CVE-2026-78660

High

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.003; 21st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,530; of 18,090 indexed, latest versions
Container images: 6,374; deployed by those charts
Fix available: 5 of 9; affected packages

HTTP/2 transport accepts malformed framing-related headers in net/http

Carried by container images the latest versions of 5,530 of 18,090 indexed charts deploy, on 6,374 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+212 more	1.26.9, 1.27.2	6,355
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more	0.60.0	5,126
golang-1.19deb	1.19.8-2	no fix listed	1
helm-4apk	4.3.0-r0	4.3.0-r2	1
ingress-nginx-controller-1.15apk	1.15.10-r3	no fix listed	1
kineapk	0.17.1-r1	no fix listed	1
kubernetes-1.37apk	1.37.1-r0	1.37.1-r2	1
runcapk	1.5.2-r0	no fix listed	1
tetragonapk	1.7.1-r4	1.7.1-r6	1

OSV records: DEBIAN-CVE-2026-78660 GO-2026-6610 CGA-4487-7phw-q6ph CGA-4c7c-vv7v-68rj CGA-8m3g-7799-mp4m CGA-8vqq-r2ff-395m CGA-f7qm-qm58-qq95 CGA-gwrf-q2qw-xxw8
Also known as: CGA-35vx-wppw-x7qp, CGA-3h29-84h2-fpvm, CGA-549w-3rfh-p826, CGA-5m57-vjc9-f9p9, CGA-674h-jc7r-4mj3, CGA-69vp-383p-x5ch, CGA-75m2-prw5-hwgv, CGA-77wf-8wxg-xgm9, CGA-8p8v-px44-9x8q, CGA-ch87-vjh7-q5c4, CGA-f6rm-vx2j-c4p8, CGA-g5qq-3wrm-946q, CGA-hhf5-4h2f-jxg6, CGA-hmfx-cqg4-6jpq, CGA-hw83-h7jc-7pmj, CGA-pxv9-259f-f7j4, CGA-q8wf-wv9q-7fmv, CGA-qfx8-xwj3-frq2, CGA-qp96-gpwf-9v2h, CGA-qrx4-5cp4-7xhr, CGA-rpwc-c4h5-9frv, CGA-rr68-65r8-g5vv, CGA-v6p6-9m54-x5pc, CGA-x66q-68px-v2f4, CGA-x9jv-g6mg-h4jq, CGA-xjhf-9jv7-7x78
Trending: Rank 9 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,530 by stars

Chart

Latest

Affected images

Radar Score

wordpresshelmforge

3.0.9

1 of 3 See more

wordpress helmforge 3.0.9

1 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/mysql :26.7.0	9d48c42f8341	stdlib@go1.24.6	1.26.9

Open the chart page →

4,484

korkor

0.2.16

1 of 1 See more

kor kor 0.2.16

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
yonahdissen/kor :latest	1a85158c82bb	golang.org/x/net@v0.57.0 stdlib@go1.26.0	0.60.0 1.26.9

Open the chart page →

512

kubelet-csr-approverkubelet-csr-approver

1.2.15

1 of 1 See more

kubelet-csr-approver kubelet-csr-approver 1.2.15

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/postfinance/kubelet-csr-approver :v1.2.15	6469ef517d2b	golang.org/x/net@v0.49.0 stdlib@go1.26.7	0.60.0 1.26.9

Open the chart page →

232

logging-operatorkube-logging

4.2.3

1 of 1 See more

logging-operator kube-logging 4.2.3

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/kube-logging/logging-operator :4.2.2	0dd85dcb1f73	golang.org/x/net@v0.10.0 stdlib@go1.20.5	0.60.0 1.26.9

Open the chart page →

1,496

myipkuoss

0.2.2

1 of 1 See more

myip kuoss 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/kuoss/myip :v0.1.7	760f5ccae493	golang.org/x/net@v0.38.0 stdlib@go1.23.8	0.60.0 1.26.9

Open the chart page →

1,088

keptnlifecycle-toolkit

0.11.0

3 of 3 See more

keptn lifecycle-toolkit 0.11.0

3 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/keptn/certificate-operator :v3.0.0	b82064b0e339	golang.org/x/net@v0.30.0 stdlib@go1.23.3	0.60.0 1.26.9
ghcr.io/keptn/lifecycle-operator :v2.0.0	866ced256a8c	golang.org/x/net@v0.30.0 stdlib@go1.23.3	0.60.0 1.26.9
ghcr.io/keptn/metrics-operator :v2.1.0	dc48471c7cf8	golang.org/x/net@v0.37.0 stdlib@go1.23.3	0.60.0 1.26.9

