of the 10 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	stdlib@go1.23.5	1.26.9
prom/alertmanager :v0.28.0	d5155cfac40a	stdlib@go1.23.4	1.26.9
quay.io/prometheus-operator/prometheus-config-reloader :v0.79.2	193280a33bc1	stdlib@go1.23.4	1.26.9
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	stdlib@go1.22.5	1.26.9
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	stdlib@go1.23.4	1.26.9
quay.io/prometheus/pushgateway :v1.11.0	99392035ae99	stdlib@go1.23.4	1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.14.0	37d841299325	stdlib@go1.23.3	1.26.9

Open the chart page →

13,875

ceph-exporterygqygq2

1.0.0

1 of 1 See more

ceph-exporter ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
digitalocean/ceph_exporter :latest	19b163e3fb95	stdlib@go1.20	1.26.9

Open the chart page →

6,880

mdbygqygq2

5.0.7

1 of 1 See more

170

mod-chartygqygq2

5.1.0

1 of 1 See more

mod-chart ygqygq2 5.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
bitnami/nginx :latest	b8d42f076789	stdlib@go1.26.8	1.26.9

Open the chart page →

170

prometheusalertygqygq2

1.0.0

1 of 1 See more

prometheusalert ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
feiyu563/prometheus-alert :v4.9.1	224cfa68cbd9	stdlib@go1.20.6	1.26.9

Open the chart page →

2,372

utcookygqygq2

2.1.4

1 of 1 See more

utcook ygqygq2 2.1.4

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
bitnami/nginx :latest	b8d42f076789	stdlib@go1.26.8	1.26.9

Open the chart page →

170

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	stdlib@go1.18.1	1.26.9

Open the chart page →

2,994

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	stdlib@go1.17.8	1.26.9
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	stdlib@go1.17.9	1.26.9
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	stdlib@go1.16	1.26.9
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	stdlib@go1.16	1.26.9

Open the chart page →

12,492

nginx-vts-exporterymrs

0.1.2

1 of 1 See more

nginx-vts-exporter ymrs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
sophos/nginx-vts-exporter :latest	f1073556b29b	stdlib@go1.13.6	1.26.9

Open the chart page →

2,470

version-checkerymrs

0.2.3

1 of 1 See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	stdlib@go1.15.2	1.26.9

Open the chart page →

4,267

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	b28bae15e219	stdlib@go1.26.7	1.26.9
quay.io/prometheus/alertmanager :latest	e9733bafb1bd	stdlib@go1.26.8	1.26.9
quay.io/prometheus/prometheus :latest	efd719c99d83	stdlib@go1.27.1	1.26.9

Open the chart page →

904

ical-filter-proxyyungwood

0.3.1

1 of 1 See more

ical-filter-proxy yungwood 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
yungwood/ical-filter-proxy :0.3.1	ddc3f30ab05f	stdlib@go1.26.5	1.26.9

Open the chart page →

259

synergy-wholesale-exporteryungwood

0.1.1

1 of 1 See more

synergy-wholesale-exporter yungwood 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
yungwood/synergy-wholesale-exporter :0.1.1	054dce85989b	stdlib@go1.26.5	1.26.9

Open the chart page →

259

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	stdlib@go1.20.4	1.26.9
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	stdlib@go1.20.4	1.26.9

Open the chart page →

6,702

zahori-moonzahori

1.0.1

3 of 3 See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon :2.5.1	a8837b00ba1c	stdlib@go1.20.4	1.26.9
quay.io/aerokube/moon-conf :2.5.1	9ca307b30080	stdlib@go1.20.4	1.26.9
quay.io/aerokube/moon-ui :2.0.5	89990b146824	stdlib@go1.20.5	1.26.9

Open the chart page →

5,024

zahori-schedulerzahori

1.0.1

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	stdlib@go1.20.5	1.26.9

Open the chart page →

3,136

jenkinszanise-jenkins-helm-chart

0.1.0

1 of 1 See more

jenkins zanise-jenkins-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
jenkins/jenkins :lts	a660310e39ad	stdlib@go1.27.0	1.26.9

Open the chart page →

2,212

posthogzeet

0.23.2

2 of 9 See more

posthog zeet 0.23.2

2 of the 9 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	stdlib@go1.17.13	1.26.9
altinity/metrics-exporter :latest	a5206c713de7	stdlib@go1.26.8	1.26.9

