Skip to content
OpenAdvisories
High · 7.0 CVE-2025-68119 BIT-golang-2025-68119EUVD-2025-206446GHSA-cm6p-qc7v-m3jwGO-2026-4338

Unexpected code execution when invoking toolchain in cmd/go

Published Jan 28, 2026 · Updated Feb 26, 2026 · Assigned by Go

Vendor: Go toolchain Product: cmd/go Package: aactl Package: actions-runner-controller Package: age Package: amass Package: amazon-cloudwatch-agent-operator Package: apache-exporter Package: authservice Package: aws-eks-pod-identity-agent Package: aws-flb-cloudwatch Package: aws-flb-kinesis Package: aws-privateca-issuer Package: aws-signer-notation-plugin Package: aws-sigv4-proxy Package: azcopy Package: azure-ipam Package: azure-ipam-dropgz Package: azure-service-operator Package: azure-workload-identity-webhook Package: bank-vaults-template Package: bento Package: blobfuse2 Package: bom Package: boring-registry Package: calico-app-policy-3.31 Package: calico-felix-3.31 Package: calicoctl-3.31 Package: capslock Package: cargobump Package: cass-operator Package: cert-manager-cmctl Package: cert-manager-istio-csr Package: cfssl Package: cfssl-bundle Package: chart-testing Package: chisel Package: cilium-cli Package: clickhouse-operator-metrics-exporter Package: cloud-provider-aws-1.31-cloud-controller-manager Package: cloud-provider-vsphere Package: cluster-api-gcp-controller Package: cluster-api-ipam-provider-in-cluster Package: confluent-cp-docker-utils Package: conftest Package: conjur-cli Package: container-object-storage-interface-controller Package: container-object-storage-interface-sidecar Package: cortex Package: cosign Package: critest Package: croc Package: crossplane-provider-aws-cloudformation Package: crossplane-provider-aws-cloudfront Package: crossplane-provider-aws-cloudwatchlogs Package: crossplane-provider-aws-dynamodb Package: crossplane-provider-aws-ec2 Package: crossplane-provider-aws-elasticache Package: crossplane-provider-aws-firehose Package: crossplane-provider-aws-iam Package: crossplane-provider-aws-kinesis Package: crossplane-provider-aws-lambda Package: crossplane-provider-aws-rds Package: crossplane-provider-aws-s3 Package: crossplane-provider-aws-sns Package: crossplane-provider-azure-sql Package: crossplane-provider-family-aws Package: crossplane-provider-sql Package: ctop Package: custom-pod-autoscaler Package: dask-gateway-server Package: db-operator Package: dbmate Package: descheduler Package: dex Package: dkron Package: dkron-executor-grpc Package: dkron-executor-nats Package: dkron-executor-rabbitmq Package: dkron-processor-fluent Package: dkron-processor-log Package: dkron-processor-syslog Package: docker-credential-ecr-login Package: docker-credential-gcr Package: docker-machine-driver-linode Package: dockerd-28 Package: dockerize Package: doppler-kubernetes-operator Package: dynamic-localpv-provisioner Package: eksctl Package: esbuild Package: extism Package: falcosidekick Package: ferretdb Package: fixuid Package: flannel Package: flux-image-automation-controller Package: flux-kustomize-controller Package: flux-notification-controller Package: fluxcd-kustomize-mutating-webhook Package: frp Package: fuse-overlayfs-snapshotter Package: fzf Package: gatus Package: ghaudit Package: git-credential-oauth Package: git-lfs Package: git-sync Package: gitlab-docker-machine-18.7 Package: gitlab-runner-helper-18.7 Package: gitleaks Package: gitness Package: gke-gcloud-auth-plugin Package: go Package: go-jsonnet Package: go-licenses Package: go-md2man Package: gobuster Package: gogatekeeper Package: golang Package: golang-1.10 Package: golang-1.13 Package: golang-1.14 Package: golang-1.16 Package: golang-1.17 