StackRadar

CVE-2026-71556

High

Advisory

Published 7 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.1
base score, highest
EPSS
0.004
29th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
205
of 17,781 indexed, latest versions
Container images
207
deployed by those charts
Fix available
2 of 2
affected packages

go-git: Worktree operations may follow symlinks

Carried by container images the latest versions of 205 of 17,781 indexed charts deploy, on 207 images.

Affected packageAffected versionsFixed inImages
github.com/go-git/go-git/v5golangv5.0.0, v5.1.0, v5.2.0, v5.3.0+23 more5.19.2205
github.com/go-git/go-git/v6golangv6.0.0-alpha.3, v6.0.0-alpha.4.0.20260520124234-0860a7d8a1646.0.0-alpha.52
OSV records
GHSA-hc8v-wwc9-vgxm
Also known as
GO-2026-6213

Charts affected

205 by stars
ChartLatestAffected imagesRadar Score
codebase-operatorepmdedp-devVerified publisher2.12.0-MDTU-DDM-SNAPSHOT.101 of 1See more

codebase-operator epmdedp-dev 2.12.0-MDTU-DDM-SNAPSHOT.10

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
epamedp/codebase-operator:2.12.0-MDTU-DDM-SNAPSHOT.1096028c86f0dd
github.com/go-git/go-git/v5@v5.4.3-0.20210630082519-b4368b2a2ca4
5.19.2

Open the chart page →

2,825
gerrit-operatorepmdedp-devVerified publisher2.11.0-MDTU-DDM-SNAPSHOT.21 of 1See more

gerrit-operator epmdedp-dev 2.11.0-MDTU-DDM-SNAPSHOT.2

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
epamedp/gerrit-operator:2.11.0-MDTU-DDM-SNAPSHOT.2b71fb39e0c9e
github.com/go-git/go-git/v5@v5.4.2
5.19.2

Open the chart page →

2,811
syncoor-serverethereum-helm-chartsVerified publisher0.0.11 of 1See more

syncoor-server ethereum-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
ghcr.io/ethpandaops/syncoor:master233aa9808fc7
github.com/go-git/go-git/v5@v5.19.1
5.19.2

Open the chart page →

952
farm-observabilityfarm-observabilityOfficialVerified publisher0.27.22 of 18See more

farm-observability farm-observability 0.27.2

2 of the 18 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
grafana/alloy:v1.16.384b76d56c594
github.com/go-git/go-git/v5@v5.18.0
5.19.2
grafana/alloy:v1.12.2f94b1c82957a
github.com/go-git/go-git/v5@v5.16.2
5.19.2

Open the chart page →

13,255
activityrelayfedihost0.1.41 of 2See more

activityrelay fedihost 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.4.115b6701d8fb31
github.com/go-git/go-git/v5@v5.4.2
5.19.2

Open the chart page →

13,450
apm-hubflanksourceVerified publisher0.0.471 of 2See more

apm-hub flanksource 0.0.47

1 of the 2 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
flanksource/apm-hub:v0.0.471dacc3195bf9
github.com/go-git/go-git/v5@v5.6.1
5.19.2

Open the chart page →

6,078
batchrunnerflanksourceVerified publisher1.0.441 of 1See more

batchrunner flanksource 1.0.44

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
flanksource/batch-runner:v1.0.44689687a7cf95
github.com/go-git/go-git/v5@v5.16.2
5.19.2

Open the chart page →

5,292
owncloud-ocisgeek-cookbookVerified publisher2.4.21 of 1See more

owncloud-ocis geek-cookbook 2.4.2

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
owncloud/ocis:1.7.0d2efcae92c84
github.com/go-git/go-git/v5@v5.1.0
5.19.2

Open the chart page →

3,236
gitanagitana1.4.01 of 1See more

gitana gitana 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
ntakashi/gitana:1.4.04171ec641120
github.com/go-git/go-git/v5@v5.4.2
5.19.2

Open the chart page →

3,478
apid-helpergkarthiks0.1.41 of 1See more

apid-helper gkarthiks 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
quay.io/gkarthics/apid-helper:v0.2.3d7d93debf1f4
github.com/go-git/go-git/v5@v5.6.1
5.19.2