Open the chart page →

3,327

lightrun-helm-chartlightrun-helm-chart

3.53.0

1 of 9 See more

lightrun-helm-chart lightrun-helm-chart 3.53.0

1 of the 9 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/mysql :8.4.10	8dbcf531a03a	stdlib@go1.24.6	1.26.9

Open the chart page →

828

mattermost-operatormattermost

1.0.5

1 of 1 See more

mattermost-operator mattermost 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
mattermost/mattermost-operator :v1.25.4	bac00a2bbd33	golang.org/x/net@v0.41.0 stdlib@go1.24.13	0.60.0 1.26.9

Open the chart page →

590

meshery-operatormeshery

1.0.70

2 of 2 See more

meshery-operator meshery 1.0.70

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
alpine/k8s :1.35.6	b7a12c5ddf26	golang.org/x/net@v0.54.0 stdlib@go1.26.3	0.60.0 1.26.9
meshery/meshery-operator :1.0.5	0d245bc8b5c6	golang.org/x/net@v0.57.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

3,403

missing-container-metricsmissing-container-metrics

0.1.1

1 of 1 See more

missing-container-metrics missing-container-metrics 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
dmilhdef/missing-container-metrics :v0.21.0	fada1a6e7638	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110 stdlib@go1.16.2	0.60.0 1.26.9

Open the chart page →

3,568

tailscale-relaymvisonneau

0.2.7

1 of 1 See more

tailscale-relay mvisonneau 0.2.7

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
mvisonneau/tailscale :v1.68.1	fc45ad8abf10	golang.org/x/net@v0.24.0 stdlib@go1.22.4	0.60.0 1.26.9

Open the chart page →

1,855

nginx-ingressnginx-ingress-chart

0.0.0-edge

1 of 1 See more

nginx-ingress nginx-ingress-chart 0.0.0-edge

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
nginx/nginx-ingress :edge	d127d1013198	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

1,566

system-upgrade-controllernimbolus

0.7.0

1 of 1 See more

system-upgrade-controller nimbolus 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
rancher/system-upgrade-controller :v0.18.0	9813f85653c8	golang.org/x/net@v0.44.0 stdlib@go1.25.3	0.60.0 1.26.9

Open the chart page →

673

olmolm

0.46.0

1 of 1 See more

olm olm 0.46.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/operator-framework/olm :v0.46.0	4404599eb7b7	golang.org/x/net@v0.57.0 stdlib@go1.26.3	0.60.0 1.26.9

Open the chart page →

462

opencostopencost-oci

2.5.32

1 of 2 See more

opencost opencost-oci 2.5.32

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/opencost/opencost :1.121.3	4cdd173253e5	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

401

ketoory

0.64.0

1 of 1 See more

keto ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
oryd/keto :v26.2.0	bfdb8b9e283a	golang.org/x/net@v0.48.0 stdlib@go1.26.0	0.60.0 1.26.9

Open the chart page →

1,391

oathkeeperory

0.64.0

1 of 1 See more

oathkeeper ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
oryd/oathkeeper :v26.2.0	467329abde34	golang.org/x/net@v0.48.0 stdlib@go1.26.0	0.60.0 1.26.9

Open the chart page →

1,336

passboltpassbolt

2.2.0

3 of 6 See more

passbolt passbolt 2.2.0

3 of the 6 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
bitnamilegacy/mariadb :12.0.2-debian-12-r0	888cdaae3cb9	stdlib@go1.25.0	1.26.9
bitnamilegacy/redis :8.2.1-debian-12-r0	25bf63f3caf7	stdlib@go1.25.0	1.26.9
library/mariadb :latest	d4fdec0510ad	stdlib@go1.26.7	1.26.9

Open the chart page →

14,129

redis-enterprise-operatorredis-enterprise-operator-official

8.0.18-11

1 of 1 See more

redis-enterprise-operator redis-enterprise-operator-official 8.0.18-11

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
redislabs/operator :8.0.18-11	9078e713bb6a	golang.org/x/net@v0.51.0 stdlib@go1.26.1	0.60.0 1.26.9

