StackRadar

GO-2026-5884

Medium

Advisory

Published 1 Jul 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
109
of 17,781 indexed, latest versions
Container images
105
deployed by those charts
Fix available
1 of 1
affected package

ORAS Go forwards registry credentials across registry redirects

Carried by container images the latest versions of 109 of 17,781 indexed charts deploy, on 105 images.

Affected packageAffected versionsFixed inImages
oras.land/oras-go/v2golangv2.0.0, v2.0.2, v2.2.0, v2.3.0+4 more2.6.1105
OSV records
GHSA-vh4v-2xq2-g5cgGO-2026-5884

Charts affected

109 by stars
ChartLatestAffected imagesRadar Score
harborharborOfficialVerified publisher1.19.21 of 8See more

harbor harbor 1.19.2

1 of the 8 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,650
artifact-hubartifact-hubVerified publisher1.23.03 of 7See more

artifact-hub artifact-hub 1.23.0

3 of the 7 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
aquasec/trivy:0.69.3bcc376de8d77
oras.land/oras-go/v2@v2.6.0
2.6.1
artifacthub/scanner:v1.23.02d8365601f0e
oras.land/oras-go/v2@v2.6.0
2.6.1
artifacthub/tracker:v1.23.05368d21a6e5c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

10,755
falcofalcosecurity9.1.02 of 3See more

falco falcosecurity 9.1.0

2 of the 3 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
falcosecurity/falco-driver-loader:0.44.17df783d5269a
oras.land/oras-go/v2@v2.6.0
2.6.1
falcosecurity/falcoctl:0.13.00eeb79adc580
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

5,227
chaos-meshchaos-meshVerified publisher2.8.41 of 4See more

chaos-mesh chaos-mesh 2.8.4

1 of the 4 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-mesh:v2.8.49e48285bb44c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

6,342
atlantisatlantis6.15.01 of 1See more

atlantis atlantis 6.15.0

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/runatlantis/atlantis:v0.47.1511231955463
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,891
mesherymesheryOfficialVerified publisher1.0.691 of 1See more

meshery meshery 1.0.69

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
meshery/meshery:stable-latest9b68e81d392e
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,407
semaphoresemaphoreuiOfficialVerified publisher16.2.21 of 1See more

semaphore semaphoreui 16.2.2

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
semaphoreui/semaphore:v2.18.3e9260bfa8255
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

2,221
pulsarapache4.7.01 of 10See more

pulsar apache 4.7.0

1 of the 10 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

9,864
argocdnicklasfrahm-argocdVerified publisher0.3.01 of 2See more

argocd nicklasfrahm-argocd 0.3.0

1 of the 2 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

5,240
ansible-semaphorecloudhippieVerified publisher15.2.101 of 1See more

ansible-semaphore cloudhippie 15.2.10

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
semaphoreui/semaphore:v2.19.1498ad9bc7a2a0
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,235
openclawopenclawVerified publisher1.91.31 of 2See more

openclaw openclaw 1.91.3

1 of the 2 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/helm-openclaw/openclaw:1.91.3ed44d81a65de
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

2,977
devtron-operatordevtron0.23.33 of 11See more

devtron-operator devtron 0.23.3

3 of the 11 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
quay.io/devtron/chart-sync:3b3d6d0e-836-39296721b5c9634d4
oras.land/oras-go/v2@v2.6.0
2.6.1
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
oras.land/oras-go/v2@v2.6.0
2.6.1
quay.io/devtron/kubelink:09867a9c-564-39289ea6dd1e4ce71
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

32,902
gatekeepergogatekeeperVerified publisher0.1.641 of 1See more

gatekeeper gogatekeeper 0.1.64

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
quay.io/gogatekeeper/gatekeeper:4.9.0dcf583aba224
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

553
meshery-operatormesheryOfficialVerified publisher1.0.691 of 2See more

meshery-operator meshery 1.0.69

1 of the 2 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
alpine/k8s:1.35.6b7a12c5ddf26
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

2,415
alloy-operatorgrafana0.7.11 of 1See more

alloy-operator grafana 0.7.1

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/grafana/alloy-operator:1.12.14ee4b71cf16a
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

401
gateway-operatorkongOfficialVerified publisher0.6.11 of 1See more

gateway-operator kong 0.6.1

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
kong/gateway-operator:1.603510967482b
oras.land/oras-go/v2@v2.5.1-0.20250331092043-d0ac8e455584
2.6.1

