StackRadar

CVE-2026-78660

High

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.003
21st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
5,334
of 18,117 indexed, latest versions
Container images
6,152
deployed by those charts
Fix available
3 of 5
affected packages

HTTP/2 transport accepts malformed framing-related headers in net/http

Carried by container images the latest versions of 5,334 of 18,117 indexed charts deploy, on 6,152 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+212 more1.26.9, 1.27.26,105
golang.org/x/netgolangv0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more0.60.04,915
golang-1.19deb1.19.8-2no fix listed1
ingress-nginx-controller-1.15apk1.15.10-r9no fix listed1
minioapk0.20251015.172955-r100.20260922.192518-r21
OSV records
CGA-549w-3rfh-p826CGA-p3fp-cff9-hfhmDEBIAN-CVE-2026-78660GO-2026-6610
Also known as
CGA-w457-vj2x-m6xf, CGA-xjhf-9jv7-7x78
Trending
Rank 10 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,334 by stars
ChartLatestAffected imagesRadar Score
kamaji-etcdclastixVerified publisher0.18.13 of 4See more

kamaji-etcd clastix 0.18.1

3 of the 4 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
cfssl/cfssl:latesta32a90480788
golang.org/x/net@v0.22.0
stdlib@go1.27.1
0.60.0
1.27.2
quay.io/coreos/etcd:v3.5.628cb0630cb85
golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2
stdlib@go1.16.15
0.60.0
1.26.9
quay.io/coreos/etcd:v3.6.12702d7b4881c6
golang.org/x/net@v0.52.0
stdlib@go1.25.10
0.60.0
1.26.9

Open the chart page →

9,549
local-path-provisionerclastixVerified publisher0.0.301 of 1See more

local-path-provisioner clastix 0.0.30

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
rancher/local-path-provisioner:v0.0.309b9148811700
golang.org/x/net@v0.27.0
stdlib@go1.23.1
0.60.0
1.26.9

Open the chart page →

1,756
vcloud-csiclastixVerified publisher1.6.04 of 5See more

vcloud-csi clastix 1.6.0

4 of the 5 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
csiplugin/csi-attacher:v3.2.160ab9b3e6a03
golang.org/x/net@v0.0.0-20210410081132-afb366fc7cd1
stdlib@go1.16
0.60.0
1.26.9
csiplugin/csi-node-driver-registrar:v2.2.02dee3fe5fe86
golang.org/x/net@v0.0.0-20210316092652-d523dce5a7f4
stdlib@go1.16
0.60.0
1.26.9
registry.k8s.io/sig-storage/csi-provisioner:v2.2.204c55b93a032
golang.org/x/net@v0.0.0-20210316092652-d523dce5a7f4
stdlib@go1.16.2
0.60.0
1.26.9
registry.k8s.io/sig-storage/csi-resizer:v1.4.09ebbf9f023e7
golang.org/x/net@v0.0.0-20211209124913-491a49abca63
stdlib@go1.17.3
0.60.0
1.26.9

Open the chart page →

12,099
cloudflare-ddnsclouddrove0.1.51 of 1See more

cloudflare-ddns clouddrove 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
favonia/cloudflare-ddns:15e61736b982b
golang.org/x/net@v0.59.0
stdlib@go1.27.1
0.60.0
1.27.2

Open the chart page →

209
cloudflared-tunnelclouddrove0.2.01 of 1See more

cloudflared-tunnel clouddrove 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
cloudflare/cloudflared:2026.9.3072c067d25cc
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9

Open the chart page →

631
cronjobclouddrove1.0.11 of 1See more

cronjob clouddrove 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
library/ubuntu:latestf144425ff09b
stdlib@go1.26.7
1.26.9

Open the chart page →

669
kube-acp-stackcloudentity2.29.13 of 7See more

kube-acp-stack cloudentity 2.29.1

3 of the 7 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
bitnamilegacy/redis-cluster:7.4.3-debian-12-r0a53d023fdfaf
stdlib@go1.23.8
1.26.9
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
golang.org/x/net@v0.33.0
stdlib@go1.21.13
0.60.0
1.26.9
gcr.io/cockroachlabs-helm-charts/cockroach-self-signer-cert:1.3e225fe7eaa55
golang.org/x/net@v0.0.0-20200602114024-627f9648deb9
stdlib@go1.13.14
0.60.0
1.26.9