Open the chart page →

4,840

endlessh-gozekker6

0.4.0

1 of 1 See more

endlessh-go zekker6 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/shizunge/endlessh-go :2026.0730.0	8826dad32623	stdlib@go1.26.5	1.26.9

Open the chart page →

827

karmazekker6

0.22.0

1 of 1 See more

karma zekker6 0.22.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
lmierzwa/karma :v0.133	f5d0a0ff4062	stdlib@go1.27.1	1.26.9

Open the chart page →

148

zookeeper-exporterzookeeper-exporter

0.1.0

1 of 1 See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
dabealu/zookeeper-exporter :latest	86106fec315f	stdlib@go1.14.15	1.26.9

Open the chart page →

2,294

zoo-project-druzoo-project

0.10.9

2 of 6 See more

zoo-project-dru zoo-project 0.10.9

2 of the 6 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/postgres :18.6-alpine3.24	77f585114c32	stdlib@go1.24.6	1.26.9
zooproject/zoo-project :dru-51e7d55383f24594959b69e58518961c6aa66740	da112e8d03f1	stdlib@go1.26.8	1.26.9

Open the chart page →

7,310

Container images carrying it

6,115 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/jdilsham/ai-k8s-agent-backend :0.1.1	ec4b8534ded6	stdlib@go1.26.8	1.26.9	1
ghcr.io/jens-maus/raspberrymatic :3.83.6.20250824	4b22b4f407c4	stdlib@go1.24.4	1.26.9	1
ghcr.io/jkroepke/kube-webhook-certgen :1.8.0	43401e216e89	stdlib@go1.26.1	1.26.9	1
ghcr.io/jkroepke/kube-webhook-certgen :1.8.1	4f6da0256b1b	stdlib@go1.26.2	1.26.9	1
ghcr.io/jkroepke/kube-webhook-certgen :1.7.7	b18964551d8e	stdlib@go1.25.5	1.26.9	1
ghcr.io/jlclx/runtimeclass-controller :latest	b3a87f92a963	stdlib@go1.17.13	1.26.9	1
ghcr.io/jmberesford/retrom-service :retrom-v0.7.14	4d763d58f11d	stdlib@go1.20.12	1.26.9	1
ghcr.io/jmcgrath207/k8s-ephemeral-storage-metrics :1.21.3	8297aa4a9278	stdlib@go1.26.5	1.26.9	1
ghcr.io/jmcgrath207/par :v0.1.0	9977511cb142	stdlib@go1.19.10	1.26.9	1
ghcr.io/jmriebold/sqs-prometheus-exporter :1.1.0	7564828ab7cb	stdlib@go1.24.0	1.26.9	1
ghcr.io/jodevsa/wireguard-operator/manager :v2.0.28	39412bdd403b	stdlib@go1.22.2	1.26.9	1
ghcr.io/jsclayton/prometheus-plex-exporter :latest	18ef1b2197ef	stdlib@go1.23.0	1.26.9	1
ghcr.io/juanfont/headscale :0.29.4-debug	2380cdb4951e	stdlib@go1.26.5	1.26.9	1
ghcr.io/juanfont/headscale :v0.29.5	780ed2f9e857	stdlib@go1.26.8	1.26.9	1
ghcr.io/juanfont/headscale :0.29.1	8453e47ea6bf	stdlib@go1.26.4	1.26.9	1
ghcr.io/juanfont/headscale :0.29.4 :v0.29.4	8833f828b414	stdlib@go1.26.5	1.26.9	1
ghcr.io/juanfont/headscale :v0.25.0	97febecbe6cb	stdlib@go1.23.4	1.26.9	1
ghcr.io/juice-shop/multi-juicer/multi-juicer :v10.3.1	de4f0de62e8b	stdlib@go1.26.7	1.26.9	1
