CVE-2026-78660

High

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.003; 21st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,334; of 18,117 indexed, latest versions
Container images: 6,152; deployed by those charts
Fix available: 3 of 5; affected packages

HTTP/2 transport accepts malformed framing-related headers in net/http

Carried by container images the latest versions of 5,334 of 18,117 indexed charts deploy, on 6,152 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+212 more	1.26.9, 1.27.2	6,105
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more	0.60.0	4,915
golang-1.19deb	1.19.8-2	no fix listed	1
ingress-nginx-controller-1.15apk	1.15.10-r9	no fix listed	1
minioapk	0.20251015.172955-r10	0.20260922.192518-r2	1

OSV records: CGA-549w-3rfh-p826 CGA-p3fp-cff9-hfhm DEBIAN-CVE-2026-78660 GO-2026-6610
Also known as: CGA-w457-vj2x-m6xf, CGA-xjhf-9jv7-7x78
Trending: Rank 10 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,334 by stars

Chart

Latest

Affected images

Radar Score

kbot-self-hostedkbot-self-hosted

0.1.8

1 of 7 See more

kbot-self-hosted kbot-self-hosted 0.1.8

1 of the 7 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
gotenberg/gotenberg :8.30	206a6c708fc6	golang.org/x/net@v0.52.0 stdlib@go1.26.0	0.60.0 1.26.9

Open the chart page →

38,887

kc-chartkc-chart

1.0.0

1 of 3 See more

kc-chart kc-chart 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/mysql :latest	9d48c42f8341	stdlib@go1.24.6	1.26.9

Open the chart page →

10,312

kcmkcm

1.12.0

12 of 12 See more

kcm kcm 1.12.0

12 of the 12 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
velero/velero :v1.18.2	37396519f399	golang.org/x/net@v0.55.0 stdlib@go1.25.11	0.60.0 1.26.9
ghcr.io/fluxcd/flux-cli :v2.9.1	020edbaee890	golang.org/x/net@v0.49.0 stdlib@go1.26.4	0.60.0 1.26.9
ghcr.io/fluxcd/helm-controller :v1.6.2	e17ab0e5885d	golang.org/x/net@v0.56.0 stdlib@go1.26.4	0.60.0 1.26.9
ghcr.io/fluxcd/source-controller :v1.9.2	2b8d06650a1b	golang.org/x/net@v0.56.0 stdlib@go1.26.4	0.60.0 1.26.9
ghcr.io/k0rdent/kcm/controller :1.12.0	0ec66900c2a9	golang.org/x/net@v0.59.0 stdlib@go1.26.6	0.60.0 1.26.9
ghcr.io/k0rdent/kcm/telemetry :1.12.0	1718c4b14e65	golang.org/x/net@v0.59.0 stdlib@go1.26.6	0.60.0 1.26.9
ghcr.io/stakater/reloader :v1.4.22	def2480040ad	golang.org/x/net@v0.56.0 stdlib@go1.26.8	0.60.0 1.26.9
quay.io/jetstack/cert-manager-cainjector :v1.21.2	c85268c64f2e	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9
quay.io/jetstack/cert-manager-controller :v1.21.2	70f532fd9cfd	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9
quay.io/jetstack/cert-manager-startupapicheck :v1.21.2	46e75b686635	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9
quay.io/jetstack/cert-manager-webhook :v1.21.2	a60e2dac46db	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9
quay.io/reactiveops/rbac-manager :v1.9.5	87e3f461446f	golang.org/x/net@v0.48.0 stdlib@go1.25.5	0.60.0 1.26.9

Open the chart page →

6,720

kcp-operatorkcp-dev

0.7.10

1 of 1 See more

kcp-operator kcp-dev 0.7.10

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/kcp-dev/kcp-operator :v0.9.0	cd8bf46d98e0	golang.org/x/net@v0.57.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

406

keeper-injectorkeeper-injector

0.10.0

2 of 2 See more

keeper-injector keeper-injector 0.10.0

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
keeper/injector-webhook :0.10.0	aeb5476b95f0	golang.org/x/net@v0.47.0 stdlib@go1.25.6	0.60.0 1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.4.4	a9f03b34a3cb	golang.org/x/net@v0.28.0 stdlib@go1.22.8	0.60.0 1.26.9