Open the chart page →

24,856
openbankingcloudentity0.1.96 of 6See more

openbanking cloudentity 0.1.9

6 of the 6 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
cloudentity/openbanking-quickstart-bank:1.11.19402ec4b5016
golang.org/x/net@v0.0.0-20201207224615-747e23833adb
stdlib@go1.15.14
0.60.0
1.26.9
cloudentity/openbanking-quickstart-configuration:1.11.18a1890eb8265
golang.org/x/net@v0.0.0-20201207224615-747e23833adb
stdlib@go1.15.14
0.60.0
1.26.9
cloudentity/openbanking-quickstart-consent-admin-portal:1.11.1ee83cdd45b7b
golang.org/x/net@v0.0.0-20201207224615-747e23833adb
stdlib@go1.15.2
0.60.0
1.26.9
cloudentity/openbanking-quickstart-consent-page:1.11.15728654cecb7
golang.org/x/net@v0.0.0-20201207224615-747e23833adb
stdlib@go1.16.6
0.60.0
1.26.9
cloudentity/openbanking-quickstart-consent-self-service-portal:1.11.18ca94ae6acf4
golang.org/x/net@v0.0.0-20201207224615-747e23833adb
stdlib@go1.15.2
0.60.0
1.26.9
cloudentity/openbanking-quickstart-financroo-tpp:1.11.1c04eb10c77b7
golang.org/x/net@v0.0.0-20201207224615-747e23833adb
stdlib@go1.15.2
0.60.0
1.26.9

Open the chart page →

25,285
cloudflare-ddns-updatecloudflare-ddns-update0.1.21 of 1See more

cloudflare-ddns-update cloudflare-ddns-update 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
ghcr.io/dploeger/cloudflare-ddns-update:v0.1.0ec06685b9ff4
golang.org/x/net@v0.25.0
stdlib@go1.22.4
0.60.0
1.26.9

Open the chart page →

1,913
cloudflare-dyndnscloudflare-dyndnsVerified publisher1.1.01 of 1See more

cloudflare-dyndns cloudflare-dyndns 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
ghcr.io/msueberkrueb/cloudflare-dyndns:1.0.0e5c945a3b000
stdlib@go1.25.1
1.26.9

Open the chart page →

681
cloudflare-tunnel-ingress-controllercloudflare-tunnel-ingress-controller0.2.31 of 1See more

cloudflare-tunnel-ingress-controller cloudflare-tunnel-ingress-controller 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
ghcr.io/oliverbaehler/cloudflare-tunnel-ingress-controller:0.2.30aec31e36d95
golang.org/x/net@v0.37.0
stdlib@go1.23.7
0.60.0
1.26.9

Open the chart page →

957
cloudfront-tenant-operatorcloudfront-tenant-operatorVerified publisher0.3.01 of 1See more

cloudfront-tenant-operator cloudfront-tenant-operator 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
ghcr.io/dsp0x4/cloudfront-tenant-operator:0.3.0eb40174cd20d
golang.org/x/net@v0.51.0
stdlib@go1.26.2
0.60.0
1.26.9

Open the chart page →

649
hcloud-ccm-mgmtcloudhippieVerified publisher1.13.01 of 1See more

hcloud-ccm-mgmt cloudhippie 1.13.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
hetznercloud/hcloud-cloud-controller-manager:v1.39.0d6fee5698759
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9