Open the chart page →

2,607
gnp-stackgnp-stack0.0.51 of 14See more

gnp-stack gnp-stack 0.0.5

1 of the 14 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
ghcr.io/openconfig/gnmic:0.45.0d422a9ebd4a2
github.com/go-git/go-git/v5@v5.16.5
5.19.2

Open the chart page →

7,659
harborgpg-dev1.18.31 of 8See more

harbor gpg-dev 1.18.3

1 of the 8 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.14.35c6f7162804c
github.com/go-git/go-git/v5@v5.16.5
5.19.2

Open the chart page →

3,376
grafana-samplinggrafana1.1.71 of 2See more

grafana-sampling grafana 1.1.7

1 of the 2 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
grafana/alloy:v1.11.38c7256f412fe
github.com/go-git/go-git/v5@v5.16.2
5.19.2

Open the chart page →

3,318
pyroscope-monitoringgrafana0.1.11 of 6See more

pyroscope-monitoring grafana 0.1.1

1 of the 6 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
grafana/otel-lgtm:0.11.1009d8c3ce4f3a
github.com/go-git/go-git/v5@v5.14.0
5.19.2

Open the chart page →

8,188
act-runnergringolitoVerified publisher0.2.01 of 1See more

act-runner gringolito 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
gitea/act_runner:0.2.11-dind-rootless6120b1165f3a
github.com/go-git/go-git/v5@v5.12.0
5.19.2

Open the chart page →

2,590
helmfile-gitops-agenthelmfile-gitops-agentVerified publisher1.1.961 of 3See more

helmfile-gitops-agent helmfile-gitops-agent 1.1.96

1 of the 3 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
fluxcd/flux-cli:v2.9.5704d55295355
github.com/go-git/go-git/v5@v5.19.1
5.19.2

Open the chart page →

2,594
giteahelmforgeVerified publisher1.1.201 of 1See more

gitea helmforge 1.1.20

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
gitea/gitea:1.27.3-rootless1c17ecaead42
github.com/go-git/go-git/v5@v5.19.1
5.19.2

Open the chart page →

535
opencloudhelmforgeVerified publisher1.0.01 of 1See more

opencloud helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
opencloudeu/opencloud:7.2.46d992ccc5f1c
github.com/go-git/go-git/v5@v5.19.1
5.19.2

Open the chart page →

663
harborhelm-harborVerified publisher2.3.51 of 8See more

harbor helm-harbor 2.3.5

1 of the 8 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
github.com/go-git/go-git/v5@v5.19.1
5.19.2

Open the chart page →

1,650
steampipehelm-steampipeVerified publisher2.4.11 of 1See more

steampipe helm-steampipe 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
ghcr.io/devops-ia/steampipe:v2.4.1a982103d91d3
github.com/go-git/go-git/v5@v5.17.1
5.19.2

Open the chart page →

3,124
svacerhelm-svacer0.6.01 of 1See more

svacer helm-svacer 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
ispras/svacer:11-2-042aa9fa9f189
github.com/go-git/go-git/v5@v5.14.0
5.19.2

Open the chart page →

6,015
gravity-initinvisiblVerified publisher1.0.91 of 1See more

gravity-init invisibl 1.0.9

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
invisibl/gravity-init:v1.0.91a970f84178b
github.com/go-git/go-git/v5@v5.4.2
5.19.2

Open the chart page →

2,006
opencloudjacobcolvinVerified publisher0.2.31 of 13See more

opencloud jacobcolvin 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
opencloudeu/opencloud-rolling:2.1.0f9634bb04905
github.com/go-git/go-git/v5@v5.13.2
5.19.2

Open the chart page →

45,239
jx-app-datadogjenkins-x0.0.101 of 2See more

jx-app-datadog jenkins-x 0.0.10

1 of the 2 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
datadog/agent:6aad9994de6a7
github.com/go-git/go-git/v5@v5.13.0
5.19.2

Open the chart page →

3,999
deploydefenderk8s-custom-controllerVerified publisher0.1.31 of 1See more

deploydefender k8s-custom-controller 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
ghcr.io/manzil-infinity180/deploydefender:ea3ab0bb646cdbeddd1aca483ecf650f9ac0d0847fbc6855c8b3
github.com/go-git/go-git/v5@v5.12.0
5.19.2