Open the chart page →

1,695

keeper-injectorkeeper-security

0.11.3

2 of 2 See more

keeper-injector keeper-security 0.11.3

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
keeper/injector-webhook :0.11.3	3eb609f3e60c	golang.org/x/net@v0.55.0 stdlib@go1.25.14	0.60.0 1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.4.4	a9f03b34a3cb	golang.org/x/net@v0.28.0 stdlib@go1.22.8	0.60.0 1.26.9

Open the chart page →

1,256

nodevitalskeiailab

0.9.4

1 of 1 See more

nodevitals keiailab 0.9.4

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/keiailab/nodevitals :0.9.4	b07e506d4cb1	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

509

qdrant-operatorkeiailab

0.10.2

1 of 1 See more

qdrant-operator keiailab 0.10.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/keiailab/qdrant-operator :v0.10.2	3da83bf91aa1	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

209

kenerkener-chart

0.0.7

1 of 1 See more

kener kener-chart 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/rajnandan1/kener :3.2.18	2b993cb232eb	stdlib@go1.20.7	1.26.9

Open the chart page →

6,382

kent-exporterkent

0.4.0

1 of 1 See more

kent-exporter kent 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
staslevchenko/kent :0.4.0	e1b5de030254	golang.org/x/net@v0.57.0 stdlib@go1.25.14	0.60.0 1.26.9

Open the chart page →

379

kestra-starterkestra

2.0.6

2 See more

kestra-starter kestra 2.0.6

2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/postgres :17.5	aadf2c0696f5	stdlib@go1.18.2	1.26.9
versity/versitygw :v1.1.0	f730e0dbc1ef	golang.org/x/net@v0.49.0 stdlib@go1.25.5	0.60.0 1.26.9

Open the chart page →

—

keyauthoritykeyauthority

0.2.27

1 of 5 See more

keyauthority keyauthority 0.2.27

1 of the 5 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
keyauthoritydh/backend :1.4.10	b2519da39b25	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

2,278

keycloak-operator-legacykeycloak-operator-legacy

1.0.0

1 of 1 See more

keycloak-operator-legacy keycloak-operator-legacy 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak-operator :19.0.2-legacy	15fa0ed662b1	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.13.8	0.60.0 1.26.9

Open the chart page →

6,417

csi-driver-nfskeyporttech

0.1.4

1 of 2 See more

csi-driver-nfs keyporttech 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
keyporttech/csi-driver-nfs :2.0.0	5bd7955ea2f1	golang.org/x/net@v0.0.0-20190415100556-4a65cf94b679 stdlib@go1.14.2	0.60.0 1.26.9

Open the chart page →

4,611

gogskeyporttech

0.1.3

1 of 3 See more

gogs keyporttech 0.1.3

1 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
gogs/gogs :0.12.3	0195b095d0b2	golang.org/x/net@v0.0.0-20191014212845-da9a3fd4c582 stdlib@go1.14.7	0.60.0 1.26.9

Open the chart page →

4,782

helm-mongodb-operatorkeyporttech

0.1.0

1 of 1 See more

helm-mongodb-operator keyporttech 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/mongodb/mongodb-enterprise-operator :1.8.2	a1c3843b03bc	golang.org/x/net@v0.0.0-20200520004742-59133d7f0dd7 stdlib@go1.13.15	0.60.0 1.26.9

Open the chart page →

10,239

connectkfirfer

1.15.0

2 of 2 See more

connect kfirfer 1.15.0

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
1password/connect-api :1.7.2	6aa94cf713f9	golang.org/x/net@v0.14.0 stdlib@go1.20.6	0.60.0 1.26.9
1password/connect-sync :1.7.2	fe527ed9d81f	golang.org/x/net@v0.14.0 stdlib@go1.20.6	0.60.0 1.26.9

Open the chart page →

4,370

dex-k8s-authenticatorkfirfer

0.0.3

1 of 1 See more

dex-k8s-authenticator kfirfer 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
mintel/dex-k8s-authenticator :1.4.0	caf71cee7b9a	golang.org/x/net@v0.0.0-20190522155817-f3200d17e092 stdlib@go1.13.11	0.60.0 1.26.9