Open the chart page →

322
hcloud-csi-mgmtcloudhippieVerified publisher2.12.05 of 5See more

hcloud-csi-mgmt cloudhippie 2.12.0

5 of the 5 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
hetznercloud/hcloud-csi-driver:v2.24.05b25f70ea9ac
golang.org/x/net@v0.58.0
stdlib@go1.27.1
0.60.0
1.27.2
registry.k8s.io/sig-storage/csi-attacher:v4.13.0d1a26170efed
golang.org/x/net@v0.58.0
stdlib@go1.26.6
0.60.0
1.26.9
registry.k8s.io/sig-storage/csi-provisioner:v6.4.06ebe60fd8ed6
golang.org/x/net@v0.59.0
stdlib@go1.26.6
0.60.0
1.26.9
registry.k8s.io/sig-storage/csi-resizer:v2.3.048fb3deb93cd
golang.org/x/net@v0.58.0
stdlib@go1.26.6
0.60.0
1.26.9
registry.k8s.io/sig-storage/livenessprobe:v2.20.019f2cf2f40e1
golang.org/x/net@v0.58.0
stdlib@go1.26.6
0.60.0
1.26.9

Open the chart page →

1,094
hcloud-csi-usercloudhippieVerified publisher1.9.03 of 3See more

hcloud-csi-user cloudhippie 1.9.0

3 of the 3 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
hetznercloud/hcloud-csi-driver:v2.24.05b25f70ea9ac
golang.org/x/net@v0.58.0
stdlib@go1.27.1
0.60.0
1.27.2
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.18.0b7fefd08651f
golang.org/x/net@v0.58.0
stdlib@go1.26.6
0.60.0
1.26.9
registry.k8s.io/sig-storage/livenessprobe:v2.20.019f2cf2f40e1
golang.org/x/net@v0.58.0
stdlib@go1.26.6
0.60.0
1.26.9

Open the chart page →

639
cloudian-exportercloudian-exporter0.1.41 of 1See more

cloudian-exporter cloudian-exporter 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
ghcr.io/dodevops/cloudian-exporter:0.1.18b7f2816541c
golang.org/x/net@v0.27.0
stdlib@go1.23.2
0.60.0
1.26.9

Open the chart page →

1,395
mercurecloudnativeapp1.0.21 of 1See more

mercure cloudnativeapp 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
dunglas/mercure:v0916834e49961
golang.org/x/net@v0.55.0
stdlib@go1.26.3
0.60.0
1.26.9

Open the chart page →

1,486
nginx-ingress-controllercloudnativeapp3.4.51 of 2See more

nginx-ingress-controller cloudnativeapp 3.4.5

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
bitnami/nginx:latestb8d42f076789
stdlib@go1.26.8
1.26.9

Open the chart page →

170
argocd-operatorcloud-native-toolkit0.6.11 of 1See more

argocd-operator cloud-native-toolkit 0.6.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
bitnami/kubectl:latestf7f9e4f64d9e
golang.org/x/net@v0.57.0
stdlib@go1.26.8
0.60.0
1.26.9

Open the chart page →

226
cp4d-deployercloud-native-toolkit1.0.01 of 1See more

cp4d-deployer cloud-native-toolkit 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
golang.org/x/net@v0.14.0
stdlib@go1.19.10
0.60.0
1.26.9

Open the chart page →

26,705
ibm-toolkit-installcloud-native-toolkit0.3.01 of 1See more

ibm-toolkit-install cloud-native-toolkit 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110
stdlib@go1.17.5
0.60.0
1.26.9

Open the chart page →

8,157
iteration-zerocloud-native-toolkit0.2.01 of 1See more

iteration-zero cloud-native-toolkit 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
quay.io/cloudnativetoolkit/cli-tools:v1.1-v1.8.2d6fd2a9e3273
golang.org/x/net@v0.0.0-20220107192237-5cfca573fb4d
stdlib@go1.18.1
0.60.0
1.26.9

Open the chart page →

8,357
ocs-operatorcloud-native-toolkit0.2.41 of 1See more

ocs-operator cloud-native-toolkit 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:lateste7965645fac6
golang.org/x/net@v0.57.0
stdlib@go1.26.7
0.60.0
1.26.9

Open the chart page →

589
pact-brokercloud-native-toolkit0.3.01 of 1See more

pact-broker cloud-native-toolkit 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
pactfoundation/pact-broker:2.101.0.0a3021fc42834
stdlib@go1.14.4
1.26.9

Open the chart page →

3,942
refarch-infraconfigcloud-native-toolkit0.2.21 of 1See more

refarch-infraconfig cloud-native-toolkit 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:lateste7965645fac6
golang.org/x/net@v0.57.0
stdlib@go1.26.7
0.60.0
1.26.9