Open the chart page →

842
local-ailocalai3.4.21 of 1See more

local-ai localai 3.4.2

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
quay.io/go-skynet/local-ai:latestd78cd113b2bc
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

3,997
steampipe-powerpipe-kubernetessteampipe-powerpipe-kubernetesVerified publisher0.13.12 of 2See more

steampipe-powerpipe-kubernetes steampipe-powerpipe-kubernetes 0.13.1

2 of the 2 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--powerpipe:latesta16ab5ca10a7
oras.land/oras-go/v2@v2.5.0
2.6.1
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--steampipe:latestc0c8d53df9f3
oras.land/oras-go/v2@v2.5.0
2.6.1

Open the chart page →

5,468
headscaleheadscaleVerified publisher1.0.191 of 3See more

headscale headscale 1.0.19

1 of the 3 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
alpine/k8s:1.36.244ef4942e171
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

3,383
kubevpnkubevpn-charts2.11.71 of 1See more

kubevpn kubevpn-charts 2.11.7

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/kubenetworks/kubevpn:v2.11.7cce8ff866f60
oras.land/oras-go/v2@v2.5.0
2.6.1

Open the chart page →

1,596
vcluster-platformloftVerified publisher4.12.01 of 1See more

vcluster-platform loft 4.12.0

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-platform:4.12.0ef92da4621e6
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

744
move2kubemove2kube0.3.151 of 1See more

move2kube move2kube 0.3.15

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
oras.land/oras-go/v2@v2.2.0
2.6.1

Open the chart page →

3,793
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/opa:1.12.084fb1af7401c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

107,811
platzioplatz-ioVerified publisher0.6.51 of 2See more

platzio platz-io 0.6.5

1 of the 2 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
platzio/backend:v0.6.5d5e5972f344b
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

2,866
topaztopaz0.2.51 of 1See more

topaz topaz 0.2.5

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/aserto-dev/topaz:0.32.594c708ecf7dc4
oras.land/oras-go/v2@v2.5.0
2.6.1

Open the chart page →

1,494
argocdtwomartensVerified publisher0.1.11 of 3See more

argocd twomartens 0.1.1

1 of the 3 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.8.6acaf37352569
oras.land/oras-go/v2@v2.2.0
2.6.1

Open the chart page →

10,315
vaultvaultVerified publisher1.22.01 of 4See more

vault vault 1.22.0

1 of the 4 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
alpine/k8s:1.35.5d870622d0040
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

4,243
upcloud-csiankra-chartsVerified publisher0.4.01 of 8See more

upcloud-csi ankra-charts 0.4.0

1 of the 8 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
alpine/k8s:1.31.137a319b15cfc9
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

14,917
scannerappscodeVerified publisher2026.1.151 of 3See more

scanner appscode 2026.1.15

1 of the 3 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/appscode/trivydb:0.0.367ffb0309acb
oras.land/oras-go/v2@v2.0.2
2.6.1

Open the chart page →

5,299
argocd-rbac-operatorargocd-rbac-operator0.4.51 of 1See more

argocd-rbac-operator argocd-rbac-operator 0.4.5

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-rbac-operator:v0.2.451dded00137a
oras.land/oras-go/v2@v2.5.0
2.6.1

Open the chart page →

954
argocd-source-trackercableship0.0.91 of 1See more

argocd-source-tracker cableship 0.0.9

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/cableship/argocd-source-tracker:0.0.6ff7dd45aa774
oras.land/oras-go/v2@v2.5.0
2.6.1

Open the chart page →

1,483
chart-sentinelcableship0.0.121 of 1See more

chart-sentinel cableship 0.0.12

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/cableship/chart-sentinel:0.1.0a037f1042b28
oras.land/oras-go/v2@v2.5.0
2.6.1

Open the chart page →

1,483
finops-stackcert-managerVerified publisher0.0.56 of 12See more

finops-stack cert-manager 0.0.5

6 of the 12 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/kyverno/background-controller:v1.12.506ed5db6cd33
oras.land/oras-go/v2@v2.3.1
2.6.1
ghcr.io/kyverno/cleanup-controller:v1.12.5b914032ef9ad
oras.land/oras-go/v2@v2.3.1
2.6.1
ghcr.io/kyverno/kyverno:v1.12.5a61c7022abcf
oras.land/oras-go/v2@v2.3.1
2.6.1
ghcr.io/kyverno/kyverno-cli:v1.12.5832a32779e6d
oras.land/oras-go/v2@v2.3.1
2.6.1
ghcr.io/kyverno/kyvernopre:v1.12.563f7eaf5aa8a
oras.land/oras-go/v2@v2.3.1
2.6.1
ghcr.io/kyverno/reports-controller:v1.12.5c62e3347611c
oras.land/oras-go/v2@v2.3.1
2.6.1