Package: golang-1.18 Package: golang-1.19 Package: golang-1.20 Package: golang-1.21 Package: golang-1.22 Package: golang-1.23 Package: golang-1.24 Package: golang-1.24 Package: golang-1.25 Package: golang-1.6 Package: golang-1.8 Package: golang-1.9 Package: golangci-lint Package: goreleaser Package: gostatsd Package: gosu Package: govulncheck Package: gptscript Package: grafana-operator Package: grafana-rollout-operator Package: grpcurl Package: guac Package: guaccsub Package: guacgql Package: guacingest Package: guacone Package: harbor-registry Package: headlamp Package: helm-3 Package: helm-docs Package: helm-operator Package: helm-set-status Package: hey Package: hivemind Package: http-echo Package: hubble Package: hubble-ui-backend Package: hydra Package: influx Package: ingress-nginx-controller-1.12 Package: ini-file Package: ip-masq-agent Package: ipfs-cluster Package: jaeger-2-anonymizer Package: jaeger-2-es-index-cleaner Package: jaeger-2-es-rollover Package: jaeger-2-esmapping-generator Package: jaeger-2-jaeger Package: jaeger-2-remote-storage Package: jaeger-2-tracegen Package: juicefs-1.3 Package: k3d Package: k3d-proxy Package: k3d-tools Package: k3s Package: k3s-multicall Package: k3s-static Package: k8s_gateway Package: kapp Package: kapp-controller Package: kbld Package: kine Package: kor Package: kratos Package: kratos-protoc-gen Package: kserve-modelmesh-serving Package: ksops Package: kube-bench Package: kube-logging-operator Package: kube-logging-operator-config-reloader Package: kube-logging-operator-custom-runner Package: kube-vip-cloud-provider Package: kubecolor Package: kubeflow-access-management Package: kubeflow-pipelines-apiserver Package: kubeflow-pipelines-cache_server Package: kubeflow-pipelines-persistence_agent Package: kubeflow-pipelines-scheduledworkflow Package: kubeflow-pipelines-viewer-crd-controller Package: kubeflow-profile-controller Package: kubelet-csr-approver Package: kuberay-operator Package: kuberlr Package: kubernetes-csi-driver-hostpath Package: kubernetes-csi-driver-nfs Package: kubernetes-csi-external-attacher Package: kubernetes-csi-external-provisioner Package: kubernetes-csi-external-resizer Package: kubernetes-csi-livenessprobe Package: kubernetes-dashboard Package: kubernetes-dashboard-api Package: kubernetes-dashboard-metrics-scraper Package: kubernetes-dns-node-cache Package: kubernetes-event-exporter Package: kubernetes-release-go-runner Package: kubernetes-replicator Package: kubescape-operator Package: kubo Package: kuma-cni-2.12 Package: kuma-cni-2.13 Package: kuma-cp-2.12 Package: kuma-dp-2.12 Package: kuma-dp-2.13 Package: kuma-install-cni-2.12 Package: kuma-install-cni-2.13 Package: kustomize Package: kyverno-policy-reporter-kyverno-plugin Package: kyverno-policy-reporter-ui Package: langfuse-3 Package: langfuse-3-worker Package: lazygit Package: licenseclassifier Package: linkerd2-proxy-init Package: litefs Package: litestream Package: local-path-provisioner Package: local-static-provisioner Package: lvm-driver Package: mage Package: manifest-tool Package: maru Package: mattermost-11.1 Package: mc Package: mesosphere-vsphere-csi-driver Package: mesosphere-vsphere-csi-syncer Package: metacontroller Package: metallb Package: metallb-controller Package: metallb-cp-tool Package: metallb-frr-compat Package: minio Package: minio-object-browser Package: minio-operator Package: minio-operator-sidecar Package: mkcert Package: mockgen Package: mods Package: mongodb-kubernetes-operator-version-upgrade-post-start-hook Package: msft-golang Package: nats-server-config-reloader Package: nats-top Package: nerdctl Package: