CVE-2026-56857

Critical

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: Critical; worst across findings
CVSS: 9.8; base score, highest
EPSS: 0.005; 41st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,276; of 18,137 indexed, latest versions
Container images: 6,115; deployed by those charts
Fix available: 1 of 1; affected package

Root.Mkdir(All) can follow junctions out of the root on Windows in os

Carried by container images the latest versions of 5,276 of 18,137 indexed charts deploy, on 6,115 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+208 more	1.26.9	6,115

OSV records: GO-2026-6604
Trending: Rank 3 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,276 by stars

Chart

Latest

Affected images

Radar Score

nfs-subdir-external-provisionerxxl-job-admin

4.0.18

1 of 1 See more

nfs-subdir-external-provisioner xxl-job-admin 4.0.18

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner :v4.0.2	63d5e04551ec	stdlib@go1.15	1.26.9

Open the chart page →

4,005

nightingalexxl-job-admin

0.2.11

4 of 6 See more

nightingale xxl-job-admin 0.2.11

4 of the 6 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	stdlib@go1.25.14	1.26.9
flashcatcloud/nightingale :8.0.0-beta.11	ea1b0aaabe09	stdlib@go1.23.9	1.26.9
library/mysql :5.7	4bc6bc963e6d	stdlib@go1.18.2	1.26.9
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	stdlib@go1.22.6	1.26.9

Open the chart page →

12,782

redisxxl-job-admin

24.1.3

1 of 1 See more

redis xxl-job-admin 24.1.3

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/dellnoantechnp/bitnami/redis :8.4.0	29064423c369	stdlib@go1.25.6	1.26.9

Open the chart page →

613

pgbounceryasn77-pgbouncer

0.0.8

1 of 1 See more

pgbouncer yasn77-pgbouncer 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/yasn77/pgbouncer :v0.0.6	cc8c13550e44	stdlib@go1.18.6	1.26.9

Open the chart page →

1,899

ygdrassil-monitoringygdrassil

0.4.0

7 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

7 of the 10 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	stdlib@go1.23.5	1.26.9
prom/alertmanager :v0.28.0	d5155cfac40a	stdlib@go1.23.4	1.26.9
quay.io/prometheus-operator/prometheus-config-reloader :v0.79.2	193280a33bc1	stdlib@go1.23.4	1.26.9
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	stdlib@go1.22.5	1.26.9
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	stdlib@go1.23.4	1.26.9
quay.io/prometheus/pushgateway :v1.11.0	99392035ae99	stdlib@go1.23.4	1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.14.0	37d841299325	stdlib@go1.23.3	1.26.9

Open the chart page →

13,875

ceph-exporterygqygq2

1.0.0

1 of 1 See more

ceph-exporter ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
digitalocean/ceph_exporter :latest	19b163e3fb95	stdlib@go1.20	1.26.9

Open the chart page →

6,880

mdbygqygq2

5.0.7

1 of 1 See more

170

mod-chartygqygq2

5.1.0

1 of 1 See more

mod-chart ygqygq2 5.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
bitnami/nginx :latest	b8d42f076789	stdlib@go1.26.8	1.26.9

Open the chart page →

170

prometheusalertygqygq2

1.0.0

1 of 1 See more

prometheusalert ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
feiyu563/prometheus-alert :v4.9.1	224cfa68cbd9	stdlib@go1.20.6	1.26.9

Open the chart page →

2,372

utcookygqygq2

2.1.4

1 of 1 See more

utcook ygqygq2 2.1.4

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
bitnami/nginx :latest	b8d42f076789	stdlib@go1.26.8	1.26.9

Open the chart page →

170

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	stdlib@go1.18.1	1.26.9

Open the chart page →

2,994

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	stdlib@go1.17.8	1.26.9
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	stdlib@go1.17.9	1.26.9
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	stdlib@go1.16	1.26.9
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	stdlib@go1.16	1.26.9

Open the chart page →

12,492

nginx-vts-exporterymrs

0.1.2

1 of 1 See more

nginx-vts-exporter ymrs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
sophos/nginx-vts-exporter :latest	f1073556b29b	stdlib@go1.13.6	1.26.9

Open the chart page →

2,470

version-checkerymrs

0.2.3

1 of 1 See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	stdlib@go1.15.2	1.26.9

Open the chart page →

4,267

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	b28bae15e219	stdlib@go1.26.7	1.26.9
quay.io/prometheus/alertmanager :latest	e9733bafb1bd	stdlib@go1.26.8	1.26.9
quay.io/prometheus/prometheus :latest	efd719c99d83	stdlib@go1.27.1	1.26.9

Open the chart page →

904

ical-filter-proxyyungwood

0.3.1

1 of 1 See more

ical-filter-proxy yungwood 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
yungwood/ical-filter-proxy :0.3.1	ddc3f30ab05f	stdlib@go1.26.5	1.26.9