Open the chart page →

4,050

home-assistantkfirfer

0.5.4

1 of 1 See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
homeassistant/home-assistant :2023.10.3	021e2afc6e57	stdlib@go1.17.1	1.26.9

Open the chart page →

7,804

keelkfirfer

1.0.5

1 of 1 See more

keel kfirfer 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
keelhq/keel :0.19.2	02ac4ea616c4	golang.org/x/net@v0.9.0 stdlib@go1.20.5	0.60.0 1.26.9

Open the chart page →

2,796

kubernetes-replicatorkfirfer

2.9.1

1 of 1 See more

kubernetes-replicator kfirfer 2.9.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/mittwald/kubernetes-replicator :v2.9.1	baf5f784398b	golang.org/x/net@v0.8.0 stdlib@go1.20.5	0.60.0 1.26.9

Open the chart page →

1,564

mysqldumpkfirfer

2.8.0

1 of 1 See more

mysqldump kfirfer 2.8.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
kfirfer/gcloud-mysql :1.0.3	c257c1e0e8b9	golang.org/x/net@v0.17.0 stdlib@go1.21.5	0.60.0 1.26.9

Open the chart page →

4,255

pod-cleanupkfirfer

0.0.4

1 of 1 See more

pod-cleanup kfirfer 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
registry.gitlab.com/gitlab-org/ci-cd/gitlab-runner-pod-cleanup :latest	4369f3ba1d9a	golang.org/x/net@v0.43.0 stdlib@go1.25.0	0.60.0 1.26.9

Open the chart page →

1,248

prometheus-elasticsearch-exporterkfirfer

6.5.1

1 of 1 See more

prometheus-elasticsearch-exporter kfirfer 6.5.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/prometheuscommunity/elasticsearch-exporter :v1.8.0	073dd360de2c	golang.org/x/net@v0.23.0 stdlib@go1.22.7	0.60.0 1.26.9

Open the chart page →

1,322

scriptskfirfer

0.1.36

1 of 1 See more

scripts kfirfer 0.1.36

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
kfirfer/scripts :0.0.24	81e5c4e5d70e	stdlib@go1.17.10	1.26.9

Open the chart page →

3,208

kiaekiae

0.1.6

6 of 9 See more

kiae kiae 0.1.6

6 of the 9 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
grafana/loki :2.6.1	1ee60f980950	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.17.9	0.60.0 1.26.9
grafana/promtail :2.6.1	072527b12cdf	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.17.9	0.60.0 1.26.9
istio/pilot :1.15.2	db08d6963975	golang.org/x/net@v0.0.0-20220624214902-1bab6f366d9e stdlib@go1.19.2	0.60.0 1.26.9
otel/opentelemetry-collector-contrib :0.63.1	dfb3a55ea8c9	golang.org/x/net@v0.1.0 stdlib@go1.19.2	0.60.0 1.26.9
ghcr.io/dexidp/dex :v2.35.3	13964b29d63e	golang.org/x/net@v0.0.0-20220927171203-f486391704dc stdlib@go1.19.2	0.60.0 1.26.9
ghcr.io/kiaedev/kiae :latest	ebd03028ff6a	golang.org/x/net@v0.0.0-20220826154423-83b083e8dc8b stdlib@go1.18.9	0.60.0 1.26.9

Open the chart page →

25,427

kimai-helmchartkimai2tet

0.1.0

1 of 2 See more

kimai-helmchart kimai2tet 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	stdlib@go1.18.2	1.26.9

Open the chart page →

2,384

local-path-provisionerkir4h

0.0.35

1 of 1 See more

local-path-provisioner kir4h 0.0.35

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
rancher/local-path-provisioner :v0.0.35	34ff0847cc47	golang.org/x/net@v0.38.0 stdlib@go1.26.1	0.60.0 1.26.9

Open the chart page →

1,186

process-exporterkir4h

1.0.1

1 of 1 See more

process-exporter kir4h 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ncabatoff/process-exporterdigest-pinned	6f0549dc24e9	golang.org/x/net@v0.33.0 stdlib@go1.23.1	0.60.0 1.26.9

Open the chart page →

1,275

typebotiokitsune-itops

0.1.4

1 of 4 See more

typebotio kitsune-itops 0.1.4

1 of the 4 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/postgres :16-alpine	721873c34ceb	stdlib@go1.24.6	1.26.9

