StackRadar

CVE-2026-56865

High

Advisory

Published 13 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.4
base score, highest
EPSS
0.001
1st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
453
of 17,781 indexed, latest versions
Container images
422
deployed by those charts
Fix available
1 of 2
affected packages

Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

Carried by container images the latest versions of 453 of 17,781 indexed charts deploy, on 422 images.

Affected packageAffected versionsFixed inImages
golang-1.19deb1.19.8-2no fix listed1
golang.org/x/modgolangv0.1.0, v0.2.0, v0.3.0, v0.4.2+38 more0.40.0421
OSV records
DEBIAN-CVE-2026-56865GO-2026-6179
Also known as
BIT-golang-2026-56865

Charts affected

453 by stars
ChartLatestAffected imagesRadar Score
waypointhashicorpVerified publisher0.1.211 of 2See more

waypoint hashicorp 0.1.21

1 of the 2 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
hashicorp/waypoint:0.11.397d521a27498
golang.org/x/mod@v0.6.0-dev.0.20220419223038-86c51ed26bb4
0.40.0

Open the chart page →

4,167
openclawopenclawVerified publisher1.91.31 of 2See more

openclaw openclaw 1.91.3

1 of the 2 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/helm-openclaw/openclaw:1.91.3ed44d81a65de
golang.org/x/mod@v0.39.0
0.40.0

Open the chart page →

2,977
connaisseurconnaisseurVerified publisher2.12.01 of 2See more

connaisseur connaisseur 2.12.0

1 of the 2 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
securesystemsengineering/connaisseur:v3.12.038918befbdad
golang.org/x/mod@v0.38.0
0.40.0

Open the chart page →

3,012
dependabot-gitlabdependabot-gitlabVerified publisher6.3.01 of 3See more

dependabot-gitlab dependabot-gitlab 6.3.0

1 of the 3 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
andrcuns/dependabot-gitlab:7.7.0-alpha.143060f159f4c
golang.org/x/mod@v0.38.0
0.40.0

Open the chart page →

4,556
devtron-operatordevtron0.23.31 of 11See more

devtron-operator devtron 0.23.3

1 of the 11 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
golang.org/x/mod@v0.30.0
0.40.0

Open the chart page →

32,902
ilumilumOfficialVerified publisher6.7.31 of 19See more

ilum ilum 6.7.3

1 of the 19 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
gitea/gitea:1.22.376f516a1a8c2
golang.org/x/mod@v0.20.0
0.40.0

Open the chart page →

23,228
temporallemontechVerified publisher0.37.01 of 13See more

temporal lemontech 0.37.0

1 of the 13 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
quay.io/prometheus/alertmanager:v0.23.09ab73a421b65
golang.org/x/mod@v0.4.2
0.40.0

Open the chart page →

14,893
nuclionuclio0.23.81 of 2See more

nuclio nuclio 0.23.8

1 of the 2 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
quay.io/nuclio/dashboard:1.17.8-amd64b5f5bd4efbee
golang.org/x/mod@v0.34.0
0.40.0

Open the chart page →

963
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
library/traefik:v2.11.00a5157f742d2
golang.org/x/mod@v0.14.0
0.40.0

Open the chart page →

17,245
k8s-infrasignoz0.17.11 of 1See more

k8s-infra signoz 0.17.1

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.139.0faf125d656fa
golang.org/x/mod@v0.29.0
0.40.0

Open the chart page →

1,039
convoyconvoyVerified publisher3.7.131 of 3See more

convoy convoy 3.7.13

1 of the 3 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
getconvoy/convoy:v26.7.6f4934cc05e31
golang.org/x/mod@v0.35.0
0.40.0

Open the chart page →

5,896
ketoory0.64.01 of 1See more

keto ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
oryd/keto:v26.2.0bfdb8b9e283a
golang.org/x/mod@v0.30.0
0.40.0

Open the chart page →

817
pmmpercona1.9.11 of 1See more

pmm percona 1.9.1

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
percona/pmm-server:3.9.1003f9c25f842
golang.org/x/mod@v0.37.0
0.40.0

Open the chart page →

790
rekorsigstoreVerified publisher1.8.51 of 9See more

rekor sigstore 1.8.5

1 of the 9 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
ghcr.io/sigstore/rekor/rekor-server:v1.5.4100d793d68d0
golang.org/x/mod@v0.38.0
0.40.0