Open the chart page →

259

synergy-wholesale-exporteryungwood

0.1.1

1 of 1 See more

synergy-wholesale-exporter yungwood 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
yungwood/synergy-wholesale-exporter :0.1.1	054dce85989b	stdlib@go1.26.5	1.26.9

Open the chart page →

259

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	stdlib@go1.20.4	1.26.9
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	stdlib@go1.20.4	1.26.9

Open the chart page →

6,702

zahori-moonzahori

1.0.1

3 of 3 See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon :2.5.1	a8837b00ba1c	stdlib@go1.20.4	1.26.9
quay.io/aerokube/moon-conf :2.5.1	9ca307b30080	stdlib@go1.20.4	1.26.9
quay.io/aerokube/moon-ui :2.0.5	89990b146824	stdlib@go1.20.5	1.26.9

Open the chart page →

5,024

zahori-schedulerzahori

1.0.1

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	stdlib@go1.20.5	1.26.9

Open the chart page →

3,136

jenkinszanise-jenkins-helm-chart

0.1.0

1 of 1 See more

jenkins zanise-jenkins-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
jenkins/jenkins :lts	a660310e39ad	stdlib@go1.27.0	1.26.9

Open the chart page →

2,212

posthogzeet

0.23.2

2 of 9 See more

posthog zeet 0.23.2

2 of the 9 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	stdlib@go1.17.13	1.26.9
altinity/metrics-exporter :latest	a5206c713de7	stdlib@go1.26.8	1.26.9

Open the chart page →

4,840

endlessh-gozekker6

0.4.0

1 of 1 See more

endlessh-go zekker6 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
ghcr.io/shizunge/endlessh-go :2026.0730.0	8826dad32623	stdlib@go1.26.5	1.26.9

Open the chart page →

827

karmazekker6

0.22.0

1 of 1 See more

karma zekker6 0.22.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
lmierzwa/karma :v0.133	f5d0a0ff4062	stdlib@go1.27.1	1.26.9

Open the chart page →

148

zookeeper-exporterzookeeper-exporter

0.1.0

1 of 1 See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
dabealu/zookeeper-exporter :latest	86106fec315f	stdlib@go1.14.15	1.26.9

Open the chart page →

2,294

zoo-project-druzoo-project

0.10.9

2 of 6 See more

zoo-project-dru zoo-project 0.10.9

2 of the 6 container images this version deploys carry CVE-2026-56857.

Container image	Digest	Package	Fixed in
library/postgres :18.6-alpine3.24	77f585114c32	stdlib@go1.24.6	1.26.9
zooproject/zoo-project :dru-51e7d55383f24594959b69e58518961c6aa66740	da112e8d03f1	stdlib@go1.26.8	1.26.9