Open the chart page →

761

cdashkitware

0.20.0

1 of 3 See more

cdash kitware 0.20.0

1 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
bitnamilegacy/minio :2024.12.18-debian-12-r0	cce234b4381a	golang.org/x/net@v0.32.0 stdlib@go1.22.10	0.60.0 1.26.9

Open the chart page →

13,581

rabbitmq-cluster-operatorklicktipp

0.4.8

3 of 3 See more

rabbitmq-cluster-operator klicktipp 0.4.8

3 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/klicktipp/kubectl :1.36.3	0c2402d92b5c	golang.org/x/net@v0.49.0 stdlib@go1.26.5	0.60.0 1.26.9
ghcr.io/rabbitmq/cluster-operator :2.23.0	9236fb4f559b	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2
ghcr.io/rabbitmq/messaging-topology-operator :1.20.3	f377d3c3e221	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

1,052

rabbitmq-topology-operatorklicktipp

0.4.3

2 of 2 See more

rabbitmq-topology-operator klicktipp 0.4.3

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/klicktipp/kubectl :1.36.3	0c2402d92b5c	golang.org/x/net@v0.49.0 stdlib@go1.26.5	0.60.0 1.26.9
ghcr.io/rabbitmq/messaging-topology-operator :1.20.3	f377d3c3e221	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

843

kloudlite-agentkloudlite

1.1.5

1 of 3 See more

kloudlite-agent kloudlite 1.1.5

1 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
bitnami/kubectl :latest	999d5eb28f40	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

226

kloudlite-platformkloudlite

1.1.5

1 of 3 See more

kloudlite-platform kloudlite 1.1.5

1 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
natsio/nats-box :0.14.1	a67913df95f1	golang.org/x/net@v0.15.0 stdlib@go1.21.3	0.60.0 1.26.9

Open the chart page →

2,678

klustre-csi-pluginklustre-csi-plugin

0.1.1

1 of 2 See more

klustre-csi-plugin klustre-csi-plugin 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.10.1	f25af73ee708	golang.org/x/net@v0.18.0 stdlib@go1.21.5	0.60.0 1.26.9

Open the chart page →

2,164

knative-servingknative-serving

1.18.3

7 of 7 See more

knative-serving knative-serving 1.18.3

7 of the 7 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
gcr.io/knative-releases/knative.dev/net-istio/cmd/controllerdigest-pinned	0d5f740b4224	golang.org/x/net@v0.39.0 stdlib@go1.24.6	0.60.0 1.26.9
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhookdigest-pinned	697668be7893	golang.org/x/net@v0.39.0 stdlib@go1.24.6	0.60.0 1.26.9
gcr.io/knative-releases/knative.dev/serving/cmd/activatordigest-pinned	031408ec516f	golang.org/x/net@v0.39.0 stdlib@go1.24.3	0.60.0 1.26.9
gcr.io/knative-releases/knative.dev/serving/cmd/autoscalerdigest-pinned	3502bb5aa60f	golang.org/x/net@v0.39.0 stdlib@go1.24.3	0.60.0 1.26.9
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler-hpadigest-pinned	7405faeb7636	golang.org/x/net@v0.39.0 stdlib@go1.24.3	0.60.0 1.26.9
gcr.io/knative-releases/knative.dev/serving/cmd/controllerdigest-pinned	5b93308a392c	golang.org/x/net@v0.39.0 stdlib@go1.24.3	0.60.0 1.26.9
gcr.io/knative-releases/knative.dev/serving/cmd/webhookdigest-pinned	50831d9aaa69	golang.org/x/net@v0.39.0 stdlib@go1.24.3	0.60.0 1.26.9

Open the chart page →

7,331

kollectkollect

0.21.0

1 of 1 See more

kollect kollect 0.21.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/platformrelay/kollect :v0.21.0	a86edc5ec3a8	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

2,268

kollektorkollektor

1.0.5

1 of 1 See more

kollektor kollektor 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
pannoi/kollektor :1.0.5	9559617788fc	golang.org/x/net@v0.17.0 stdlib@go1.20.14	0.60.0 1.26.9