Open the chart page →

1,893
giteak8s-home-lab-repo2.6.01 of 1See more

gitea k8s-home-lab-repo 2.6.0

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
gitea/gitea:1.26.27d13848af126
github.com/go-git/go-git/v5@v5.19.0
5.19.2

Open the chart page →

2,139
k10restorekastenVerified publisher8.0.141 of 1See more

k10restore kasten 8.0.14

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
gcr.io/kasten-images/restorectl:8.0.145a0884f9a90c
github.com/go-git/go-git/v5@v5.16.2
5.19.2

Open the chart page →

1,459
kcmkcm1.11.02 of 12See more

kcm kcm 1.11.0

2 of the 12 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
ghcr.io/fluxcd/flux-cli:v2.9.1020edbaee890
github.com/go-git/go-git/v5@v5.19.1
5.19.2
ghcr.io/fluxcd/source-controller:v1.9.22b8d06650a1b
github.com/go-git/go-git/v5@v5.19.1
5.19.2

Open the chart page →

2,818
kiaekiae0.1.61 of 9See more

kiae kiae 0.1.6

1 of the 9 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.35.313964b29d63e
github.com/go-git/go-git/v5@v5.4.2
5.19.2

Open the chart page →

19,168
ksoc-pluginsksocOfficialVerified publisher1.9.101 of 5See more

ksoc-plugins ksoc 1.9.10

1 of the 5 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
public.ecr.aws/n8h5y2v5/rad-security/rad-sbom:v1.1.34e97e0e7a2088
github.com/go-git/go-git/v5@v5.13.0
5.19.2

Open the chart page →

3,199
u4a-componentkubebb0.2.101 of 8See more

u4a-component kubebb 0.2.10

1 of the 8 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
kubebb/oidc-server:v0.2.02b5894ef1e2f
github.com/go-git/go-git/v5@v5.4.2
5.19.2

Open the chart page →

13,819
argo-workflowskubeblocksVerified publisher0.40.141 of 2See more

argo-workflows kubeblocks 0.40.14

1 of the 2 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
quay.io/argoproj/argocli:v3.5.591b9825f09a8
github.com/go-git/go-git/v5@v5.11.0
5.19.2

Open the chart page →

2,871
casdoor-helm-chartskubeblocksVerified publisher1.753.01 of 1See more

casdoor-helm-charts kubeblocks 1.753.0

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
casbin/casdoor:v1.753.0770ad9ec3190
github.com/go-git/go-git/v5@v5.11.0
5.19.2

Open the chart page →

2,299
grafanakubeblocksVerified publisher6.59.41 of 1See more

grafana kubeblocks 6.59.4

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
grafana/grafana:10.1.11b9ca4bbc4a2
github.com/go-git/go-git/v5@v5.4.2
5.19.2

Open the chart page →

3,561
kubeclaritykubeclarity2.23.31 of 5See more

kubeclarity kubeclarity 2.23.3

1 of the 5 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
ghcr.io/openclarity/grype-server:v0.6.079412399f301
github.com/go-git/go-git/v5@v5.8.1
5.19.2

Open the chart page →

5,496
harborkubesphereVerified publisher1.9.31 of 11See more

harbor kubesphere 1.9.3

1 of the 11 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
github.com/go-git/go-git/v5@v5.4.2
5.19.2

Open the chart page →

17,798
deepflowkubesphere-stable6.2.6061 of 8See more

deepflow kubesphere-stable 6.2.606

1 of the 8 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
grafana/grafana:9.5.239c849cebccc
github.com/go-git/go-git/v5@v5.4.2
5.19.2

Open the chart page →

18,316
kubiya-runnerkubiya-helm-chartsOfficialVerified publisher0.9.41 of 9See more

kubiya-runner kubiya-helm-charts 0.9.4

1 of the 9 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
grafana/alloy:v1.5.101a63f4e032c
github.com/go-git/go-git/v5@v5.11.0
5.19.2

Open the chart page →

20,204
kusionkusionstackVerified publisher0.14.11 of 3See more

kusion kusionstack 0.14.1

1 of the 3 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
kusionstack/kusion:v0.14.0126c8f0b0976
github.com/go-git/go-git/v5@v5.12.0
5.19.2

Open the chart page →

6,824
trivy-serverlemontechVerified publisher0.1.01 of 1See more

trivy-server lemontech 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
aquasec/trivy:0.32.0973d0df16189
github.com/go-git/go-git/v5@v5.4.2
5.19.2

