StackRadar

CVE-2026-56864

High

Advisory

Published 13 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.003
22nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
457
of 17,787 indexed, latest versions
Container images
424
deployed by those charts
Fix available
1 of 2
affected packages

Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

Carried by container images the latest versions of 457 of 17,787 indexed charts deploy, on 424 images.

Affected packageAffected versionsFixed inImages
golang-1.19deb1.19.8-2no fix listed1
golang.org/x/modgolangv0.1.0, v0.2.0, v0.3.0, v0.4.2+38 more0.40.0423
OSV records
DEBIAN-CVE-2026-56864GO-2026-6180
Also known as
BIT-golang-2026-56864

Charts affected

457 by stars
ChartLatestAffected imagesRadar Score
monitoringrocketchat-server0.0.171 of 9See more

monitoring rocketchat-server 0.0.17

1 of the 9 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.143.03bc07732530c
golang.org/x/mod@v0.31.0
0.40.0

Open the chart page →

6,860
devtron-enterpriseromholdings48.0.02 of 28See more

devtron-enterprise romholdings 48.0.0

2 of the 28 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
golang.org/x/mod@v0.30.0
0.40.0
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
golang.org/x/mod@v0.13.0
0.40.0

Open the chart page →

66,542
devtron-operatorromholdings0.23.31 of 11See more

devtron-operator romholdings 0.23.3

1 of the 11 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
golang.org/x/mod@v0.30.0
0.40.0

Open the chart page →

31,447
chainrss30.1.284 of 8See more

chain rss3 0.1.28

4 of the 8 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
rss3/op-batcher:d2c5ced00901227473fc196fda838191f0cb4e02e8adc09d9c07
golang.org/x/mod@v0.13.0
0.40.0
rss3/op-geth:rss3-main-1ecad3026148aa1bc52
golang.org/x/mod@v0.14.0
0.40.0
rss3/op-node:d2c5ced00901227473fc196fda838191f0cb4e02d1d2ae6efd05
golang.org/x/mod@v0.13.0
0.40.0
rss3/op-proposer:d2c5ced00901227473fc196fda838191f0cb4e0296672897ba9e
golang.org/x/mod@v0.13.0
0.40.0

Open the chart page →

8,528
op-batcherrss30.1.01 of 2See more

op-batcher rss3 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
rss3/op-batcher:a77d1f52fc3492bf21915bdff8ee8e0b5bd2cb8adae8a5bdd7a6
golang.org/x/mod@v0.13.0
0.40.0

Open the chart page →

1,251
op-proposerrss30.1.01 of 2See more

op-proposer rss3 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
rss3/op-proposer:a77d1f52fc3492bf21915bdff8ee8e0b5bd2cb8aa4059dd32c48
golang.org/x/mod@v0.13.0
0.40.0

Open the chart page →

1,251
vsl-chainrss30.1.04 of 7See more

vsl-chain rss3 0.1.0

4 of the 7 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
rss3/op-batcher:a77d1f52fc3492bf21915bdff8ee8e0b5bd2cb8adae8a5bdd7a6
golang.org/x/mod@v0.13.0
0.40.0
rss3/op-geth:rss3-main-1ecad3026148aa1bc52
golang.org/x/mod@v0.14.0
0.40.0
rss3/op-node:a77d1f52fc3492bf21915bdff8ee8e0b5bd2cb8a45b91380bbe7
golang.org/x/mod@v0.13.0
0.40.0
rss3/op-proposer:a77d1f52fc3492bf21915bdff8ee8e0b5bd2cb8aa4059dd32c48
golang.org/x/mod@v0.13.0
0.40.0

Open the chart page →

6,044
vsl-rpcrss30.3.42 of 4See more

vsl-rpc rss3 0.3.4

2 of the 4 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
rss3/op-geth:rss3-main-1ecad3026148aa1bc52
golang.org/x/mod@v0.14.0
0.40.0
rss3/op-node:d2c5ced00901227473fc196fda838191f0cb4e02d1d2ae6efd05
golang.org/x/mod@v0.13.0
0.40.0

Open the chart page →

4,611
vsl-sequencerrss30.3.42 of 4See more

vsl-sequencer rss3 0.3.4

2 of the 4 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
rss3/op-geth:rss3-main-1ecad3026148aa1bc52
golang.org/x/mod@v0.14.0
0.40.0
rss3/op-node:d2c5ced00901227473fc196fda838191f0cb4e02d1d2ae6efd05
golang.org/x/mod@v0.13.0
0.40.0