Open the chart page →

589
robot-shopcloud-native-toolkit1.1.12 of 12See more

robot-shop cloud-native-toolkit 1.1.1

2 of the 12 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
robotshop/rs-dispatch:latestde81f1d07b02
stdlib@go1.17
1.26.9
robotshop/rs-mongodb:latest119b545823cd
stdlib@go1.16.3
1.26.9

Open the chart page →

39,597
tool-testcloud-native-toolkit0.2.11 of 1See more

tool-test cloud-native-toolkit 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
bitnami/nginx:latestb8d42f076789
stdlib@go1.26.8
1.26.9

Open the chart page →

170
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad5 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

5 of the 6 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
stdlib@go1.20.12
1.26.9
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
stdlib@go1.23.8
1.26.9
ghcr.io/formancehq/dex:v1.0.4b803fbe1cdb8
golang.org/x/net@v0.0.0-20220927171203-f486391704dc
stdlib@go1.19.1
0.60.0
1.26.9
ghcr.io/formancehq/membership:v1.11.024a0113d5fb0
golang.org/x/net@v0.41.0
stdlib@go1.24.6
0.60.0
1.26.9
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
stdlib@go1.23.8
1.26.9

Open the chart page →

23,208
cloud-provider-kubevirtcloud-provider-kubevirtVerified publisher0.2.01 of 1See more

cloud-provider-kubevirt cloud-provider-kubevirt 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
quay.io/kubevirt/kubevirt-cloud-controller-manager:v0.6.037ad4c475941
golang.org/x/net@v0.49.0
stdlib@go1.24.13
0.60.0
1.26.9

Open the chart page →

1,093
cloudrevecloudreve0.2.01 of 2See more

cloudreve cloudreve 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
cloudreve/cloudreve:4.18.0f7a464100bf6
golang.org/x/net@v0.55.0
stdlib@go1.25.5
0.60.0
1.26.9

Open the chart page →

3,601
k8s-monitoring-appcloudscriptVerified publisher1.0.01 of 1See more

k8s-monitoring-app cloudscript 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
ghcr.io/cloudscript-technology/k8s-monitoring-app:v0.0.25cab66a6b3574
golang.org/x/net@v0.38.0
stdlib@go1.24.10
0.60.0
1.26.9

Open the chart page →

1,783
cloudvaultcloudvaultOfficialVerified publisher1.0.21 of 3See more

cloudvault cloudvault 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
library/postgres:18.3-alpine54451ecb8ab3
stdlib@go1.24.6
1.26.9

Open the chart page →

2,738
ctrox-csi-s3cloudve0.1.01 of 4See more

ctrox-csi-s3 cloudve 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
ctrox/csi-s3:v1.2.0-rc.23c72862bea3c
golang.org/x/net@v0.0.0-20211216030914-fe4d6282115f
stdlib@go1.16.13
0.60.0
1.26.9

Open the chart page →

4,853
galaxycloudve6.8.81 of 3See more

galaxy cloudve 6.8.8

1 of the 3 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
tusproject/tusd:v1.13.0f8088058b80f
golang.org/x/net@v0.14.0
stdlib@go1.21.0
0.60.0
1.26.9

Open the chart page →

7,473
galaxy-cvmfs-csicloudve2.5.12 of 3See more

galaxy-cvmfs-csi cloudve 2.5.1

2 of the 3 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.10.1f25af73ee708
golang.org/x/net@v0.18.0
stdlib@go1.21.5
0.60.0
1.26.9
registry.k8s.io/sig-storage/csi-provisioner:v4.0.1bf5a235b67d8
golang.org/x/net@v0.19.0
stdlib@go1.21.5
0.60.0
1.26.9