neuvector-sigstore-interface Package: newrelic-fluent-bit-output Package: newrelic-infra-operator Package: newrelic-nri-statsd Package: nfs-subdir-external-provisioner Package: nginx-prometheus-exporter Package: nri-cassandra Package: nri-couchbase Package: nri-f5 Package: nri-haproxy Package: nri-jmx Package: nri-memcached Package: nri-mongodb Package: nri-nagios Package: nri-nginx Package: nri-postgresql Package: nri-rabbitmq Package: nri-redis Package: octo-sts Package: octo-sts-webhook Package: openbao-k8s Package: opencost Package: opensearch-k8s-operator Package: opentofu-1.9 Package: osv-scanner Package: paranoia Package: percona-server-mongodb-operator Package: percona-server-mongodb-operator-mongodb-healthcheck Package: petname Package: pg_timetable Package: pg_user Package: pgpool2_exporter Package: podcli Package: policy-controller Package: policy-controller-tester Package: postgres-operator Package: protoc-gen-go Package: protoc-gen-go-grpc Package: pvc-autoresizer Package: rabbitmq-cluster-operator Package: rabbitmq-default-user-credential-updater Package: rabbitmq-messaging-topology-operator Package: rancher-helm-3 Package: rancher-loglevel Package: rancher-machine Package: rancher-system-agent Package: rancher-system-upgrade-controller Package: rancher-telemetry Package: ratify Package: ratify-licensechecker Package: ratify-sbom Package: ratify-schemavalidator Package: ratify-vulnerabilityreport Package: redis-operator Package: redka Package: restic Package: runc Package: s5cmd Package: sbom-convert Package: sbom-scorecard Package: sbomqs Package: scorecard Package: sealed-secrets Package: sealed-secrets-kubeseal Package: secrets-store-csi-driver Package: secrets-store-csi-driver-provider-aws Package: sftpgo-plugin-auth Package: sftpgo-plugin-geoipfilter Package: sftpgo-plugin-kms Package: sftpgo-plugin-pubsub Package: slsa-verifier Package: sonobuoy Package: sops Package: spark-operator Package: spegel Package: spire-agent Package: spire-controller-manager Package: spire-oidc-discovery-provider Package: spire-server Package: spqr Package: src Package: src-fingerprint Package: sriov-network-device-plugin Package: stakater-reloader Package: steampipe Package: step Package: step-kms-plugin Package: swagger Package: temporal-ui-server Package: terraform Package: terraform-docs Package: terraform-mcp-server Package: terraform-provider-pagerduty Package: terraform-provider-time Package: tetra Package: tetragon-operator Package: tfsec Package: thanos-operator Package: timescaledb-parallel-copy Package: timescaledb-tune Package: timoni Package: tofu-controller Package: tofu-controller-runner Package: toolchain Package: traefik-3.6 Package: undock Package: vale Package: vault-benchmark Package: vault-k8s Package: vault-secrets-webhook Package: vertical-pod-autoscaler Package: vertical-pod-autoscaler-recommender Package: vertical-pod-autoscaler-updater Package: volume-modifier-for-k8s Package: wave Package: wazero Package: wgcf Package: whereabouts Package: wire-go Package: wuzz Package: x509-certificate-exporter Package: xcaddy Package: xeol Package: yace Package: ytt Package: yunikorn-k8shim Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external VCS commands are constructed. This issue can also be triggered by providing a malicious version string to the toolchain. On systems with Git installed, downloading and building modules with malicious version strings can allow an attacker to write to arbitrary files on the filesystem. This can only be triggered by explicitly providing the malicious version strings to the toolchain and does not affect usage of @latest or bare module paths.

