StackRadar

CVE-2026-56865

High

Advisory

Published 13 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.4
base score, highest
EPSS
0.001
1st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
453
of 17,781 indexed, latest versions
Container images
422
deployed by those charts
Fix available
1 of 2
affected packages

Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

Carried by container images the latest versions of 453 of 17,781 indexed charts deploy, on 422 images.

Affected packageAffected versionsFixed inImages
golang-1.19deb1.19.8-2no fix listed1
golang.org/x/modgolangv0.1.0, v0.2.0, v0.3.0, v0.4.2+38 more0.40.0421
OSV records
DEBIAN-CVE-2026-56865GO-2026-6179
Also known as
BIT-golang-2026-56865

Charts affected

453 by stars
ChartLatestAffected imagesRadar Score
rancherwenerme2.15.12 of 2See more

rancher wenerme 2.15.1

2 of the 2 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
rancher/rancher:v2.15.15f6c4dc52a05
golang.org/x/mod@v0.36.0
0.40.0
rancher/shell:v0.8.1f293af9c635f
golang.org/x/mod@v0.37.0
0.40.0

Open the chart page →

1,456
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
prom/alertmanager:v0.28.0d5155cfac40a
golang.org/x/mod@v0.22.0
0.40.0

Open the chart page →

9,381
prometheus-monitoring-stackyotron-helm-charts1.2.01 of 3See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

1 of the 3 container images this version deploys carry CVE-2026-56865.

Container imageDigestPackageFixed in
quay.io/prometheus/alertmanager:latest690c7b525f43
golang.org/x/mod@v0.38.0
0.40.0