Open the chart page →

5,415
swo-k8s-collectorsolarwindsOfficialVerified publisher5.3.01 of 3See more

swo-k8s-collector solarwinds 5.3.0

1 of the 3 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/opentelemetry-ebpf-instrumentation/ebpf-instrument:v0.9.026f82b148dfe
golang.org/x/mod@v0.35.0
0.40.0

Open the chart page →

2,335
truenas-csptruenas-cspVerified publisher1.2.41 of 11See more

truenas-csp truenas-csp 1.2.4

1 of the 11 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
quay.io/hpestorage/csi-driver:v3.2.0ef7f4e1544fa
golang.org/x/mod@v0.30.0
0.40.0

Open the chart page →

5,759
uffizzi-controlleruffizzi-controller2.4.61 of 11See more

uffizzi-controller uffizzi-controller 2.4.6

1 of the 11 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
uffizzi/controller:latest0344805f267b
golang.org/x/mod@v0.8.0
0.40.0

Open the chart page →

14,240
photoprismandrenarchyVerified publisher8.15.01 of 1See more

photoprism andrenarchy 8.15.0

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
photoprism/photoprism:260728958642220223
golang.org/x/mod@v0.38.0
0.40.0

Open the chart page →

8,825
fadicetic0.3.11 of 25See more

fadi cetic 0.3.1

1 of the 25 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
library/traefik:2.5.47d0228d19042
golang.org/x/mod@v0.4.2
0.40.0

Open the chart page →

52,919
daskhubdask2024.1.11 of 9See more

daskhub dask 2024.1.1

1 of the 9 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
library/traefik:2.10.61957e3314f43
golang.org/x/mod@v0.12.0
0.40.0

Open the chart page →

14,094
k8s-image-swapperestahnVerified publisher1.11.01 of 2See more

k8s-image-swapper estahn 1.11.0

1 of the 2 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
ghcr.io/estahn/k8s-image-swapper:1.5.102f5be9cde5f9
golang.org/x/mod@v0.14.0
0.40.0

Open the chart page →

1,981
kubeflowkubeflow1.6.21 of 45See more

kubeflow kubeflow 1.6.2

1 of the 45 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
kubeflow/training-operator:v1-e1434f6ff847e2b6af0
golang.org/x/mod@v0.6.0-dev.0.20220419223038-86c51ed26bb4
0.40.0

Open the chart page →

96,941
venti-stackkuossOfficialVerified publisher0.5.01 of 9See more

venti-stack kuoss 0.5.0

1 of the 9 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
quay.io/prometheus/alertmanager:v0.34.0690c7b525f43
golang.org/x/mod@v0.38.0
0.40.0

Open the chart page →

3,808
local-ailocalai3.4.21 of 1See more

local-ai localai 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
quay.io/go-skynet/local-ai:latestd78cd113b2bc
golang.org/x/mod@v0.36.0
0.40.0

Open the chart page →

3,997
policy-controllersigstoreVerified publisher0.10.71 of 2See more

policy-controller sigstore 0.10.7

1 of the 2 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
ghcr.io/sigstore/policy-controller/policy-controllerdigest-pinned0bcd60beb93f
golang.org/x/mod@v0.24.0
0.40.0

Open the chart page →

911
uffizzi-appuffizzi-app1.3.01 of 14See more

uffizzi-app uffizzi-app 1.3.0

1 of the 14 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
uffizzi/controller:latest0344805f267b
golang.org/x/mod@v0.8.0
0.40.0

Open the chart page →

19,337
athens-proxyvolker-raschekVerified publisher2.0.31 of 1See more

athens-proxy volker-raschek 2.0.3

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
gomods/athens:v0.17.10f61d1e62359
golang.org/x/mod@v0.35.0
0.40.0

Open the chart page →

2,039
athens-proxyathens-chartsOfficialVerified publisher0.17.11 of 1See more

athens-proxy athens-charts 0.17.1

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
gomods/athens:v0.18.197cc113b34b0
golang.org/x/mod@v0.35.0
0.40.0

Open the chart page →

1,298
sbom-operatorckotzbauerVerified publisher0.46.21 of 1See more

sbom-operator ckotzbauer 0.46.2

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
ghcr.io/ckotzbauer/sbom-operator:0.45.2dbdb3e524dea
golang.org/x/mod@v0.39.0
0.40.0