Open the chart page →

2,822
galaxy-depscloudve1.1.16 of 7See more

galaxy-deps cloudve 1.1.1

6 of the 7 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
bitnamilegacy/kubectl:latestcd354d5b2556
golang.org/x/net@v0.41.0
stdlib@go1.24.5
0.60.0
1.26.9
bitnamilegacy/rabbitmq-cluster-operator:1.14.0-scratch-r567ac64a9623a
golang.org/x/net@v0.0.0-20220225172249-27dd8689420f
stdlib@go1.17
0.60.0
1.26.9
bitnamilegacy/rmq-messaging-topology-operator:1.7.1-scratch-r33c26208691a1
golang.org/x/net@v0.0.0-20220614195744-fb05da6f9022
stdlib@go1.17
0.60.0
1.26.9
ghcr.io/cloudnative-pg/cloudnative-pg:1.25.0a27779ed1085
golang.org/x/net@v0.32.0
stdlib@go1.23.4
0.60.0
1.26.9
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.8.0f6717ce72a26
golang.org/x/net@v0.8.0
stdlib@go1.20.3
0.60.0
1.26.9
registry.k8s.io/sig-storage/csi-provisioner:v3.5.0d078dc174323
golang.org/x/net@v0.8.0
stdlib@go1.20.3
0.60.0
1.26.9

Open the chart page →

15,697
galaxy-k8s-monitorcloudve0.1.11 of 1See more

galaxy-k8s-monitor cloudve 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
afgane/galaxy-k8s-monitor:latest457173db5640
golang.org/x/net@v0.30.0
stdlib@go1.24.13
0.60.0
1.26.9

Open the chart page →

726
galaxykubemancloudve2.10.14 of 7See more

galaxykubeman cloudve 2.10.1

4 of the 7 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
galaxy/cloudman-server:lateste5c265fe9fcd
golang.org/x/net@v0.0.0-20220225172249-27dd8689420f
stdlib@go1.17.13
0.60.0
1.26.9
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.8.0f6717ce72a26
golang.org/x/net@v0.8.0
stdlib@go1.20.3
0.60.0
1.26.9
registry.k8s.io/sig-storage/csi-provisioner:v3.5.0d078dc174323
golang.org/x/net@v0.8.0
stdlib@go1.20.3
0.60.0
1.26.9
registry.k8s.io/sig-storage/nfs-provisioner:v4.0.8c825f3d5e28b
golang.org/x/net@v0.0.0-20190923162816-aa69164e4478
stdlib@go1.16.2
0.60.0
1.26.9

Open the chart page →

20,360
janisterminalcloudve0.1.01 of 2See more

janisterminal cloudve 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
stakater/proxyinjector:v0.0.2383fef483d497
golang.org/x/net@v0.0.0-20190812203447-cdfb69ac37fc
stdlib@go1.13.1
0.60.0
1.26.9

Open the chart page →

81,695
openstack-cinder-csicloudve1.2.01 of 5See more

openstack-cinder-csi cloudve 1.2.0

1 of the 5 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
k8scloudprovider/cinder-csi-plugin:latesta30c7a2a594a
golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd
stdlib@go1.17.10
0.60.0
1.26.9

Open the chart page →

3,441
proxyinjectorcloudve0.0.231 of 1See more

proxyinjector cloudve 0.0.23

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
stakater/proxyinjector:v0.0.2383fef483d497
golang.org/x/net@v0.0.0-20190812203447-cdfb69ac37fc
stdlib@go1.13.1
0.60.0
1.26.9

Open the chart page →

4,176
pulsarcloudve0.2.02 of 2See more

pulsar cloudve 0.2.0

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
galaxy/pulsar-kubernetes:0.15.7e50a890e24c9
golang.org/x/net@v0.33.0
stdlib@go1.22.7
0.60.0
1.26.9
library/docker:dind0b6d18a4a222
golang.org/x/net@v0.59.0
stdlib@go1.26.8
0.60.0
1.26.9

Open the chart page →

7,355
argo-cdcluster-deploy0.3.32 of 3See more

argo-cd cluster-deploy 0.3.3

2 of the 3 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.5.3dd3f47d5a5e4
golang.org/x/net@v0.56.0
stdlib@go1.26.4
0.60.0
1.26.9
quay.io/argoprojlabs/argocd-image-updater:v1.3.0cb009167015c
golang.org/x/net@v0.56.0
stdlib@go1.26.5
0.60.0
1.26.9