Affected products

VendorProductAffectedFixed
Go toolchain cmd/go 1.25.0 – < 1.25.6 1.25.6

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 13 golang-1.24 No fix yet —
Debian 12 golang-1.19 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS golang-1.23 +2 No fix yet —
Ubuntu 25.10 golang-1.23 +2 No fix yet —
Ubuntu 24.04 LTS golang-1.21 +4 No fix yet —
Ubuntu 22.04 LTS golang-1.17 +7 No fix yet —
Ubuntu 20.04 LTS golang-1.13 +5 No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS golang-1.8 +2 No fix yet —
Ubuntu 16.04 LTS golang-1.6 +1 No fix yet —
Ubuntu 14.04 LTS golang-1.10 No fix yet —
Ubuntu Pro 22.04 LTS golang-1.13 No fix yet —
Ubuntu Pro 20.04 LTS golang-1.16 No fix yet —
Ubuntu Pro 18.04 LTS golang-1.13 +2 No fix yet —
Ubuntu Pro 16.04 LTS golang-1.13 +1 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 golang1.25 +6 1.25.9-1.hum1 RHSA-2026:7385
Red Hat Hardened Images 1 golang1.26 +6 1.26.2-1.hum1 RHSA-2026:7291

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0426-1, SUSE-SU-2026:0219-1
SLES 15 SP7 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0789-1, SUSE-SU-2026:0308-1
SLES 15 SP7 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES 15 SP7 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
SLES 15 SP6 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0426-1, SUSE-SU-2026:0219-1
SLES 15 SP6 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0789-1, SUSE-SU-2026:0308-1
SLES 15 SP6 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES 15 SP6 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
SLES 15 SP5 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0426-1, SUSE-SU-2026:0219-1
SLES 15 SP5 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0687-1, SUSE-SU-2026:0296-1
SLES 15 SP5 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES 15 SP5 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES 15 SP4 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0426-1, SUSE-SU-2026:0219-1
SLES 15 SP4 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0687-1, SUSE-SU-2026:0296-1
SLES 15 SP4 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES 15 SP4 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 go1.24 1.24.12-160000.1.1 SUSE-SU-2026:20429-1, SUSE-SU-2026:20122-1
SLES for SAP 16.0 go1.24-openssl 1.24.13-160000.1.1 SUSE-SU-2026:20629-1
SLES for SAP 16.0 go1.25 1.25.6-160000.1.1 SUSE-SU-2026:20132-1
SLES for SAP 16.0 go1.25-openssl 1.25.7-160000.1.1 SUSE-SU-2026:20623-1
SLES for SAP 15 SP6 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0426-1, SUSE-SU-2026:0219-1
SLES for SAP 15 SP6 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0789-1, SUSE-SU-2026:0308-1
SLES for SAP 15 SP6 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES for SAP 15 SP6 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
SLES for SAP 15 SP5 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0426-1, SUSE-SU-2026:0219-1
SLES for SAP 15 SP5 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0687-1, SUSE-SU-2026:0296-1
SLES for SAP 15 SP5 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES for SAP 15 SP5 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES for SAP 15 SP4 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0426-1, SUSE-SU-2026:0219-1
SLES for SAP 15 SP4 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0687-1, SUSE-SU-2026:0296-1