Open the chart page →

12,562
cloudttycloudtty0.8.91 of 2See more

cloudtty cloudtty 0.8.9

1 of the 2 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/cloudtty/cloudshell:v0.8.900984ba0f0eb
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

3,951
cluster-setupcluster-setup1.5.01 of 8See more

cluster-setup cluster-setup 1.5.0

1 of the 8 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
oras.land/oras-go/v2@v2.5.0
2.6.1

Open the chart page →

10,037
developer-operatordeveloper-operatorVerified publisher2.1.21 of 1See more

developer-operator developer-operator 2.1.2

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/developer-operator/developer-operator-controller:2.1.2301847adfe16
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,828
kdiffkdiff-snapshotsVerified publisher0.0.2031 of 2See more

kdiff kdiff-snapshots 0.0.203

1 of the 2 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.2035bc5ca66d55a
oras.land/oras-go/v2@v2.5.0
2.6.1

Open the chart page →

5,508
kdiff-snapshotskdiff-snapshotsVerified publisher0.0.551 of 1See more

kdiff-snapshots kdiff-snapshots 0.0.55

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.55d7f93d2182fe
oras.land/oras-go/v2@v2.5.0
2.6.1

Open the chart page →

5,789
kubescoutkubescouteVerified publisher0.1.11 of 1See more

kubescout kubescoute 0.1.1

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/haedalwang/kubescout:0.1.107d51f838f0d
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

714
mesherykubesphere-stable0.5.01 of 13See more

meshery kubesphere-stable 0.5.0

1 of the 13 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
layer5/meshery:stable-latest78a8be21bef3
oras.land/oras-go/v2@v2.5.0
2.6.1

Open the chart page →

24,690
kubetailkubetailVerified publisher0.26.01 of 3See more

kubetail kubetail 0.26.0

1 of the 3 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/kubetail-org/kubetail-dashboard:0.17.08617f0a7f703
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

1,850
periscopeperiscopeVerified publisher1.1.61 of 1See more

periscope periscope 1.1.6

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/gnana997/periscope:1.1.621b284fb00f2
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

800
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

8,158
accounts-uiappscodeVerified publisher2026.9.111 of 1See more

accounts-ui appscode 2026.9.11

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

2,592
aceappscodeVerified publisher2026.9.111 of 2See more

ace appscode 2026.9.11

1 of the 2 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

2,894
ace-installerappscodeVerified publisher2026.9.111 of 2See more

ace-installer appscode 2026.9.11

1 of the 2 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

3,225
ace-installer-certifiedappscodeVerified publisher2026.9.111 of 2See more

ace-installer-certified appscode 2026.9.11

1 of the 2 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

3,225
billingappscodeVerified publisher2026.9.111 of 1See more

billing appscode 2026.9.11

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

2,592
fargocdappscodeVerified publisher2026.5.221 of 1See more

fargocd appscode 2026.5.22

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/appscode/fargocd:v0.0.31f5c791fc54d
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

446
fargocd-managerappscodeVerified publisher2026.5.221 of 1See more

fargocd-manager appscode 2026.5.22

1 of the 1 container images this version deploys carry GO-2026-5884.

Container imageDigestPackageFixed in
ghcr.io/appscode/fargocd:v0.0.31f5c791fc54d
oras.land/oras-go/v2@v2.6.0
2.6.1

Open the chart page →

446

Container images carrying it

105 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/opsmxpublic/opa:1.12.084fb1af7401c
oras.land/oras-go/v2@v2.6.0
oras.land/oras-go/v2@v2.6.0
2.6.1
2.6.1
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
oras.land/oras-go/v2@v2.3.0
oras.land/oras-go/v2@v2.3.0
2.6.1
2.6.1
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
oras.land/oras-go/v2@v2.6.0
oras.land/oras-go/v2@v2.6.0
2.6.1
2.6.1
1
registry.gitlab.com/xrow-public/developer-operator/developer-operator-controller:2.1.2301847adfe16
oras.land/oras-go/v2@v2.6.0
oras.land/oras-go/v2@v2.6.0
2.6.1
2.6.1
1
registry.gitlab.com/xrow-public/helm-openclaw/openclaw:1.91.3ed44d81a65de
oras.land/oras-go/v2@v2.6.0
oras.land/oras-go/v2@v2.6.0
2.6.1
2.6.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.