Open the chart page →

3,758
argo-eventscluster-deploy0.1.01 of 1See more

argo-events cluster-deploy 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.10a83d2699ae53
golang.org/x/net@v0.49.0
stdlib@go1.24.11
0.60.0
1.26.9

Open the chart page →

1,691
cert-managercluster-deploy0.2.34 of 4See more

cert-manager cluster-deploy 0.2.3

4 of the 4 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-cainjector:v1.21.2c85268c64f2e
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9
quay.io/jetstack/cert-manager-controller:v1.21.270f532fd9cfd
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9
quay.io/jetstack/cert-manager-startupapicheck:v1.21.246e75b686635
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9
quay.io/jetstack/cert-manager-webhook:v1.21.2a60e2dac46db
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9

Open the chart page →

866
metaflowcluster-deploy0.2.21 of 1See more

metaflow cluster-deploy 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
stdlib@go1.20.2
1.26.9

Open the chart page →

9,455
mla-external-secretscluster-deploy0.4.01 of 1See more

mla-external-secrets cluster-deploy 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/external-secrets:v2.11.066fb710878cb
golang.org/x/net@v0.58.0
stdlib@go1.26.6
0.60.0
1.26.9

Open the chart page →

270
monitoringcluster-deploy0.3.09 of 11See more

monitoring cluster-deploy 0.3.0

9 of the 11 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
grafana/grafana:12.4.1e932bd6ed0e0
golang.org/x/net@v0.49.0
stdlib@go1.25.8
0.60.0
1.26.9
grafana/loki:3.6.73c8fd3570dd9
golang.org/x/net@v0.47.0
stdlib@go1.24.13
0.60.0
1.26.9
grafana/loki-canary:3.6.70dac7d5cb383
golang.org/x/net@v0.47.0
stdlib@go1.24.13
0.60.0
1.26.9
prom/memcached-exporter:v0.15.592a6ad5a3d3e
golang.org/x/net@v0.47.0
stdlib@go1.25.6
0.60.0
1.26.9
quay.io/prometheus-operator/prometheus-config-reloader:v0.89.0cb4ac6a56555
golang.org/x/net@v0.49.0
stdlib@go1.25.6
0.60.0
1.26.9
quay.io/prometheus/node-exporter:v1.10.2337ff1d356b6
golang.org/x/net@v0.44.0
stdlib@go1.25.3
0.60.0
1.26.9
quay.io/prometheus/prometheus:v3.10.07571a304e67f
golang.org/x/net@v0.49.0
stdlib@go1.26.0
0.60.0
1.26.9
quay.io/prometheus/pushgateway:v1.11.249ed9fdf3780
golang.org/x/net@v0.46.0
stdlib@go1.25.3
0.60.0
1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.01545919b72e3
golang.org/x/net@v0.48.0
stdlib@go1.25.5
0.60.0
1.26.9

Open the chart page →

12,320
traefikcluster-deploy0.3.11 of 1See more

traefik cluster-deploy 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
library/traefik:v3.7.1324841fe2de73
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9

Open the chart page →

253
whoamicluster-deploy0.0.11 of 1See more

whoami cluster-deploy 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container imageDigestPackageFixed in
traefik/whoami:latestc4717a8d1f01
golang.org/x/net@v0.57.0
stdlib@go1.26.5
0.60.0
1.26.9