Open the chart page →

1,362

cert-managerkomailo-helm-charts

1.10.1

4 of 4 See more

cert-manager komailo-helm-charts 1.10.1

4 of the 4 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/jetstack/cert-manager-cainjector :v1.21.2	c85268c64f2e	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9
quay.io/jetstack/cert-manager-controller :v1.21.2	70f532fd9cfd	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9
quay.io/jetstack/cert-manager-startupapicheck :v1.21.2	46e75b686635	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9
quay.io/jetstack/cert-manager-webhook :v1.21.2	a60e2dac46db	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

866

cloudflare-tunnel-remotekomailo-helm-charts

1.3.2

1 of 1 See more

cloudflare-tunnel-remote komailo-helm-charts 1.3.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
cloudflare/cloudflared :2026.9.3	072c067d25cc	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

631

external-dnskomailo-helm-charts

1.11.0

1 of 1 See more

external-dns komailo-helm-charts 1.11.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
registry.k8s.io/external-dns/external-dns :v0.22.0	5fdcaf7deb5c	golang.org/x/net@v0.58.0 stdlib@go1.26.6	0.60.0 1.26.9

Open the chart page →

254

external-secretskomailo-helm-charts

6.1.0

1 of 1 See more

external-secrets komailo-helm-charts 6.1.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/external-secrets/external-secrets :v2.10.0	814117b0fd6d	golang.org/x/net@v0.57.0 stdlib@go1.26.6	0.60.0 1.26.9

Open the chart page →

311

ingress-nginxkomailo-helm-charts

1.0.0

2 of 2 See more

ingress-nginx komailo-helm-charts 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
registry.k8s.io/ingress-nginx/controller :v1.11.3	d56f135b6462	golang.org/x/net@v0.29.0 stdlib@go1.22.8	0.60.0 1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.4.4	a9f03b34a3cb	golang.org/x/net@v0.28.0 stdlib@go1.22.8	0.60.0 1.26.9

Open the chart page →

2,621

k8s-metrics-serverkomailo-helm-charts

1.2.0

1 of 1 See more

k8s-metrics-server komailo-helm-charts 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
registry.k8s.io/metrics-server/metrics-server :v0.9.0	d9862115e7c7	golang.org/x/net@v0.56.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

469

longhornkomailo-helm-charts

0.6.0

3 of 3 See more

longhorn komailo-helm-charts 0.6.0

3 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.12.1	83b79f57043f	golang.org/x/net@v0.57.0 stdlib@go1.26.5	0.60.0 1.26.9
longhornio/longhorn-share-manager :v1.12.1	efaf47aeb4e8	golang.org/x/net@v0.56.0 stdlib@go1.26.5	0.60.0 1.26.9
longhornio/longhorn-ui :v1.12.1	03a3ce6673df	stdlib@go1.25.12	1.26.9

Open the chart page →

1,519

metallbkomailo-helm-charts

1.2.4

3 of 4 See more

metallb komailo-helm-charts 1.2.4

3 of the 4 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/metallb/controller :v0.16.1	f51ab515de9c	golang.org/x/net@v0.53.0 stdlib@go1.25.9	0.60.0 1.26.9
quay.io/metallb/frr-k8s :v0.0.25	1cb06fb2d553	golang.org/x/net@v0.39.0 stdlib@go1.25.8	0.60.0 1.26.9
quay.io/metallb/speaker :v0.16.1	16561e96531e	golang.org/x/net@v0.53.0 stdlib@go1.25.9	0.60.0 1.26.9

Open the chart page →

3,430

traefikkomailo-helm-charts

5.1.0

1 of 1 See more

traefik komailo-helm-charts 5.1.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/traefik :v3.7.13	24841fe2de73	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

253

komiserkomiser-eks

3.1.10

1 of 1 See more

komiser komiser-eks 3.1.10

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
tailwarden/komiser :3.1.10	3f68c8ae7993	golang.org/x/net@v0.17.0 stdlib@go1.22.0	0.60.0 1.26.9

Open the chart page →

1,959

komoplanekomodor

0.1.8

1 of 1 See more

komoplane komodor 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
komodorio/komoplane :0.2.1	9678d02c3f2e	golang.org/x/net@v0.47.0 stdlib@go1.26.2	0.60.0 1.26.9