Open the chart page →

40
coder-observabilitycoder-observabilityVerified publisher0.7.32 of 21See more

coder-observability coder-observability 0.7.3

2 of the 21 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
grafana/grafana:10.4.19a9043254ba16
golang.org/x/mod@v0.24.0
0.40.0
quay.io/prometheus/alertmanager:v0.27.0e13b6ed5cb92
golang.org/x/mod@v0.14.0
0.40.0

Open the chart page →

24,700
cosmocosmo-platformOfficialVerified publisher0.20.01 of 10See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
golang.org/x/mod@v0.17.0
0.40.0

Open the chart page →

28,839
listmonkdeliveryheroVerified publisher0.1.121 of 1See more

listmonk deliveryhero 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
listmonk/listmonk:v2.1.0d2eac77ddfad
golang.org/x/mod@v0.5.1
0.40.0

Open the chart page →

2,537
gitlab-runnergitlab-jh0.92.11 of 1See more

gitlab-runner gitlab-jh 0.92.1

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v19.3.1af0325804248
golang.org/x/mod@v0.38.0
0.40.0

Open the chart page →

904
giteagroundhog2k0.16.31 of 1See more

gitea groundhog2k 0.16.3

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
gitea/gitea:1.27.387a67ee09d3a
golang.org/x/mod@v0.37.0
0.40.0

Open the chart page →

535
netbirdhelmforgeVerified publisher1.0.101 of 4See more

netbird helmforge 1.0.10

1 of the 4 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
netbirdio/netbird-server:0.78.13086534361a1
golang.org/x/mod@v0.39.0
0.40.0

Open the chart page →

2,962
inlets-operatorinlets0.17.201 of 1See more

inlets-operator inlets 0.17.20

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
ghcr.io/inlets/inlets-operator:0.17.2208265c006973
golang.org/x/mod@v0.34.0
0.40.0

Open the chart page →

497
coreinstill-aiOfficialVerified publisher0.1.752 of 15See more

core instill-ai 0.1.75

2 of the 15 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
instill/api-gateway:9bfdc88b53eaa51c523
golang.org/x/mod@v0.29.0
0.40.0
instill/artifact-backend:b28766ac4a393e601ed
golang.org/x/mod@v0.32.0
0.40.0

Open the chart page →

30,816
intel-gpu-resource-driverintelVerified publisher0.7.01 of 1See more

intel-gpu-resource-driver intel 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
intel/intel-gpu-resource-driver:v0.7.0e158711e32ce
golang.org/x/mod@v0.21.0
0.40.0

Open the chart page →

559
jenkins-operatorjenkins0.8.11 of 1See more

jenkins-operator jenkins 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
quay.io/jenkins-kubernetes-operator/operator:v0.8.171cb50263c3b
golang.org/x/mod@v0.4.2
0.40.0

Open the chart page →

2,211
kubearmorkubearmor1.7.41 of 4See more

kubearmor kubearmor 1.7.4

1 of the 4 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
kubearmor/kubearmor:stablea08141311045
golang.org/x/mod@v0.36.0
0.40.0

Open the chart page →

1,355
loftloftVerified publisher0.0.0-ci.141 of 1See more

loft loft 0.0.0-ci.14

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/loft:0.0.0-ci.14b69bcdaa8492
golang.org/x/mod@v0.12.0
0.40.0

Open the chart page →

3,675
vcluster-platformloftVerified publisher4.12.01 of 1See more

vcluster-platform loft 4.12.0

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-platform:4.12.0ef92da4621e6
golang.org/x/mod@v0.36.0
0.40.0

Open the chart page →

744
kubecostmesosphere-stable0.37.51 of 9See more

kubecost mesosphere-stable 0.37.5

1 of the 9 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
quay.io/prometheus/alertmanager:v0.27.0e13b6ed5cb92
golang.org/x/mod@v0.14.0
0.40.0

Open the chart page →

17,693
move2kubemove2kube0.3.151 of 1See more

move2kube move2kube 0.3.15

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
golang.org/x/mod@v0.12.0
0.40.0

Open the chart page →

3,793
psmdb-operatorpercona1.23.11 of 1See more

psmdb-operator percona 1.23.1

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
percona/percona-server-mongodb-operator:1.23.0feaff989e253
golang.org/x/mod@v0.36.0
0.40.0