Open the chart page →

1,326

backstagerhdh-chart

4.0.1

1 of 2 See more

backstage rhdh-chart 4.0.1

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/rhdh/rhdh-hub-rhel9 :latest	4f8c0f8a8ee0	golang.org/x/net@v0.48.0 stdlib@go1.26.7	0.60.0 1.26.9

Open the chart page →

1,987

selenium-gridselenium-grid

0.59.1

3 of 4 See more

selenium-grid selenium-grid 0.59.1

3 of the 4 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
selenium/hub :4.48.0-20260905	d47c27474cb4	stdlib@go1.27.1	1.27.2
selenium/node-chrome :4.48.0-20260905	5ac71fd8dd1e	golang.org/x/net@v0.57.0 stdlib@go1.27.1	0.60.0 1.27.2
selenium/node-firefox :4.48.0-20260905	74a5c1c90f95	golang.org/x/net@v0.57.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

9,270

rekorsigstore

1.8.7

7 of 9 See more

rekor sigstore 1.8.7

7 of the 9 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/redisdigest-pinned	148bb5411c18	stdlib@go1.18.2	1.26.9
gcr.io/trillian-opensource-ci/db_serverdigest-pinned	2a685a38dd01	stdlib@go1.18.2	1.26.9
ghcr.io/sigstore/rekor/rekor-server :v1.5.4	100d793d68d0	golang.org/x/net@v0.57.0 stdlib@go1.26.4	0.60.0 1.26.9
ghcr.io/sigstore/scaffolding/createdbdigest-pinned	16673c1099a5	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9
ghcr.io/sigstore/scaffolding/createtreedigest-pinned	4c845ced03d8	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9
ghcr.io/sigstore/scaffolding/trillian_log_serverdigest-pinned	32ee491f4d00	golang.org/x/net@v0.59.0 stdlib@go1.27.0	0.60.0 1.27.2
ghcr.io/sigstore/scaffolding/trillian_log_signerdigest-pinned	3d0152303816	golang.org/x/net@v0.59.0 stdlib@go1.27.0	0.60.0 1.27.2

Open the chart page →

7,889

mssqlserver-2022simcube

1.2.3

1 of 1 See more

mssqlserver-2022 simcube 1.2.3

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
mcr.microsoft.com/mssql/server :2022-latest	4402d880dd4c	stdlib@go1.26.1	1.26.9

Open the chart page →

3,301

snyk-monitorsnyk

2.23.26

1 of 2 See more

snyk-monitor snyk 2.23.26

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
snyk/kubernetes-monitor :2.23.26	fb5ad76ce84e	golang.org/x/net@v0.54.0 stdlib@go1.25.14	0.60.0 1.26.9

Open the chart page →

1,061

swo-k8s-collectorsolarwinds

5.3.0

3 of 3 See more

swo-k8s-collector solarwinds 5.3.0

3 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
solarwinds/solarwinds-otel-collector :0.152.3-k8s	3c1110e8bdfb	golang.org/x/net@v0.55.0 stdlib@go1.26.4-X:boringcrypto	0.60.0 1.26.9
ghcr.io/open-telemetry/opentelemetry-ebpf-instrumentation/ebpf-instrument :v0.9.0	26f82b148dfe	golang.org/x/net@v0.53.0 stdlib@go1.25.9	0.60.0 1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.19.0	6b2f0b6f2f86	golang.org/x/net@v0.51.0 stdlib@go1.26.2	0.60.0 1.26.9

Open the chart page →

3,462

sops-operatorsops-operator

0.10.1

2 of 2 See more

sops-operator sops-operator 0.10.1

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
clastix/kubectl :v1.31	22918a06c253	golang.org/x/net@v0.26.0 stdlib@go1.22.5	0.60.0 1.26.9
ghcr.io/peak-scale/sops-operator :0.10.1	1da9b716b792	golang.org/x/net@v0.57.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

1,943

thehivestrangebee-helm

1.1.0

2 of 7 See more

thehive strangebee-helm 1.1.0

2 of the 7 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
bitnamilegacy/elasticsearch :9.1.2-debian-12-r0	00176a47afa0	golang.org/x/net@v0.42.0 stdlib@go1.24.6	0.60.0 1.26.9
bitnamilegacy/os-shell :12-debian-12-r51	77e65e9d633e	golang.org/x/net@v0.42.0 stdlib@go1.25.0	0.60.0 1.26.9