Open the chart page →

7,310

Container images carrying it

6,115 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/kikplate/kikplate-api :main	2fbce0601a3c	stdlib@go1.25.11	1.26.9	1
ghcr.io/kite-org/kite :v0.16.0	951616cbaf9c	stdlib@go1.26.8	1.26.9	1
ghcr.io/kkb0318/irsa-manager :0.3.2	96d600ae97b4	stdlib@go1.22.7	1.26.9	1
ghcr.io/kkb0318/kom :0.3.0	4e77eff2d906	stdlib@go1.24.4	1.26.9	1
ghcr.io/kluster-manager/cluster-gateway :v1.12.1	58bed8d1e7fc	stdlib@go1.25.11	1.26.9	1
ghcr.io/kluster-manager/cluster-gateway-manager :v1.12.1	f22cae0e6cf3	stdlib@go1.25.11	1.26.9	1
ghcr.io/kluster-manager/cluster-profile :v0.13.0	b8b0aaef2543	stdlib@go1.25.13	1.26.9	1
ghcr.io/kluster-manager/cluster-proxy :latest	27a5c64b7ea8	stdlib@go1.21.8	1.26.9	1
ghcr.io/kluster-manager/cluster-proxy :v0.10.1	a7fce69e171c	stdlib@go1.25.11	1.26.9	1
ghcr.io/kluster-manager/fluxcd-addon :v0.0.11	37105f529ed0	stdlib@go1.25.13	1.26.9	1
ghcr.io/kluster-manager/fluxcd-addon :v0.0.2	3acba3df8827	stdlib@go1.22.3	1.26.9	1
ghcr.io/kluster-manager/managed-serviceaccount :latest	365183f83ac9	stdlib@go1.22.0	1.26.9	1
ghcr.io/kluster-manager/managed-serviceaccount :v0.10.0	fc256885915b	stdlib@go1.25.8	1.26.9	1
ghcr.io/kluster-manager/multicluster-controlplane :latest	6de40f528be9	stdlib@go1.21.8	1.26.9	1
ghcr.io/kluster-manager/registration-operator :v1.2.0	0cbced8e6240	stdlib@go1.25.7	1.26.9	1
ghcr.io/kokuwaio/gcloud-mysql :v3.2.19	63098135c550	stdlib@go1.26.1	1.26.9	1
ghcr.io/kokuwaio/pingdom-exporter :v0.5.7	3e52df096943	stdlib@go1.26.5	1.26.9	1
ghcr.io/kongz/piggy-webhooks :0.7.6	9197edc00bbf	stdlib@go1.26.8	1.26.9	1
ghcr.io/konsole-is/fqdn-controller :0.3.0	8d5d41ab22aa	stdlib@go1.27.0	1.26.9	1
ghcr.io/kore3lab/kore-board.backend :v0.5.5	455f6e7a26fd	stdlib@go1.19.4	1.26.9	1
ghcr.io/kore3lab/kore-board.metrics-scraper :v0.5.5	47f88b18fb7c	stdlib@go1.19.4	1.26.9	1
ghcr.io/kore3lab/kore-board.terminal :v0.5.5	f52e66eff50b	stdlib@go1.18.9	1.26.9	1
ghcr.io/krateoplatformops/aggregation-layer-example :0.1.0	6a0ed8196346	stdlib@go1.19.5	1.26.9	1
ghcr.io/krateoplatformops/app :1.2.86	aaa3fe7d5c74	stdlib@go1.22.9	1.26.9	1
ghcr.io/krateoplatformops/authn :0.23.0	791c8f9d885a	stdlib@go1.24.2	1.26.9	1
ghcr.io/krateoplatformops/azuredevops-provider :0.23.1	50f8f704df3d	stdlib@go1.23.12	1.26.9	1
ghcr.io/krateoplatformops/azuredevops-provider :0.16.1	d251f3e44714	stdlib@go1.19.5	1.26.9	1
ghcr.io/krateoplatformops/azuredevops-rest-dynamic-controller-plugin :0.0.5	86f36ba6fcc5	stdlib@go1.24.2	1.26.9	1
ghcr.io/krateoplatformops/azure-pricing-rest-dynamic-controller-plugin :0.1.0	68bd2c3fbf57	stdlib@go1.23.6	1.26.9	1
ghcr.io/krateoplatformops/backend :0.15.3	83743fcca3a7	stdlib@go1.23.3	1.26.9	1
ghcr.io/krateoplatformops/bff :0.8.7	799eeacbf9a0	stdlib@go1.23.3	1.26.9	1
ghcr.io/krateoplatformops/capi-watcher :0.1.0	fa01a157d972	stdlib@go1.19.2	1.26.9	1
ghcr.io/krateoplatformops/chart-inspector :1.0.0	264ba5302f8e	stdlib@go1.25.6	1.26.9	1
ghcr.io/krateoplatformops/composition-watcher :0.1.4	ef3b17c07cfc	stdlib@go1.23.2	1.26.9	1
ghcr.io/krateoplatformops/core-provider :0.10.2	205bcfac23e3	stdlib@go1.21.4	1.26.9	1
ghcr.io/krateoplatformops/core-provider :1.0.0	363cdedfa59f	stdlib@go1.25.6	1.26.9	1
ghcr.io/krateoplatformops/deviser :0.7.1	8310717431b2	stdlib@go1.26.3	1.26.9	1
ghcr.io/krateoplatformops/etcd :3.5.19-debian-12-r0	0d68858b2699	stdlib@go1.23.7	1.26.9	1
ghcr.io/krateoplatformops/eventrouter :0.3.1	6b958b8a6058	stdlib@go1.19.2	1.26.9	1
ghcr.io/krateoplatformops/eventrouter-kafka-producer :0.1.1	55b18c0dda37	stdlib@go1.19.2	1.26.9	1
ghcr.io/krateoplatformops/events-ingester :0.5.3	e917b25f6b49	stdlib@go1.26.3	1.26.9	1
ghcr.io/krateoplatformops/events-presenter :0.9.3	81b8ad5e4178	stdlib@go1.26.3	1.26.9	1
ghcr.io/krateoplatformops/eventstack/eventrouter :0.6.0	30121418adfa	stdlib@go1.25.5	1.26.9	1
ghcr.io/krateoplatformops/eventstack/eventsse :0.5.8	b65eb9c88669	stdlib@go1.25.4	1.26.9	1
ghcr.io/krateoplatformops/eventstack/sweeper :0.1.0	5d5e24119ff1	stdlib@go1.25.3	1.26.9	1
ghcr.io/krateoplatformops/finops-composition-definition-parser :0.1.2	d9d82c32f418	stdlib@go1.24.2	1.26.9	1
ghcr.io/krateoplatformops/finops-database-handler-uploader :0.2.1	31ee1096bc9c	stdlib@go1.25.4	1.26.9	1
ghcr.io/krateoplatformops/finops-http-rest-queue :0.1.0	eaa0801e29a7	stdlib@go1.22.1	1.26.9	1
ghcr.io/krateoplatformops/finops-moving-window-microservice :0.1.0	1c9a888ee58f	stdlib@go1.24.2	1.26.9	1
ghcr.io/krateoplatformops/finops-nats-subscriber :0.1.0	761d96bf2d9c	stdlib@go1.22.1	1.26.9	1