Open the chart page →

246
persespersesOfficialVerified publisher0.23.21 of 1See more

perses perses 0.23.2

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
persesdev/perses:v0.54.0a0e34ddaf9d7
golang.org/x/mod@v0.38.0
0.40.0

Open the chart page →

133
plecopleco0.24.01 of 1See more

pleco pleco 0.24.0

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
public.ecr.aws/r3m4q3r9/pleco:0.24.0651739583336
golang.org/x/mod@v0.24.0
0.40.0

Open the chart page →

1,346
bentoself-hosters-by-nightVerified publisher0.9.11 of 1See more

bento self-hosters-by-night 0.9.1

1 of the 1 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
ghcr.io/warpstreamlabs/bento:1.8.121715979aefa
golang.org/x/mod@v0.22.0
0.40.0

Open the chart page →

1,046
sn-platformstreamnative1.11.441 of 9See more

sn-platform streamnative 1.11.44

1 of the 9 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
quay.io/prometheus/alertmanager:v0.25.0fd4d9a3dd1fd
golang.org/x/mod@v0.7.0
0.40.0

Open the chart page →

15,477
feedbacksystemthm-mni-iiVerified publisher0.47.11 of 10See more

feedbacksystem thm-mni-ii 0.47.1

1 of the 10 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
thmmniii/fbs-runner:v1.27.186105349c1a3
golang.org/x/mod@v0.11.0
0.40.0

Open the chart page →

28,534

Container images carrying it

422 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
golang.org/x/mod@v0.4.2
0.40.0
1
quay.io/jenkins-kubernetes-operator/operator:v0.8.171cb50263c3b
golang.org/x/mod@v0.4.2
0.40.0
1
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
golang.org/x/mod@v0.12.0
0.40.0
1
quay.io/kubescape/kubescape:v4.0.1358651dce3376
golang.org/x/mod@v0.38.0
0.40.0
1
quay.io/kubescape/node-agent:v0.3.2192044ed750f5e
golang.org/x/mod@v0.37.0
0.40.0
1
quay.io/kubescape/operator:v0.2.16901b2694425e9
golang.org/x/mod@v0.35.0
0.40.0
1
quay.io/minio/operator:v7.1.1cd587f60c43d
golang.org/x/mod@v0.24.0
0.40.0
1
quay.io/nuclio/dashboard:1.17.8-amd64b5f5bd4efbee
golang.org/x/mod@v0.34.0
0.40.0
1
quay.io/piraeusdatastore/nri-volume-qos:v0.1.3cbe3e1ea2b6a
golang.org/x/mod@v0.36.0
0.40.0
1
quay.io/prometheus/alertmanager:v0.24.0088464f949de
golang.org/x/mod@v0.5.1
0.40.0
1
quay.io/prometheus/alertmanager:v0.32.058e117eabcce
golang.org/x/mod@v0.34.0
0.40.0
1
quay.io/prometheus/alertmanager:v0.31.188b605de9aba
golang.org/x/mod@v0.32.0
0.40.0
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
golang.org/x/mod@v0.12.0
0.40.0
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
golang.org/x/mod@v0.4.2
0.40.0
1
quay.io/skopeo/stable:v1.134853591bd1d2
golang.org/x/mod@v0.10.0
0.40.0
1
quay.io/stackrox-io/stackrox-operator:4.11.3e12f4ca30515
golang.org/x/mod@v0.38.0
0.40.0
1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator:3.3.242dd426130a9
golang.org/x/mod@v0.39.0
0.40.0
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
golang.org/x/mod@v0.35.0
0.40.0
1
registry.gitlab.com/xrow-public/helm-openclaw/openclaw:1.91.3ed44d81a65de
golang.org/x/mod@v0.39.0
0.40.0
1
registry.gitlab.com/xrow-public/velero-client/velero-client:1.4.203015f863a3e
golang.org/x/mod@v0.36.0
0.40.0
1
registry.k8s.io/coredns/coredns:v1.13.294caebb89dcf
golang.org/x/mod@v0.29.0
0.40.0
1
registry.k8s.io/dns/k8s-dns-node-cache:1.26.78b9a78d101a1
golang.org/x/mod@v0.28.0
0.40.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.