Open the chart page →

1,346

Container images carrying it

6,152 by charts deploying them

A fixed version is listed for 3 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
rancher/local-path-provisioner :v0.0.22	e34c88ae0aff	golang.org/x/net@v0.0.0-20201021035429-f5854403a974 stdlib@go1.16.15	0.60.0 1.26.9	1
rancher/local-path-provisioner :v0.0.37	e757967a5ec3	golang.org/x/net@v0.56.0 stdlib@go1.26.5	0.60.0 1.26.9	1
rancher/mirrored-cloud-provider-vsphere :v1.31.1	febfd0517838	golang.org/x/net@v0.26.0 stdlib@go1.22.8	0.60.0 1.26.9	1
rancher/mirrored-kube-vip-kube-vip-iptables :v1.2.4	a071159e19cc	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2	1
rancher/mirrored-library-traefik :2.9.4	0842af6afcdf	golang.org/x/net@v0.0.0-20220927171203-f486391704dc stdlib@go1.19.2	0.60.0 1.26.9	1
rancher/mirrored-longhornio-csi-attacher :v4.11.0-20260428	fe417c28a6b8	golang.org/x/net@v0.48.0 stdlib@go1.25.9	0.60.0 1.26.9	1
rancher/mirrored-longhornio-csi-node-driver-registrar :v2.16.0-20260428	e82a8c8f800d	golang.org/x/net@v0.49.0 stdlib@go1.25.9	0.60.0 1.26.9	1
rancher/mirrored-longhornio-csi-provisioner :v5.3.0-20260428	9e519a21a77c	golang.org/x/net@v0.48.0 stdlib@go1.25.9	0.60.0 1.26.9	1
rancher/mirrored-longhornio-csi-resizer :v2.1.0-20260428	41cb674d1154	golang.org/x/net@v0.48.0 stdlib@go1.25.9	0.60.0 1.26.9	1
rancher/mirrored-longhornio-csi-snapshotter :v8.5.0-20260428	1975fac3890f	golang.org/x/net@v0.49.0 stdlib@go1.25.9	0.60.0 1.26.9	1
rancher/mirrored-sig-storage-csi-provisioner :v6.0.0	0c537015fe9c	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.60.0 1.26.9	1
rancher/mirrored-sig-storage-snapshot-controller :v6.1.0	934863015367	golang.org/x/net@v0.0.0-20220909164309-bea034e7d591 stdlib@go1.18	0.60.0 1.26.9	1
rancher/mirrored-sig-storage-snapshot-validation-webhook :v8.1.0	67ca97fe362b	golang.org/x/net@v0.28.0 stdlib@go1.22.5	0.60.0 1.26.9	1
rancher/mirrored-sig-storage-snapshot-validation-webhook :v6.1.0	deac027820ae	golang.org/x/net@v0.0.0-20220909164309-bea034e7d591 stdlib@go1.18	0.60.0 1.26.9	1
rancher/nginx-ingress-controller :v1.14.5-hardened2	6cbc1e932b5b	golang.org/x/net@v0.52.0 stdlib@go1.24.13	0.60.0 1.26.9	1
rancher/pushprox-client :v0.1.0-rancher2-client	a41cd716c412	stdlib@go1.16.4	1.26.9	1
rancher/pushprox-proxy :v0.1.0-rancher2-proxy	3126395b966c	stdlib@go1.16.4	1.26.9	1
rancher/system-upgrade-controller :v0.19.2	34fa058fe453	golang.org/x/net@v0.48.0 stdlib@go1.25.8	0.60.0 1.26.9	1
rancher/system-upgrade-controller :v0.18.0	9813f85653c8	golang.org/x/net@v0.44.0 stdlib@go1.25.3	0.60.0 1.26.9	1
raspbernetes/csi-node-driver-registrar :2.0.1	a552705225fd	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.13.15	0.60.0 1.26.9	1
