GO-2026-6225
UnscoredAdvisory
Published 18 Aug 2026In the index since 5 Sept 2026
- Severity
- Unscored
- worst across findings
- CVSS
- —
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 61
- of 17,781 indexed, latest versions
- Container images
- 54
- deployed by those charts
- Fix available
- None
- affected package
Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env
Carried by container images the latest versions of 61 of 17,781 indexed charts deploy, on 54 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v0.0.0-20220119192733-fe33c00cee21, v0.0.0-20220327082430-c57b701bfc08, v0.0.0-20221002210726-e883f69e0206, v0.0.0-20221129204813-6a4d6ed5d396+1 more | no fix listed | 54 |
- OSV records
- GO-2026-6225
Charts affected
61 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| redhat-trusted-application-pipelineopenshift | 1.0.2 | 1 of 2See more | 8,599 |
| voyager-gatewayopenshift | 2026.1.15 | 1 of 2See more | 2,567 |
| osdfir-infrastructureosdfir-infrastructureVerified publisher | 2.15.0 | 1 of 40See more | 71,208 |
| piggy-webhookspiggyVerified publisher | 0.7.5 | 1 of 1See more | 504 |
| argo-workflowsquench-argo-workflowsVerified publisher | 0.0.2 | 1 of 1See more | 8 |
| crossplanequench-crossplaneVerified publisher | 0.0.3 | 1 of 1See more | 8 |
| kyvernoquench-kyvernoVerified publisher | 0.0.1 | 1 of 2See more | 342 |
| rancher-auto-registerrancher-auto-registerVerified publisher | 0.1.0 | 1 of 1See more | 1,837 |
| argo-workflowromholdings | 0.1.6 | 1 of 1See more | 1,580 |
| sigstore-probersigstoreVerified publisher | 0.3.1 | 1 of 1See more | 424 |
| projectsveltossveltosVerified publisher | 1.15.0 | 1 of 11See more | 72 |
Container images carrying it
54 by charts deploying them
A fixed version is listed for 0 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| quay.io/ | c46aa0ded8ed | github.com/ | no fix listed | 1 |
| quay.io/ | 58651dce3376 | github.com/ | no fix listed | 1 |
| quay.io/ | 7b4202c25b67 | github.com/ | no fix listed | 1 |
| registry.gitlab.com/ | 9b9d1ed86b6a | github.com/ | no fix listed | 1 |