Open the chart page →

16,869

truenas-csptruenas-csp

1.2.4

10 of 11 See more

truenas-csp truenas-csp 1.2.4

10 of the 11 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/hpestorage/csi-driver :v3.2.0	ef7f4e1544fa	golang.org/x/net@v0.48.0 stdlib@go1.25.10	0.60.0 1.26.9
quay.io/hpestorage/csi-extensions :v1.2.11	89146672a7ac	golang.org/x/net@v0.48.0 stdlib@go1.26.3	0.60.0 1.26.9
quay.io/hpestorage/volume-group-provisioner :v1.0.10	7bf9d8f16a5d	golang.org/x/net@v0.48.0 stdlib@go1.26.3	0.60.0 1.26.9
quay.io/hpestorage/volume-group-snapshotter :v1.0.10	caeaaffe7e2b	golang.org/x/net@v0.48.0 stdlib@go1.26.3	0.60.0 1.26.9
quay.io/hpestorage/volume-mutator :v1.3.10	9e98b2e697bd	golang.org/x/net@v0.48.0 stdlib@go1.26.3	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-attacher :v4.12.0	b9dc9a714a48	golang.org/x/net@v0.54.0 stdlib@go1.26.3	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.17.0	f9de845b1701	golang.org/x/net@v0.54.0 stdlib@go1.26.3	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-provisioner :v6.2.0	6be9f63ca4ca	golang.org/x/net@v0.51.0 stdlib@go1.25.7	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-resizer :v2.1.0	589e525cddef	golang.org/x/net@v0.48.0 stdlib@go1.25.7	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-snapshotter :v8.5.0	da081c27e8a6	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.60.0 1.26.9

Open the chart page →

9,075

uffizzi-controlleruffizzi-controller

2.4.6

8 of 11 See more

uffizzi-controller uffizzi-controller 2.4.6

8 of the 11 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
uffizzi/controller :latest	0344805f267b	golang.org/x/net@v0.12.0 stdlib@go1.20.14	0.60.0 1.26.9
uffizzi/uffizzi-cluster-operator :v1.6.5	5ca448a08783	golang.org/x/net@v0.8.0 stdlib@go1.19.13	0.60.0 1.26.9
quay.io/jetstack/cert-manager-cainjector :v1.14.5	4ffda7facb4d	golang.org/x/net@v0.24.0 stdlib@go1.21.9	0.60.0 1.26.9
quay.io/jetstack/cert-manager-controller :v1.14.5	9c0527cab629	golang.org/x/net@v0.24.0 stdlib@go1.21.9	0.60.0 1.26.9
quay.io/jetstack/cert-manager-startupapicheck :v1.14.5	0f5b104bdd1b	golang.org/x/net@v0.24.0 stdlib@go1.21.9	0.60.0 1.26.9
quay.io/jetstack/cert-manager-webhook :v1.14.5	ef419261a209	golang.org/x/net@v0.24.0 stdlib@go1.21.9	0.60.0 1.26.9
registry.k8s.io/ingress-nginx/controller :v1.10.1	e24f39d3eed6	golang.org/x/net@v0.22.0 stdlib@go1.22.2	0.60.0 1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.4.1	36d05b4077fb	golang.org/x/net@v0.22.0 stdlib@go1.22.2	0.60.0 1.26.9

Open the chart page →

19,132

filebrowserutkuozdemir

1.0.0

1 of 1 See more

filebrowser utkuozdemir 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
filebrowser/filebrowser :v2.23.0	86e8449ff8ff	golang.org/x/net@v0.0.0-20220412020605-290c469a71a5 stdlib@go1.18.3	0.60.0 1.26.9

Open the chart page →

4,046

vault-operatorvault-operator

1.24.1

1 of 1 See more

vault-operator vault-operator 1.24.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/bank-vaults/vault-operator :v1.24.1	b5529976f0f6	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

178

vsphere-csivsphere-tmm

3.8.1

7 of 7 See more

vsphere-csi vsphere-tmm 3.8.1

7 of the 7 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
registry.k8s.io/csi-vsphere/driver :v3.5.0	4bb8350a5a62	golang.org/x/net@v0.38.0 stdlib@go1.24.4	0.60.0 1.26.9
registry.k8s.io/csi-vsphere/syncer :v3.5.0	bb88468fff2a	golang.org/x/net@v0.38.0 stdlib@go1.24.4	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-attacher :v4.8.1	69888dba5815	golang.org/x/net@v0.34.0 stdlib@go1.23.1	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.13.0	d7138bcc3aa5	golang.org/x/net@v0.32.0 stdlib@go1.23.1	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-provisioner :v4.0.1	bf5a235b67d8	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-resizer :v1.14.0	5e7cbb63fd49	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.60.0 1.26.9
registry.k8s.io/sig-storage/livenessprobe :v2.15.0	2c5f9dc4ea5a	golang.org/x/net@v0.32.0 stdlib@go1.23.1	0.60.0 1.26.9