ghcr.io/juniorjpdj/containers/ejabberd-captcha :26.07-r1	10c57cbc7ad0	stdlib@go1.25.12	1.26.9	1
ghcr.io/justwatchcom/sql_exporter :v0.8	c4b1d3d0f052	stdlib@go1.24.4	1.26.9	1
ghcr.io/k0rdent/kcm/controller :1.12.0	0ec66900c2a9	stdlib@go1.26.6	1.26.9	1
ghcr.io/k0rdent/kcm/telemetry :1.12.0	1718c4b14e65	stdlib@go1.26.6	1.26.9	1
ghcr.io/k10app/businit :latest	94c9a3e799c2	stdlib@go1.19.3	1.26.9	1
ghcr.io/k8s-at-home/apache-musicindex :v1.4.1-2	c9bd82dc5fda	stdlib@go1.18.4	1.26.9	1
ghcr.io/k8s-at-home/bazarr :v1.0.3	fdb5501cdfb9	stdlib@go1.16.8	1.26.9	1
ghcr.io/k8s-at-home/cni-plugins :v0.9.1	241592d93640	stdlib@go1.15.8	1.26.9	1
ghcr.io/k8s-at-home/emby :v4.6.1.0	5c6b8f91f1c4	stdlib@go1.15	1.26.9	1
ghcr.io/k8s-at-home/gateway-admision-controller :v2.0.0	0d6d0df98fe4	stdlib@go1.16.4	1.26.9	1
ghcr.io/k8s-at-home/gateway-admision-controller :v3.5.0	175512bb3f61	stdlib@go1.18.3	1.26.9	1
ghcr.io/k8s-at-home/haste-server :latest	827aa2f2389d	stdlib@go1.15	1.26.9	1
ghcr.io/k8s-at-home/jackett :v0.20.1316	3a4715b46aa2	stdlib@go1.18.3	1.26.9	1
ghcr.io/k8s-at-home/lidarr :v1.0.0.2255	54ebc1f90963	stdlib@go1.16.7	1.26.9	1
ghcr.io/k8s-at-home/network-ups-tools :v2.7.4-2479-g86a32237	cbd5d4cc1245	stdlib@go1.15	1.26.9	1
ghcr.io/k8s-at-home/nullserv :v1.3.0	0792c7e6d814	stdlib@go1.16.5	1.26.9	1
ghcr.io/k8s-at-home/nzbget :v21.1	e5571acd10ce	stdlib@go1.18.4	1.26.9	1
ghcr.io/k8s-at-home/nzbhydra2 :v3.14.2	ef3670f7e0a8	stdlib@go1.15	1.26.9	1
ghcr.io/k8s-at-home/plex :v1.28.0.5999-97678ded3	ef756c7d784b	stdlib@go1.18.4	1.26.9	1
ghcr.io/k8s-at-home/prowlarr :v0.3.0.1710	c863aa9875fa	stdlib@go1.16.8	1.26.9	1
ghcr.io/k8s-at-home/qbittorrent :v4.4.2	61deadd1ec78	stdlib@go1.16.8	1.26.9	1
ghcr.io/k8s-at-home/radarr :v4.1.0.6175	4273dfaf0295	stdlib@go1.18.4	1.26.9	1
ghcr.io/k8s-at-home/readarr :v0.1.0.715	ad943e9309e4	stdlib@go1.15	1.26.9	1
ghcr.io/k8s-at-home/sabnzbd :v3.3.1	c2d6e775db5a	stdlib@go1.15	1.26.9	1
ghcr.io/k8s-at-home/sonarr :v3.0.8.1507	0eb230e2381a	stdlib@go1.18.4	1.26.9	1
ghcr.io/k8s-at-home/tautulli :v2.7.7	4ea617c30397	stdlib@go1.16.7	1.26.9	1
ghcr.io/k8s-at-home/transmission :v3.00	6011182e3946	stdlib@go1.18.4	1.26.9	1
ghcr.io/k8s-at-home/wireguard :v1.0.20210424	448045c4270b	stdlib@go1.15	1.26.9	1
ghcr.io/k8s-at-home/xteve :v2.2.0.200	292b3614670f	stdlib@go1.16.8	1.26.9	1
ghcr.io/k8sgpt-ai/k8sgpt-operator :v0.2.29	82d0adcce816	stdlib@go1.26.5	1.26.9	1
ghcr.io/k8s-home-lab/wireguard :v1.0.20210914	779858b5e11d	stdlib@go1.18.5	1.26.9	1
ghcr.io/k8s-lynq/lynq :1.1.22	229b05e3c717	stdlib@go1.24.13	1.26.9	1