Open the chart page →

4,611
gitearubxkubeVerified publisher1.2.31 of 1See more

gitea rubxkube 1.2.3

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
gitea/gitea:1.27.134e3f6b75f5c
golang.org/x/mod@v0.37.0
0.40.0

Open the chart page →

592
memorubxkubeVerified publisher1.2.11 of 1See more

memo rubxkube 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
neosmemo/memos:0.293e1253477066
golang.org/x/mod@v0.35.0
0.40.0

Open the chart page →

555
spindlerubxkubeVerified publisher0.1.11 of 2See more

spindle rubxkube 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
library/docker:29.7.2-dind3ef33f2e220b
golang.org/x/mod@v0.36.0
0.40.0

Open the chart page →

1,439
ed-traefik2scaleway-charts0.2.01 of 1See more

ed-traefik2 scaleway-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
library/traefik:2.5.62f603f8d3abe
golang.org/x/mod@v0.4.2
0.40.0

Open the chart page →

3,160
photoprismschoolguys-helmcharts0.3.81 of 1See more

photoprism schoolguys-helmcharts 0.3.8

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
photoprism/photoprism:260601650c6ad5a651
golang.org/x/mod@v0.36.0
0.40.0

Open the chart page →

10,429
hermitcrabseal-ioVerified publisher0.1.42 of 2See more

hermitcrab seal-io 0.1.4

2 of the 2 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
sealio/hermitcrab:v0.1.4a326a2f03660
golang.org/x/mod@v0.17.0
0.40.0
sealio/terraform-deployer:v1.5.7-seal.1b0389d9848a5
golang.org/x/mod@v0.8.0
0.40.0

Open the chart page →

4,883
semaphoresemaphore-light1.0.01 of 1See more

semaphore semaphore-light 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
semaphoreui/semaphore:latest3996804607eb
golang.org/x/mod@v0.30.0
0.40.0

Open the chart page →

1,674
service-exampleservice-example-jt0.1.11 of 9See more

service-example service-example-jt 0.1.1

1 of the 9 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
bitnami/mongodb-exporter:latestf7034c13af4e
golang.org/x/mod@v0.37.0
0.40.0

Open the chart page →

7,105
ccx-monitoringseveralnines0.6.211 of 7See more

ccx-monitoring severalnines 0.6.21

1 of the 7 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
quay.io/prometheus/alertmanager:v0.26.0361db356b330
golang.org/x/mod@v0.9.0
0.40.0

Open the chart page →

7,709
alertmanagersignoz0.5.21 of 1See more

alertmanager signoz 0.5.2

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
signoz/alertmanager:0.5.07bc7de2e33c2
golang.org/x/mod@v0.4.2
0.40.0

Open the chart page →

2,181
ctlog-tilessigstoreVerified publisher0.1.71 of 1See more

ctlog-tiles sigstore 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
ghcr.io/transparency-dev/tesseract/posix:v0.1.2b044edd23888
golang.org/x/mod@v0.38.0
0.40.0

Open the chart page →

256
sigstore-probersigstoreVerified publisher0.3.11 of 1See more

sigstore-prober sigstore 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
ghcr.io/sigstore/sigstore-probers/prober:v1.0.1d1e914e6d6b9
golang.org/x/mod@v0.36.0
0.40.0

Open the chart page →

424
keycloak-configuratorsikalabs0.2.01 of 1See more

keycloak-configurator sikalabs 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
hashicorp/terraform:1.44dcb45513699
golang.org/x/mod@v0.8.0
0.40.0

Open the chart page →

2,863
bytesafe-cesimcube1.0.41 of 3See more

bytesafe-ce simcube 1.0.4

1 of the 3 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
bytesafe/bytesafe-ce:v1.0.4ee287384c005
golang.org/x/mod@v0.10.0
0.40.0

Open the chart page →

1,494
tailscalesinextraVerified publisher0.18.11 of 2See more

tailscale sinextra 0.18.1

1 of the 2 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
registry.k8s.io/coredns/coredns:v1.13.294caebb89dcf
golang.org/x/mod@v0.29.0
0.40.0

Open the chart page →

1,047
teamcitysinextraVerified publisher1.0.21 of 3See more

teamcity sinextra 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
library/docker:26.1-dinddd43b430341a
golang.org/x/mod@v0.17.0
0.40.0

Open the chart page →

2,429
axonhubsnubisks0.1.01 of 3See more

axonhub snubisks 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
looplj/axonhub:latest2c71eeaef295
golang.org/x/mod@v0.38.0
0.40.0

Open the chart page →

682
harborsoftonic1.13.01 of 8See more

harbor softonic 1.13.0

1 of the 8 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
golang.org/x/mod@v0.12.0
0.40.0