Open the chart page →

7,123

wazuhwazuh-helm

0.0.8

1 of 4 See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
wazuh/wazuh-manager :4.11.1	1da5c38c6a78	golang.org/x/net@v0.0.0-20200202094626-16171245cfb2 stdlib@go1.14.12	0.60.0 1.26.9

Open the chart page →

8,020

aad-pod-identityaad-pod-identity

4.1.18

2 of 2 See more

aad-pod-identity aad-pod-identity 4.1.18

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
mcr.microsoft.com/oss/azure/aad-pod-identity/mic :v1.8.17	3004b93fcb74	golang.org/x/net@v0.7.0 stdlib@go1.19.10	0.60.0 1.26.9
mcr.microsoft.com/oss/azure/aad-pod-identity/nmi :v1.8.17	77788bf38938	golang.org/x/net@v0.7.0 stdlib@go1.19.10	0.60.0 1.26.9

Open the chart page →

4,251

abcdesktopabcdesktop

4.4.13

2 of 9 See more

abcdesktop abcdesktop 4.4.13

2 of the 9 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/abcdesktopio/keysgenerator :4.4	26e0bcfa4c01	golang.org/x/net@v0.49.0 stdlib@go1.26.8	0.60.0 1.26.9
ghcr.io/abcdesktopio/mongo :safe8.0	b91afcb145a5	golang.org/x/net@v0.57.0 stdlib@go1.26.6	0.60.0 1.26.9

Open the chart page →

1,185

agonesagones

1.61.0

1 of 5 See more

agones agones 1.61.0

1 of the 5 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
alpine/kubectl :1.35.4	9ccd82364762	golang.org/x/net@v0.47.0 stdlib@go1.25.9	0.60.0 1.26.9

Open the chart page →

1,423

photoprismandrenarchy

8.15.0

1 of 1 See more

photoprism andrenarchy 8.15.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
photoprism/photoprism :260728	958642220223	golang.org/x/net@v0.57.0 stdlib@go1.26.5	0.60.0 1.26.9

Open the chart page →

50,190

kubedbappscode

2026.7.10

8 of 8 See more

kubedb appscode 2026.7.10

8 of the 8 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/kubectl-nonroot :1.34	0b26892cec94	golang.org/x/net@v0.38.0 stdlib@go1.24.13	0.60.0 1.26.9
ghcr.io/appscode/petset :v0.1.0	93fa0daf603c	golang.org/x/net@v0.47.0 stdlib@go1.25.10	0.60.0 1.26.9
ghcr.io/appscode/sidekick :v0.0.15	d1036b07e348	golang.org/x/net@v0.47.0 stdlib@go1.25.11	0.60.0 1.26.9
ghcr.io/kubedb/kubedb-autoscaler :v0.51.0	5d1182ac21f0	golang.org/x/net@v0.55.0 stdlib@go1.25.12	0.60.0 1.26.9
ghcr.io/kubedb/kubedb-crd-manager :v0.21.0	9506a6cb98d1	golang.org/x/net@v0.55.0 stdlib@go1.25.12	0.60.0 1.26.9
ghcr.io/kubedb/kubedb-ops-manager :v0.53.0	6d4c9fe66e4f	golang.org/x/net@v0.55.0 stdlib@go1.25.12	0.60.0 1.26.9
ghcr.io/kubedb/kubedb-provisioner :v0.66.0	e7041c3b41e7	golang.org/x/net@v0.55.0 stdlib@go1.25.13	0.60.0 1.26.9
ghcr.io/kubedb/kubedb-webhook-server :v0.42.0	e0f4431c4704	golang.org/x/net@v0.55.0 stdlib@go1.25.13	0.60.0 1.26.9

Open the chart page →

6,811

cloudflaredartur9010

1.0.9

3 of 3 See more

cloudflared artur9010 1.0.9

3 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
cloudflare/cloudflared :2026.3.0	6b599ca3e974	golang.org/x/net@v0.40.0 stdlib@go1.24.13	0.60.0 1.26.9
registry.k8s.io/ingress-nginx/controller :v1.15.1	594ceea76b01	golang.org/x/net@v0.52.0 stdlib@go1.26.1	0.60.0 1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.6.9	01038e7de14b	golang.org/x/net@v0.52.0 stdlib@go1.26.1	0.60.0 1.26.9