Open the chart page →

4,271
m9sweeperm9sweeperVerified publisher1.6.01 of 6See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
ghcr.io/m9sweeper/trawler:1.6.0df917c5a7e54
github.com/go-git/go-git/v5@v5.11.0
5.19.2

Open the chart page →

9,774
mayastormayastorVerified publisher2.12.11 of 31See more

mayastor mayastor 2.12.1

1 of the 31 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
grafana/alloy:v1.8.17790f6f7fbd8
github.com/go-git/go-git/v5@v5.13.0
5.19.2

Open the chart page →

21,064
kubeaddons-catalogmesosphere0.1.161 of 2See more

kubeaddons-catalog mesosphere 0.1.16

1 of the 2 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
mesosphere/kubeaddons-catalog:v0.11.4073db43d0b8b
github.com/go-git/go-git/v5@v5.1.0
5.19.2

Open the chart page →

12,010
dexmesosphere-stable2.14.11 of 5See more

dex mesosphere-stable 2.14.1

1 of the 5 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
mesosphere/dex:v2.37.0-d2iq.1b093d78a21ed
github.com/go-git/go-git/v5@v5.4.2
5.19.2

Open the chart page →

19,214
kommandermesosphere-stable0.39.22 of 29See more

kommander mesosphere-stable 0.39.2

2 of the 29 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
mesosphere/kommander-federation-utility-apiserver:v0.21.2f9b769c65e24
github.com/go-git/go-git/v5@v5.2.0
5.19.2
mesosphere/kubeaddons-catalog:v0.11.4073db43d0b8b
github.com/go-git/go-git/v5@v5.1.0
5.19.2

Open the chart page →

68,284
kube-prometheus-stackmesosphere-stable75.9.11 of 7See more

kube-prometheus-stack mesosphere-stable 75.9.1

1 of the 7 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
grafana/grafana:12.0.2b5b59bfc7561
github.com/go-git/go-git/v5@v5.14.0
5.19.2

Open the chart page →

10,180
argocd-extra-app-info-exportermikejohVerified publisher0.1.121 of 1See more

argocd-extra-app-info-exporter mikejoh 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
mikejoh/argocd-extra-app-info-exporter:0.2.05c5a3b734271
github.com/go-git/go-git/v5@v5.12.0
5.19.2

Open the chart page →

1,334
filestashmt1905024.0.01 of 1See more

filestash mt190502 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
machines/filestash:latest0b8fc005e52e
github.com/go-git/go-git/v6@v6.0.0-alpha.3
6.0.0-alpha.5

Open the chart page →

3,499
giteamyaVerified publisher23.12.51 of 1See more

gitea mya 23.12.5

1 of the 1 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
gitea/gitea:1.21.6ac73e0da341f
github.com/go-git/go-git/v5@v5.11.0
5.19.2

Open the chart page →

3,430
agent-control-cdnewrelic1.0.02 of 3See more

agent-control-cd newrelic 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-71556.

Container imageDigestPackageFixed in
ghcr.io/fluxcd/flux-cli:v2.5.1274a179fd402
github.com/go-git/go-git/v5@v5.13.2
5.19.2
ghcr.io/fluxcd/source-controller:v1.5.000cd9316a379
github.com/go-git/go-git/v5@v5.13.2
5.19.2

Open the chart page →

5,034

Container images carrying it

207 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/kubermatic/kubermatic:v2.24.5ebba936046ab
github.com/go-git/go-git/v5@v5.11.0
5.19.2
1
quay.io/openshift/origin-jenkins-agent-base:latestc241c971aef8
github.com/go-git/go-git/v5@v5.11.0
5.19.2
1
quay.io/operator-framework/catalogd:v1.8.06ff40fa6257f
github.com/go-git/go-git/v5@v5.16.5
5.19.2
1
quay.io/operator-framework/operator-controller:v1.8.0bca5dfcc67ca
github.com/go-git/go-git/v5@v5.16.5
5.19.2
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
github.com/go-git/go-git/v5@v5.3.0
5.19.2
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao:v2.5.5-gitlab25b7636dfba3f
github.com/go-git/go-git/v5@v5.19.1
5.19.2
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
github.com/go-git/go-git/v5@v5.19.1
5.19.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.