SLES for SAP 15 SP4 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLES for SAP 15 SP4 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLES 16.0 go1.24 1.24.12-160000.1.1 SUSE-SU-2026:20429-1, SUSE-SU-2026:20122-1
SLES 16.0 go1.24-openssl 1.24.13-160000.1.1 SUSE-SU-2026:20629-1
SLES 16.0 go1.25 1.25.6-160000.1.1 SUSE-SU-2026:20132-1
SLES 16.0 go1.25-openssl 1.25.7-160000.1.1 SUSE-SU-2026:20623-1
SLE HPC 15 SP5 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0426-1, SUSE-SU-2026:0219-1
SLE HPC 15 SP5 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0687-1, SUSE-SU-2026:0296-1
SLE HPC 15 SP5 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLE HPC 15 SP5 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1
SLE HPC 15 SP4 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0426-1, SUSE-SU-2026:0219-1
SLE HPC 15 SP4 go1.24-openssl 1.24.12-150000.1.18.1 SUSE-SU-2026:0687-1, SUSE-SU-2026:0296-1
SLE HPC 15 SP4 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
SLE HPC 15 SP4 go1.25-openssl 1.25.6-150000.1.9.1 SUSE-SU-2026:0297-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed coredns 1.14.1-1.1 openSUSE-SU-2026:10101-1
openSUSE Tumbleweed go1.24 1.24.12-1.1 openSUSE-SU-2026:10063-1
openSUSE Tumbleweed go1.25 1.25.6-1.1 openSUSE-SU-2026:10064-1
openSUSE Leap 16.0 coredns 1.14.2-bp160.1.1 openSUSE-SU-2026:20619-1
openSUSE Leap 16.0 go1.24 1.24.12-160000.1.1 openSUSE-SU-2026:20220-1, openSUSE-SU-2026:20077-1
openSUSE Leap 16.0 go1.24-openssl 1.24.13-160000.1.1 openSUSE-SU-2026:20308-1
openSUSE Leap 16.0 go1.25 1.25.6-160000.1.1 openSUSE-SU-2026:20085-1
openSUSE Leap 16.0 go1.25-openssl 1.25.7-160000.1.1 openSUSE-SU-2026:20301-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 go1.24 1.24.12-150000.1.53.1 SUSE-SU-2026:0426-1, SUSE-SU-2026:0219-1
openSUSE Leap 15.6 go1.24-openssl 1.24.12-150600.13.15.1 SUSE-SU-2026:0789-1, SUSE-SU-2026:0308-1
openSUSE Leap 15.6 go1.25 1.25.6-150000.1.26.1 SUSE-SU-2026:0218-1
openSUSE Leap 15.6 go1.25-openssl 1.25.6-150600.13.9.1 SUSE-SU-2026:0298-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20260128T190828-150000.1.143.1 SUSE-SU-2026:0354-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 go 1.25.6-r0 —
Alpine v3.23 go 1.25.6-r0 —
Alpine v3.22 go 1.24.12-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 amazon-ssm-agent 3.3.3883.0-1.amzn2023 ALAS2023-2026-1499
Amazon Linux 2023 golang +6 1.24.12-1.amzn2023.0.1 ALAS2023-2026-1381
Amazon Linux 2 amazon-ssm-agent 3.3.3883.0-1.amzn2 ALAS2-2026-3207
Amazon Linux 2 golang +6 1.24.12-1.amzn2.0.1 ALAS2-2026-3136

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 golang 1.24.12-1 —
Azure Linux 2 (CBL-Mariner) msft-golang 1.24.12-1 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aactl 0.4.12-r40 —
Wolfi rolling actions-runner-controller 0.13.1-r1 —
Wolfi rolling age 1.3.1-r1 —
Wolfi rolling amass 5.0.1-r4 —
Wolfi rolling amazon-cloudwatch-agent-operator 3.3.1-r1 —
Wolfi rolling apache-exporter 1.0.12-r1 —
Wolfi rolling authservice +1 1.1.5-r1 —
Wolfi rolling aws-eks-pod-identity-agent 0.1.36-r2 —
Wolfi rolling aws-flb-cloudwatch 1.9.4-r23 —
Wolfi rolling aws-flb-kinesis 1.10.3-r4 —
Wolfi rolling aws-privateca-issuer 1.8.0-r1 —
Wolfi rolling aws-signer-notation-plugin 1.0.2292-r5 —
Wolfi rolling aws-sigv4-proxy 1.11-r1 —
Wolfi rolling azcopy 10.31.1-r1 —
Wolfi rolling azure-ipam +1 0.4.0-r8 —
Wolfi rolling azure-service-operator 2.17.0-r1 —
Wolfi rolling azure-workload-identity-webhook 1.5.1-r6 —
Wolfi rolling bank-vaults-template 1.32.1-r1 —