Open the chart page →

878

Container images carrying it

422 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/prometheus/alertmanager:latest:v0.34.0690c7b525f43
golang.org/x/mod@v0.38.0
0.40.0
8
quay.io/prometheus/alertmanager:v0.27.0e13b6ed5cb92
golang.org/x/mod@v0.14.0
0.40.0
8
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
golang.org/x/mod@v0.35.0
0.40.0
7
quay.io/prometheus/alertmanager:v0.23.09ab73a421b65
golang.org/x/mod@v0.4.2
0.40.0
5
rancher/rancher:v2.15.15f6c4dc52a05
golang.org/x/mod@v0.36.0
0.40.0
4
rancher/shell:v0.8.1f293af9c635f
golang.org/x/mod@v0.37.0
0.40.0
4
rss3/op-geth:rss3-main-1ecad3026148aa1bc52
golang.org/x/mod@v0.14.0
0.40.0
4
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
golang.org/x/mod@v0.10.0
0.40.0
4
quay.io/prometheus/alertmanager:v0.25.0fd4d9a3dd1fd
golang.org/x/mod@v0.7.0
0.40.0
4
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
golang.org/x/mod@v0.36.0
0.40.0
3
grafana/grafana:11.0.00dc5a246ab16
golang.org/x/mod@v0.14.0
0.40.0
3
grafana/grafana:11.3.0a0f881232a6f
golang.org/x/mod@v0.20.0
0.40.0
3
neosmemo/memos:0.30.071a5b4738d1b
golang.org/x/mod@v0.35.0
0.40.0
3
oryd/hydra:v2.2.02c93beb5e5f2
golang.org/x/mod@v0.14.0
0.40.0
3
prom/alertmanager:v0.28.0d5155cfac40a
golang.org/x/mod@v0.22.0
0.40.0
3
rss3/op-node:d2c5ced00901227473fc196fda838191f0cb4e02d1d2ae6efd05
golang.org/x/mod@v0.13.0
0.40.0
3
tykio/tyk-dashboard:v5.13.10e03b94c153d
golang.org/x/mod@v0.36.0
0.40.0
3
tykio/tyk-gateway-ee:v5.13.13e907e675bf9
golang.org/x/mod@v0.36.0
0.40.0
3
ghcr.io/coder/coder:v2.37.10c6994bb4c5a
golang.org/x/mod@v0.35.0
0.40.0
3
ghcr.io/dexidp/dex:v2.45.18499afd690c4
golang.org/x/mod@v0.32.0
0.40.0
3
ghcr.io/spiffe/spire-agent:1.15.341b0dcd8b258
golang.org/x/mod@v0.38.0
0.40.0
3
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
golang.org/x/mod@v0.30.0
0.40.0
3
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
golang.org/x/mod@v0.30.0
0.40.0
3
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
golang.org/x/mod@v0.13.0
0.40.0
3
quay.io/prometheus/alertmanager:v0.26.0361db356b330
golang.org/x/mod@v0.9.0
0.40.0
3
registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v19.3.1af0325804248
golang.org/x/mod@v0.38.0
0.40.0
3
coredns/coredns:1.13.19b9128672209
golang.org/x/mod@v0.27.0
0.40.0
2
devopsfaith/krakend:latestf8bdaa8a1a43
golang.org/x/mod@v0.19.0
0.40.0
2
grafana/alloy:v1.8.17790f6f7fbd8
golang.org/x/mod@v0.24.0
0.40.0
2
grafana/alloy:v1.12.2f94b1c82957a
golang.org/x/mod@v0.29.0
0.40.0
2
grafana/grafana:11.1.0079600c9517b
golang.org/x/mod@v0.18.0
0.40.0
2
grafana/grafana:11.1.4886b56d5534e
golang.org/x/mod@v0.18.0
0.40.0
2
grafana/grafana:11.4.0d8ea37798ccc
golang.org/x/mod@v0.20.0
0.40.0
2
k0sproject/k0s:v1.26.0-k0s.0f04635825d51
golang.org/x/mod@v0.7.0
0.40.0
2
library/docker:dind5efed980cba3
golang.org/x/mod@v0.36.0
0.40.0
2
library/traefik:v3.7.16b9cbca6fac4
golang.org/x/mod@v0.35.0
0.40.0
2
library/traefik:v2.57d5a6ae66572
golang.org/x/mod@v0.4.2
0.40.0
2
listmonk/listmonk:v2.1.0d2eac77ddfad
golang.org/x/mod@v0.5.1
0.40.0
2
listmonk/listmonk:latest:v6.2.0f535d59e1499
golang.org/x/mod@v0.33.0
0.40.0
2
longhornio/longhorn-manager:v1.12.183b79f57043f
golang.org/x/mod@v0.37.0
0.40.0
2
mattermost/mattermost-team-edition:10.11.2b8bd1246cb3a
golang.org/x/mod@v0.24.0
0.40.0
2
moby/buildkit:v0.32.2-rootless504731e577c2
golang.org/x/mod@v0.38.0
0.40.0
2
oryd/kratos:v1.3.1fe2428f103a6
golang.org/x/mod@v0.19.0
0.40.0
2
otel/opentelemetry-collector-contrib:0.156.0125bdbeb7590
golang.org/x/mod@v0.37.0
0.40.0
2
rss3/op-batcher:a77d1f52fc3492bf21915bdff8ee8e0b5bd2cb8adae8a5bdd7a6
golang.org/x/mod@v0.13.0
0.40.0
2
rss3/op-proposer:a77d1f52fc3492bf21915bdff8ee8e0b5bd2cb8aa4059dd32c48
golang.org/x/mod@v0.13.0
0.40.0
2
tkpd/gripmock:1.10.174441dadcfbd
golang.org/x/mod@v0.4.2
0.40.0
2
uffizzi/controller:latest0344805f267b
golang.org/x/mod@v0.8.0
0.40.0
2
uselagoon/docker-host:v3.6.12c89ed939b8b
golang.org/x/mod@v0.24.0
0.40.0
2
ghcr.io/fluxcd/source-controller:v1.9.22b8d06650a1b
golang.org/x/mod@v0.36.0
0.40.0
2

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.