Open the chart page →

7,672
datadogspartan0.1.01 of 1See more

datadog spartan 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
gcr.io/datadoghq/cluster-agent:7.61.06efe04ba4e06
golang.org/x/mod@v0.22.0
0.40.0

Open the chart page →

3,272
spire-identity-exchangespiffeVerified publisher0.2.21 of 3See more

spire-identity-exchange spiffe 0.2.2

1 of the 3 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
ghcr.io/spiffe/spire-agent:1.15.341b0dcd8b258
golang.org/x/mod@v0.38.0
0.40.0

Open the chart page →

1,429
stackrox-operatorstackroxVerified publisher4.11.31 of 1See more

stackrox-operator stackrox 4.11.3

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
quay.io/stackrox-io/stackrox-operator:4.11.3e12f4ca30515
golang.org/x/mod@v0.38.0
0.40.0

Open the chart page →

164
stakefishstakefish0.1.01 of 8See more

stakefish stakefish 0.1.0

1 of the 8 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
quay.io/prometheus/alertmanager:v0.27.0e13b6ed5cb92
golang.org/x/mod@v0.14.0
0.40.0

Open the chart page →

18,426
argocd-operatorstatcan0.5.01 of 1See more

argocd-operator statcan 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-operator:v0.4.0cf8faa986789
golang.org/x/mod@v0.5.1-0.20210830214625-1b1db11ec8f4
0.40.0

Open the chart page →

1,985
group-challengesubshell-labVerified publisher2.1.01 of 2See more

group-challenge subshell-lab 2.1.0

1 of the 2 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
darthsim/imgproxy:v3.29.17d12c7c8fc66
golang.org/x/mod@v0.25.0
0.40.0

Open the chart page →

2,579
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
golang.org/x/mod@v0.27.0
0.40.0

Open the chart page →

3,372
tbot-spiffe-daemon-setteleport-agent-kube18.11.01 of 1See more

tbot-spiffe-daemon-set teleport-agent-kube 18.11.0

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
public.ecr.aws/gravitational/tbot-distroless:18.11.04ba5ace31fea
golang.org/x/mod@v0.37.0
0.40.0

Open the chart page →

455
temporaltemporal0.28.91 of 13See more

temporal temporal 0.28.9

1 of the 13 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
quay.io/prometheus/alertmanager:v0.23.09ab73a421b65
golang.org/x/mod@v0.4.2
0.40.0

Open the chart page →

21,004
monitoringthl-chartsVerified publisher0.1.11 of 10See more

monitoring thl-charts 0.1.1

1 of the 10 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
quay.io/prometheus/alertmanager:v0.23.09ab73a421b65
golang.org/x/mod@v0.4.2
0.40.0

Open the chart page →

18,908
netbirdtotmicro1.8.21 of 4See more

netbird totmicro 1.8.2

1 of the 4 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
netbirdio/management:0.60.252682e5f48f9
golang.org/x/mod@v0.26.0
0.40.0

Open the chart page →

5,966
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
golang.org/x/mod@v0.16.0
0.40.0

Open the chart page →

2,478
tyk-control-planetyk-helm5.3.02 of 7See more

tyk-control-plane tyk-helm 5.3.0

2 of the 7 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
tykio/tyk-dashboard:v5.13.10e03b94c153d
golang.org/x/mod@v0.36.0
0.40.0
tykio/tyk-gateway-ee:v5.13.13e907e675bf9
golang.org/x/mod@v0.36.0
0.40.0

Open the chart page →

2,929
tyk-dashboardtyk-helm5.3.01 of 1See more

tyk-dashboard tyk-helm 5.3.0

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
tykio/tyk-dashboard:v5.13.10e03b94c153d
golang.org/x/mod@v0.36.0
0.40.0

Open the chart page →

659
tyk-data-planetyk-helm5.3.01 of 3See more

tyk-data-plane tyk-helm 5.3.0

1 of the 3 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
tykio/tyk-gateway-ee:v5.13.13e907e675bf9
golang.org/x/mod@v0.36.0
0.40.0

Open the chart page →

846
tyk-stacktyk-helm5.3.02 of 7See more

tyk-stack tyk-helm 5.3.0

2 of the 7 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
tykio/tyk-dashboard:v5.13.10e03b94c153d
golang.org/x/mod@v0.36.0
0.40.0
tykio/tyk-gateway-ee:v5.13.13e907e675bf9
golang.org/x/mod@v0.36.0
0.40.0

Open the chart page →

2,879
velero-clientvelero-clientVerified publisher1.4.21 of 1See more

velero-client velero-client 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/velero-client/velero-client:1.4.203015f863a3e
golang.org/x/mod@v0.36.0
0.40.0