ravendb/ravendb-operator :2.1.0	511050205ac5	golang.org/x/net@v0.48.0 stdlib@go1.26.6	0.60.0 1.26.9	1
rayselfs/aws-ec2-runtime-checker :v0.1.5	562e5b2f81ce	golang.org/x/net@v0.47.0 stdlib@go1.24.11	0.60.0 1.26.9	1
rclone/rclone :1.63.0	08e1af3c8814	golang.org/x/net@v0.8.0 stdlib@go1.20.5	0.60.0 1.26.9	1
rclone/rclone :1.57.0	1e6eeabddc01	golang.org/x/net@v0.0.0-20210813160813-60bc85c4be6d stdlib@go1.17.2	0.60.0 1.26.9	1
rclone/rclone :1.66.0	a693c46a6b8b	golang.org/x/net@v0.20.0 stdlib@go1.22.1	0.60.0 1.26.9	1
rclone/rclone :1.56.0	f2fc45c8bc57	golang.org/x/net@v0.0.0-20210415231046-e915ea6b2b7d stdlib@go1.16.6	0.60.0 1.26.9	1
reallibrephotos/librephotos-frontend :1.2.1	52371b6769d4	stdlib@go1.24.13	1.26.9	1
reaper99/recipya :v1.2.2	7f7ec3aeb88c	golang.org/x/net@v0.27.0 stdlib@go1.22.0	0.60.0 1.26.9	1
redislabs/operator :8.0.18-11	9078e713bb6a	golang.org/x/net@v0.51.0 stdlib@go1.26.1	0.60.0 1.26.9	1
redislabs/operator :7.4.2-2	ecb101af0506	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.60.0 1.26.9	1
redislabs/redisearch :2.4.14	33561794c5c8	stdlib@go1.16.7	1.26.9	1
redpandadata/kminion :v2.3.6	12bc33b3e334	golang.org/x/net@v0.55.0 stdlib@go1.26.6	0.60.0 1.26.9	1
redpandadata/kminion :v2.3.2	56da99e8d0d3	golang.org/x/net@v0.55.0 stdlib@go1.26.3	0.60.0 1.26.9	1
regclient/regsync :v0.8.3	3d8d8e40afb7	stdlib@go1.24.2	1.26.9	1
releaseargus/argus :0.29.0	e07088252d03	stdlib@go1.25.5	1.26.9	1
replicated/replicated-sdk :1.0.0-beta.31	8751b4963250	golang.org/x/net@v0.23.0 stdlib@go1.23.2	0.60.0 1.26.9	1
reportportal/migrations :5.7.0	da5d8e1395fe	golang.org/x/net@v0.0.0-20190424112056-4829fb13d2c6 stdlib@go1.13.6	0.60.0 1.26.9	1
reportportal/service-index :5.0.11	2b27a2d7a87d	golang.org/x/net@v0.0.0-20190613194153-d28f0bde5980 stdlib@go1.17.1	0.60.0 1.26.9	1
restic/restic :0.19.1	136600b6ff68	golang.org/x/net@v0.55.0 stdlib@go1.26.4	0.60.0 1.26.9	1
restic/restic :0.15.2	579e4e6a4931	golang.org/x/net@v0.8.0 stdlib@go1.19.8	0.60.0 1.26.9	1
restic/rest-server :0.14.0	d2aff06f47eb	stdlib@go1.24.3	1.26.9	1
resurfaceio/resurface :3.7.84	d5cda2f64109	stdlib@go1.23.0	1.26.9	1
rezachalak/bzen-mongo :1.0.0	34f694325191	stdlib@go1.19.12	1.26.9	1
ribbybibby/s3-exporter :v0.5.0	998184c51a00	stdlib@go1.15.15	1.26.9	1
richardjennings/opa-nginx :0.0.3	66424aca125d	stdlib@go1.20.5	1.26.9	1
rimusz/security-sample-app :0.2.0	b9a178ca76ef	stdlib@go1.14.4	1.26.9	1
robiningelbrecht/strava-statistics :v5.0.0	40842cdfd616	golang.org/x/net@v0.55.0 stdlib@go1.26.3	0.60.0 1.26.9	1
robjuz/postgresql-nominatim :latest	805c7bab76df	stdlib@go1.16.5	1.26.9	1
robotnik/filebrowser :2.24.2-1	43b177ffbb72	golang.org/x/net@v0.11.0 stdlib@go1.20.6	0.60.0 1.26.9	1
robotshop/rs-dispatch :latest	de81f1d07b02	stdlib@go1.17	1.26.9	1