Open the chart page →

357

Container images carrying it

6,152 by charts deploying them

A fixed version is listed for 3 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/dirien/minecraft-exporter:0.24.061d89bf99ff7
golang.org/x/net@v0.51.0
stdlib@go1.25.10
0.60.0
1.26.9
1
ghcr.io/distribution/distribution:3.0.04ba3adf47f5c
golang.org/x/net@v0.37.0
stdlib@go1.23.7
0.60.0
1.26.9
1
ghcr.io/djcass44/cso-proxy:cccf49fdb360d44125ad
golang.org/x/net@v0.0.0-20210908191846-a5e095526f91
stdlib@go1.17.5
0.60.0
1.26.9
1
ghcr.io/djcass44/gitlab-goproxy:v0.1.8a43323732181
golang.org/x/net@v0.10.0
stdlib@go1.21.0
0.60.0
1.26.9
1
ghcr.io/djerfy/zabbix-kubernetes-discovery:v1.4.207a50c07e7c69
stdlib@go1.23.1
1.26.9
1
ghcr.io/dmazhukov/cronguard:0.4.37683dd5b26ba
golang.org/x/net@v0.58.0
stdlib@go1.27.1
0.60.0
1.27.2
1
ghcr.io/dntosas/capi2argo-cluster-operator:v1.5.0fb8c6457ef6e
golang.org/x/net@v0.40.0
stdlib@go1.25.6
0.60.0
1.26.9
1
ghcr.io/dodevops/azure-advanced-backup:0.4.01041d4449e49
golang.org/x/net@v0.0.0-20220225172249-27dd8689420f
stdlib@go1.17.9
0.60.0
1.26.9
1
ghcr.io/dodevops/cloudian-exporter:0.1.18b7f2816541c
golang.org/x/net@v0.27.0
stdlib@go1.23.2
0.60.0
1.26.9
1
ghcr.io/dodevops/scalyr-k8snode-manager:latestfc39fcdd3968
stdlib@go1.18.1
1.26.9
1
ghcr.io/dodevops/vmware-rest-proxy:0.1.730f7f73b0a10
golang.org/x/net@v0.19.0
stdlib@go1.21.7
0.60.0
1.26.9
1
ghcr.io/donkie/spoolman:0.24.042135965c42d
stdlib@go1.19.8
1.26.9
1
ghcr.io/donkie/spoolman:0.26.1cf9b41e17b93
stdlib@go1.19.8
1.26.9
1
ghcr.io/doodlescheduling/k8sdb-controller:v0.0.1a6c2251a6263
golang.org/x/net@v0.0.0-20211108170745-6635138e15ea
stdlib@go1.16.14
0.60.0
1.26.9
1
ghcr.io/doodlescheduling/k8skeycloak-controller:v0.0.19befc51b1ad6
golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b
stdlib@go1.15.15
0.60.0
1.26.9
1
ghcr.io/doodlescheduling/k8soauth2-proxy-controller:v0.1.280d049c9da31
golang.org/x/net@v0.0.0-20220225172249-27dd8689420f
stdlib@go1.17.11
0.60.0
1.26.9
1
ghcr.io/doodlescheduling/k8s-pause:v0.1.16b3215e37738
golang.org/x/net@v0.0.0-20210825183410-e898025ed96a
stdlib@go1.17.8
0.60.0
1.26.9
1
ghcr.io/doodlescheduling/k8sprom-patch-controller:v0.1.243b92c9cf029
golang.org/x/net@v0.0.0-20211108170745-6635138e15ea
stdlib@go1.17.8
0.60.0
1.26.9
1
ghcr.io/doodlescheduling/k8stcpmap-controller:v0.0.1ff005643dc97
golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781
stdlib@go1.16.14
0.60.0
1.26.9
1
ghcr.io/doodlescheduling/k8svault-controller:v0.2.0627e5e211766
golang.org/x/net@v0.0.0-20211108170745-6635138e15ea
stdlib@go1.16.15
0.60.0
1.26.9
1
ghcr.io/doodlescheduling/saml-exporter:v0.5.03d5a99841bc2
stdlib@go1.22.3
1.26.9
1
ghcr.io/douban/aliyun-exporter:mainb7c694331362
stdlib@go1.24.2
1.26.9
1
ghcr.io/douban/qiniu-exporter:maind1da3bcfad7d
stdlib@go1.19.5
1.26.9
1
ghcr.io/douban/ucloud-exporter:mainb4bb8a9021a2