Open the chart page →

532
corednsvks-helm-chartsVerified publisher1.45.01 of 1See more

coredns vks-helm-charts 1.45.0

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
coredns/coredns:1.13.19b9128672209
golang.org/x/mod@v0.27.0
0.40.0

Open the chart page →

887
voidllmvoidllmVerified publisher0.0.251 of 1See more

voidllm voidllm 0.0.25

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
ghcr.io/voidmind-io/voidllm:0.0.250df11dd20c28
golang.org/x/mod@v0.37.0
0.40.0

Open the chart page →

277
aih-scannerwallarmVerified publisher2.7.111 of 2See more

aih-scanner wallarm 2.7.11

1 of the 2 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
wallarm/aih-scanner:2.7.11f1cb26db1f5b
golang.org/x/mod@v0.29.0
0.40.0

Open the chart page →

3,906
gateway-control-planewallarmVerified publisher0.2.01 of 2See more

gateway-control-plane wallarm 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
wallarm/gateway-control-plane:0.2.0a321bc974a19
golang.org/x/mod@v0.27.0
0.40.0

Open the chart page →

1,455
alertmanagerwenerme1.43.11 of 1See more

alertmanager wenerme 1.43.1

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
quay.io/prometheus/alertmanager:v0.34.0690c7b525f43
golang.org/x/mod@v0.38.0
0.40.0

Open the chart page →

63
argo-eventswenerme2.4.271 of 1See more

argo-events wenerme 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-56864.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
golang.org/x/mod@v0.38.0
0.40.0

Open the chart page →

969

Container images carrying it

424 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/hpestorage/csi-driver:v3.3.0e58e22427b38
golang.org/x/mod@v0.38.0
0.40.0
1
quay.io/hpestorage/csi-driver:v3.2.0ef7f4e1544fa
golang.org/x/mod@v0.30.0
0.40.0
1
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
golang.org/x/mod@v0.4.2
0.40.0
1
quay.io/jenkins-kubernetes-operator/operator:v0.8.171cb50263c3b
golang.org/x/mod@v0.4.2
0.40.0
1
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
golang.org/x/mod@v0.12.0
0.40.0
1
quay.io/kubescape/kubescape:v4.0.1358651dce3376
golang.org/x/mod@v0.38.0
0.40.0
1
quay.io/kubescape/node-agent:v0.3.2192044ed750f5e
golang.org/x/mod@v0.37.0
0.40.0
1
quay.io/kubescape/operator:v0.2.16901b2694425e9
golang.org/x/mod@v0.35.0
0.40.0
1
quay.io/minio/operator:v7.1.1cd587f60c43d
golang.org/x/mod@v0.24.0
0.40.0
1
quay.io/nuclio/dashboard:1.17.8-amd64b5f5bd4efbee
golang.org/x/mod@v0.34.0
0.40.0
1
quay.io/piraeusdatastore/nri-volume-qos:v0.1.3cbe3e1ea2b6a
golang.org/x/mod@v0.36.0
0.40.0
1
quay.io/prometheus/alertmanager:v0.24.0088464f949de
golang.org/x/mod@v0.5.1
0.40.0
1
quay.io/prometheus/alertmanager:v0.32.058e117eabcce
golang.org/x/mod@v0.34.0
0.40.0
1
quay.io/prometheus/alertmanager:v0.31.188b605de9aba
golang.org/x/mod@v0.32.0
0.40.0
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
golang.org/x/mod@v0.12.0
0.40.0
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
golang.org/x/mod@v0.4.2
0.40.0
1
quay.io/skopeo/stable:v1.134853591bd1d2
golang.org/x/mod@v0.10.0
0.40.0
1
quay.io/stackrox-io/stackrox-operator:4.11.3e12f4ca30515
golang.org/x/mod@v0.38.0
0.40.0
1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator:3.3.242dd426130a9
golang.org/x/mod@v0.39.0
0.40.0
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
golang.org/x/mod@v0.35.0
0.40.0
1
registry.gitlab.com/xrow-public/helm-openclaw/openclaw:1.91.3ed44d81a65de
golang.org/x/mod@v0.39.0
0.40.0
1
registry.gitlab.com/xrow-public/velero-client/velero-client:1.4.203015f863a3e
golang.org/x/mod@v0.36.0
0.40.0
1
registry.k8s.io/coredns/coredns:v1.13.294caebb89dcf
golang.org/x/mod@v0.29.0
0.40.0
1
registry.k8s.io/dns/k8s-dns-node-cache:1.26.78b9a78d101a1
golang.org/x/mod@v0.28.0
0.40.0
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.