Open the chart page →

4,168

bambooatlassian-data-center

2.0.17

1 of 2 See more

bamboo atlassian-data-center 2.0.17

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
atlassian/bamboo :12.1.12	eb98d6fbeee7	stdlib@go1.22.2	1.26.9

Open the chart page →

36,178

alb-controllerazure-application-gateway-for-containers

1.12.2

3 of 3 See more

alb-controller azure-application-gateway-for-containers 1.12.2

3 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
mcr.microsoft.com/application-lb/images/alb-controller :1.12.2	6991e4273bb4	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9
mcr.microsoft.com/application-lb/images/alb-controller-bootstrap :1.12.2	0709f9fd5bfd	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9
mcr.microsoft.com/application-lb/images/alb-controller-crds :1.12.2	f5e176115522	golang.org/x/net@v0.57.0 stdlib@go1.26.7	0.60.0 1.26.9

Open the chart page →

418

baserowbaserow-chart

1.1.0

4 of 6 See more

baserow baserow-chart 1.1.0

4 of the 6 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
baserow/backend :2.4.0	af9aa6fe8482	golang.org/x/net@v0.58.0 stdlib@go1.25.14	0.60.0 1.26.9
bitnamilegacy/minio :2024.7.4-debian-12-r0	952f86d1116c	golang.org/x/net@v0.26.0 stdlib@go1.21.12	0.60.0 1.26.9
bitnamilegacy/redis :7.2.5-debian-12-r0	5261cae9e407	stdlib@go1.21.10	1.26.9
caddy/ingress :v0.2.1	18d1366fc0e9	golang.org/x/net@v0.17.0 stdlib@go1.21.4	0.60.0 1.26.9

Open the chart page →

19,706

mysql-operatorbitpoke

0.6.3

2 of 2 See more

mysql-operator bitpoke 0.6.3

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
bitpoke/mysql-operator :v0.6.3	f44fa86ab27e	golang.org/x/net@v0.8.0 stdlib@go1.17.13	0.60.0 1.26.9
bitpoke/mysql-operator-orchestrator :v0.6.3	d86560c75bed	golang.org/x/net@v0.8.0 stdlib@go1.19.9	0.60.0 1.26.9

Open the chart page →

5,362

celestia-appcelestia-labs

0.5.0

1 of 3 See more

celestia-app celestia-labs 0.5.0

1 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/celestiaorg/celestia-app :v3.7.0-arabica	23a9ec9b1879	golang.org/x/net@v0.34.0 stdlib@go1.23.6	0.60.0 1.26.9

Open the chart page →

1,527

cert-manager-webhook-hetznercert-manager-webhook-hetzner

0.2.1

1 of 1 See more

cert-manager-webhook-hetzner cert-manager-webhook-hetzner 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
deyaeddin/cert-manager-webhook-hetzner :latest	797b0d06210a	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110 stdlib@go1.16.7	0.60.0 1.26.9

Open the chart page →

4,145

fadicetic

0.3.1

2 of 25 See more

fadi cetic 0.3.1

2 of the 25 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
grafana/grafana :7.3.5	511bc20bfcd1	golang.org/x/net@v0.0.0-20201022231255-08b38378de70 stdlib@go1.15.5	0.60.0 1.26.9
library/traefik :2.5.4	7d0228d19042	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e stdlib@go1.17.3	0.60.0 1.26.9

Open the chart page →

141,463

kuttchristianhuth

9.11.2

1 of 3 See more

kutt christianhuth 9.11.2

1 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
bitnami/redis :latest	33a5a129cadc	stdlib@go1.26.8	1.26.9

Open the chart page →

783

clamavclamav

1.10.39

1 of 2 See more

clamav clamav 1.10.39

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
registry.gitlab.com/xrow-public/helm-clamav/kubectl :1.10.39	7d7a46f5dc6d	golang.org/x/net@v0.57.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

231

cloudquerycloudquery

39.0.4

1 of 1 See more

cloudquery cloudquery 39.0.4

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/cloudquery/cloudquery :6.40.0	40b804fce7f9	golang.org/x/net@v0.56.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

877

cluster-api-operatorcluster-api-operator

0.29.0

1 of 1 See more

cluster-api-operator cluster-api-operator 0.29.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
registry.k8s.io/capi-operator/cluster-api-operator :v0.29.0	465e72f8b06a	golang.org/x/net@v0.56.0 stdlib@go1.26.6	0.60.0 1.26.9

Open the chart page →

187

Container images carrying it

6,374 by charts deploying them

A fixed version is listed for 5 of the 9 affected packages.