stdlib@go1.24.2
1.26.9
1
ghcr.io/douban/upyun-exporter:main6810900c9c4a
stdlib@go1.25.5
1.26.9
1
ghcr.io/dpicillo/paguro/paguro-node-installer:v0.1.2526c1324e1dc
golang.org/x/net@v0.58.0
stdlib@go1.26.6
0.60.0
1.26.9
1
ghcr.io/dploeger/cloudflare-ddns-update:v0.1.0ec06685b9ff4
golang.org/x/net@v0.25.0
stdlib@go1.22.4
0.60.0
1.26.9
1
ghcr.io/drakkan/sftpgo:v2.7.59011fe608d33
golang.org/x/net@v0.57.0
stdlib@go1.25.12
0.60.0
1.26.9
1
ghcr.io/druggeri/nut_exporter:3.3.0276460d141c7
golang.org/x/net@v0.35.0
stdlib@go1.26.3
0.60.0
1.26.9
1
ghcr.io/dsp0x4/cloudfront-tenant-operator:0.3.0eb40174cd20d
golang.org/x/net@v0.51.0
stdlib@go1.26.2
0.60.0
1.26.9
1
ghcr.io/duyet/gaxy:latest31d658a22bd1
stdlib@go1.27.1
1.27.2
1
ghcr.io/dynamia-ai/hami-enterprise:v2.10.0-r0-openshift.c4e22e88745504757300
golang.org/x/net@v0.57.0
stdlib@go1.26.5
0.60.0
1.26.9
1
ghcr.io/dysnix/bitnami/mongodb:4.4.11-debian-10-r5073116e61007
stdlib@go1.16.12
1.26.9
1
ghcr.io/dysnix/docker-bitcoind:0.29.0490ca8e3dd21
stdlib@go1.22.2
1.26.9
1
ghcr.io/edgelesssys/continuum/continuum-proxy24c76f294a80
golang.org/x/net@v0.32.0
stdlib@go1.23.3
0.60.0
1.26.9
1
ghcr.io/edgelesssys/coordinator:v0.5.0bcd5b8d4c45c
golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781
stdlib@go1.16.7
0.60.0
1.26.9
1
ghcr.io/edgelesssys/marblerun/coordinator:v1.9.2e589db0d0a2c
golang.org/x/net@v0.58.0
stdlib@go1.26.1
0.60.0
1.26.9
1
ghcr.io/eenchev/prometheus-universal-exporter:1.6.0c7ffe36f13c6
golang.org/x/net@v0.59.0
0.60.0
1
ghcr.io/einstack/glide:0.0.1-alpineab3f7d0a1d50
golang.org/x/net@v0.19.0
stdlib@go1.21.6
0.60.0
1.26.9
1
ghcr.io/element-hq/ess-helm/matrix-tools:0.3.20eac0521be29
golang.org/x/net@v0.36.0
stdlib@go1.23.7
0.60.0
1.26.9
1
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
stdlib@go1.19.8
1.26.9
1
ghcr.io/eminaktas/kubedns-shepherd:v0.4.40a20e1b41740
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9
1
ghcr.io/eminaktas/oom-tracer:v0.1.0c90ca8389c87
golang.org/x/net@v0.38.0
stdlib@go1.25.1
0.60.0
1.26.9
1
ghcr.io/emissary-ingress/emissary:4.1.04a981156abee
golang.org/x/net@v0.50.0
stdlib@go1.24.13
0.60.0
1.26.9
1
ghcr.io/emqx/emqx-operator:2.3.378d1c5eacebd
golang.org/x/net@v0.47.0
stdlib@go1.24.13
0.60.0
1.26.9
1
ghcr.io/ente/server:0472c929b6070e61fecaf2013d47efce2dcda462f646b68a1b8d
golang.org/x/net@v0.56.0
stdlib@go1.26.4
0.60.0
1.26.9
1
ghcr.io/eosc-lot-1/logrotate:3-alpineb0e20d200f89
stdlib@go1.22.4
1.26.9
1
ghcr.io/epinio/epinio-ui:v1.7.1-0.0.1d3de52dfb0b4
golang.org/x/net@v0.0.0-20220826154423-83b083e8dc8b
stdlib@go1.20
0.60.0
1.26.9
1
ghcr.io/eraser-dev/eraser-manager:v1.4.2cda6025d1152
golang.org/x/net@v0.56.0
stdlib@go1.26.5
0.60.0
1.26.9
1
ghcr.io/erikmagkekse/btrfs-nfs-csi:0.12.0cb29d9b801a5
golang.org/x/net@v0.58.0
stdlib@go1.26.7
0.60.0
1.26.9
1

syft 1.42.1 · advisories as of 13 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.