Container image	Digest	Package	Fixed in	Used by
grafana/alloy :v1.14.0	f50931848bd8	golang.org/x/net@v0.50.0 stdlib@go1.25.7	0.60.0 1.26.9	1
grafana/alloy :v1.12.2	f94b1c82957a	golang.org/x/net@v0.46.0 stdlib@go1.25.5	0.60.0 1.26.9	1
grafana/beyla :1.3.3	36d07f8d276e	golang.org/x/net@v0.21.0 stdlib@go1.21.7	0.60.0 1.26.9	1
grafana/beyla :3.32.0	3ff0f7cf2bbf	golang.org/x/net@v0.57.0 stdlib@go1.25.11	0.60.0 1.26.9	1
grafana/beyla :2.2.2	a9cf4560472e	golang.org/x/net@v0.38.0 stdlib@go1.24.1	0.60.0 1.26.9	1
grafana/beyla-k8s-cache :2	53b2f561cb1b	golang.org/x/net@v0.48.0 stdlib@go1.25.3	0.60.0 1.26.9	1
grafana/cloudcost-exporter :v1.14.0	1ceccc8e1adc	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2	1
grafana/grafana :6.6.0	052147d7e0ec	golang.org/x/net@v0.0.0-20190923162816-aa69164e4478 stdlib@go1.13.4	0.60.0 1.26.9	1
grafana/grafana :10.1.5	0679e877ba20	golang.org/x/net@v0.12.0 stdlib@go1.20.10	0.60.0 1.26.9	1
grafana/grafana :7.5.6	09bb407e26ab	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777 stdlib@go1.16.1	0.60.0 1.26.9	1
grafana/grafana :7.3.3	15b977f5207d	golang.org/x/net@v0.0.0-20200813134508-3edf25e44fcc stdlib@go1.15.1	0.60.0 1.26.9	1
grafana/grafana :9.4.7	1a359d92f40e	golang.org/x/net@v0.4.0 stdlib@go1.20.1	0.60.0 1.26.9	1
grafana/grafana :10.1.1	1b9ca4bbc4a2	golang.org/x/net@v0.12.0 stdlib@go1.20.8	0.60.0 1.26.9	1
grafana/grafana :13.0.1-security-01	2d1f9ae67c17	golang.org/x/net@v0.52.0 stdlib@go1.26.2	0.60.0 1.26.9	1
grafana/grafana :12.2.2	2ebef928d7e5	golang.org/x/net@v0.45.0 stdlib@go1.25.3	0.60.0 1.26.9	1
grafana/grafana :12.2.1	35c41e0fd029	golang.org/x/net@v0.45.0 stdlib@go1.25.3	0.60.0 1.26.9	1
grafana/grafana :9.5.2	39c849cebccc	golang.org/x/net@v0.8.0 stdlib@go1.20.4	0.60.0 1.26.9	1
grafana/grafana :11.2.2-security-01	464eac539793	golang.org/x/net@v0.28.0 stdlib@go1.22.7	0.60.0 1.26.9	1
grafana/grafana :11.5.1	5781759b3d27	golang.org/x/net@v0.34.0 stdlib@go1.23.5	0.60.0 1.26.9	1
grafana/grafana :11.6.0	62d2b9d20a19	golang.org/x/net@v0.36.0 stdlib@go1.23.7	0.60.0 1.26.9	1
grafana/grafana :8.0.3	696823fbc561	golang.org/x/net@v0.0.0-20210521195947-fe42d452be8f stdlib@go1.16.1	0.60.0 1.26.9	1
grafana/grafana :10.2.3	6b5b37eb35bb	golang.org/x/net@v0.19.0 stdlib@go1.21.3	0.60.0 1.26.9	1
grafana/grafana :7.3.4	6d42886b3ebe	golang.org/x/net@v0.0.0-20200813134508-3edf25e44fcc stdlib@go1.15.5	0.60.0 1.26.9	1
grafana/grafana :12.3.0	70d9599b186c	golang.org/x/net@v0.46.0 stdlib@go1.25.3	0.60.0 1.26.9	1
grafana/grafana :7.2.1	733842cca5bd	golang.org/x/net@v0.0.0-20200813134508-3edf25e44fcc stdlib@go1.15.1	0.60.0 1.26.9	1
grafana/grafana :12.2.0	74144189b384	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.60.0 1.26.9	1
grafana/grafana :9.4.3	76dcf36e7d2a	golang.org/x/net@v0.4.0 stdlib@go1.19.4	0.60.0 1.26.9	1
grafana/grafana :13.1.1	7cb8c64c4d57	golang.org/x/net@v0.55.0 stdlib@go1.26.3	0.60.0 1.26.9	1
grafana/grafana :10.3.3	8640e5038e83	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.60.0 1.26.9	1
grafana/grafana :11.5.2	8b37a2f028f1	golang.org/x/net@v0.34.0 stdlib@go1.23.5	0.60.0 1.26.9	1
grafana/grafana :9.1.1	9746858c20e6	golang.org/x/net@v0.0.0-20220615171555-694bf12d69de stdlib@go1.17.12	0.60.0 1.26.9	1
grafana/grafana :12.1.1	a1701c218024	golang.org/x/net@v0.41.0 stdlib@go1.24.6	0.60.0 1.26.9	1
grafana/grafana :9.0.1	a738d0744784	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.17.11	0.60.0 1.26.9	1
grafana/grafana :10.4.19	a9043254ba16	golang.org/x/net@v0.40.0 stdlib@go1.24.3	0.60.0 1.26.9	1
grafana/grafana :13.1.3	ab5cb380e3ff	golang.org/x/net@v0.56.0 stdlib@go1.26.5	0.60.0 1.26.9	1
grafana/grafana :11.1.3	b23b588cf7cb	golang.org/x/net@v0.26.0 stdlib@go1.22.4	0.60.0 1.26.9	1
grafana/grafana :12.0.2	b5b59bfc7561	golang.org/x/net@v0.40.0 stdlib@go1.24.4	0.60.0 1.26.9	1
grafana/grafana :8.1.5	b7dd9cd0e59d	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e stdlib@go1.16.1	0.60.0 1.26.9	1
grafana/grafana :12.3.2	ba93c9d192e5	golang.org/x/net@v0.47.0 stdlib@go1.25.6	0.60.0 1.26.9	1
grafana/grafana :6.5.1	befcd84da2c1	golang.org/x/net@v0.0.0-20190724013045-ca1201d0de80 stdlib@go1.13.1	0.60.0 1.26.9	1
grafana/grafana :8.3.5	cd7cb4345aa7	golang.org/x/net@v0.0.0-20210903162142-ad29c8ab022f stdlib@go1.17.6	0.60.0 1.26.9	1
grafana/grafana :8.3.4	cf81d2c753c8	golang.org/x/net@v0.0.0-20210903162142-ad29c8ab022f stdlib@go1.17.6	0.60.0 1.26.9	1
grafana/grafana :7.4.5	d322192ed2fa	golang.org/x/net@v0.0.0-20201022231255-08b38378de70 stdlib@go1.15.6	0.60.0 1.26.9	1
grafana/grafana :9.3.6	e5a9655dabef	golang.org/x/net@v0.1.0 stdlib@go1.19.4	0.60.0 1.26.9	1
grafana/grafana :8.5.3	ecc1b80b8ca2	golang.org/x/net@v0.0.0-20211118161319-6a13c67c3ce4 stdlib@go1.17.9	0.60.0 1.26.9	1
grafana/grafana :10.4.0	f9811e4e687f	golang.org/x/net@v0.20.0 stdlib@go1.21.8	0.60.0 1.26.9	1
grafana/grafana :11.3.1	fa801ab6e1ae	golang.org/x/net@v0.29.0 stdlib@go1.23.1	0.60.0 1.26.9	1
grafana/kubernetes-diff-logger :0.0.5	98f6d1cd1e25	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e stdlib@go1.16.5	0.60.0 1.26.9	1
grafana/logcli :main-c90366d-amd64	3d85bb66e39b	golang.org/x/net@v0.0.0-20210505214959-0714010a04ed stdlib@go1.16.2	0.60.0 1.26.9	1
grafana/loki :2.9.10	35b02acc6765	golang.org/x/net@v0.26.0 stdlib@go1.22.5	0.60.0 1.26.9	1