Wolfi rolling bento +3 1.14.1-r1 —
Wolfi rolling blobfuse2 2.4.2-r8 —
Wolfi rolling bom 0.7.1-r4 —
Wolfi rolling boring-registry 0.16.6-r5 —
Wolfi rolling calicoctl-3.31 +2 3.31.3-r2 —
Wolfi rolling capslock 0.3.1-r1 —
Wolfi rolling cargobump 0.1.0-r9 —
Wolfi rolling cass-operator 1.28.0-r3 —
Wolfi rolling cert-manager-cmctl 2.4.0-r2 —
Wolfi rolling cert-manager-istio-csr 0.15.0-r1 —
Wolfi rolling cfssl +1 1.6.5-r26 —
Wolfi rolling chart-testing 3.14.0-r3 —
Wolfi rolling chisel 1.11.3-r4 —
Wolfi rolling cilium-cli 0.19.0-r1 —
Wolfi rolling clickhouse-operator-metrics-exporter 0.25.6-r1 —
Wolfi rolling cloud-provider-aws-1.31-cloud-controller-manager 1.31.9-r2 —
Wolfi rolling cluster-api-gcp-controller 1.10.0-r7 —
Wolfi rolling cluster-api-ipam-provider-in-cluster 1.0.3-r4 —
Wolfi rolling confluent-cp-docker-utils 1.0.6-r1 —
Wolfi rolling conjur-cli 9.1.1-r1 —
Wolfi rolling container-object-storage-interface-sidecar +1 0.2.2-r1 —
Wolfi rolling cortex 1.20.1-r1 —
Wolfi rolling cosign 3.0.4-r2 —
Wolfi rolling critest +1 1.35.0-r1 —
Wolfi rolling croc 10.3.1-r2 —
Wolfi rolling crossplane-provider-aws-s3 +13 2.3.0-r3 —
Wolfi rolling crossplane-provider-azure-sql 2.3.0-r2 —
Wolfi rolling crossplane-provider-sql 0.13.0-r3 —
Wolfi rolling ctop 0.7.7-r30 —
Wolfi rolling custom-pod-autoscaler 2.12.2-r5 —
Wolfi rolling dask-gateway-server 2025.4.0-r7 —
Wolfi rolling db-operator 2.16.0-r4 —
Wolfi rolling dbmate 2.29.3-r1 —
Wolfi rolling descheduler 0.34.0-r3 —
Wolfi rolling dex 2.44.0-r8 —
Wolfi rolling dkron +6 4.0.9-r1 —
Wolfi rolling docker-credential-ecr-login 0.11.0-r2 —
Wolfi rolling docker-credential-gcr 2.1.31-r1 —
Wolfi rolling docker-machine-driver-linode 0.1.15-r9 —
Wolfi rolling dockerd-28 28.5.2-r13 —
Wolfi rolling dockerize 0.9.9-r1 —
Wolfi rolling doppler-kubernetes-operator 1.7.1-r3 —
Wolfi rolling dynamic-localpv-provisioner 4.4.0-r3 —
Wolfi rolling eksctl 0.221.0-r1 —
Wolfi rolling esbuild 0.27.2-r1 —
Wolfi rolling extism 1.6.3-r5 —
Wolfi rolling falcosidekick 2.32.0-r4 —
Wolfi rolling ferretdb 2.7.0-r3 —
Wolfi rolling fixuid 0.6.0-r6 —
Wolfi rolling flannel 0.28.0-r2 —
Wolfi rolling flux-image-automation-controller 1.0.4-r4 —
Wolfi rolling flux-kustomize-controller 1.7.3-r4 —
Wolfi rolling flux-notification-controller 1.7.5-r4 —
Wolfi rolling fluxcd-kustomize-mutating-webhook 0.7.0-r2 —
Wolfi rolling frp +1 0.66.0-r1 —
Wolfi rolling fuse-overlayfs-snapshotter 2.1.7-r2 —
Wolfi rolling fzf 0.67.0-r2 —
Wolfi rolling gatus 5.34.0-r1 —
Wolfi rolling ghaudit 0.4.0-r17 —
Wolfi rolling git-credential-oauth 0.17.2-r1 —
Wolfi rolling git-lfs 3.7.1-r3 —
Wolfi rolling git-sync 4.5.1-r1 —
Wolfi rolling gitlab-runner-helper-18.7 +1 18.7.2-r1 —
Wolfi rolling gitleaks 8.30.0-r2 —
Wolfi rolling gitness 3.3.0-r5 —
Wolfi rolling gke-gcloud-auth-plugin 0.1.0-r12 —
Wolfi rolling go-jsonnet 0.21.0-r3 —
Wolfi rolling go-licenses 2.0.1-r3 —
Wolfi rolling go-md2man 2.0.7-r6 —
Wolfi rolling gobuster 3.8.2-r5 —
Wolfi rolling gogatekeeper 4.4.0-r1 —
Wolfi rolling golangci-lint 2.8.0-r1 —
Wolfi rolling goreleaser 2.13.3-r2 —
Wolfi rolling gostatsd 28.3.0-r22 —
Wolfi rolling gosu 1.19-r3 —
Wolfi rolling govulncheck 1.1.4-r6 —
Wolfi rolling gptscript 0.9.8-r1 —
Wolfi rolling grafana-operator 5.21.4-r1 —
Wolfi rolling grafana-rollout-operator 0.33.0-r1 —
Wolfi rolling grpcurl 1.9.3-r10 —
Wolfi rolling guac +4 1.0.1-r4 —
Wolfi rolling harbor-registry 3.0.0-r14 —
Wolfi rolling headlamp 0.39.0-r1 —
Wolfi rolling helm-3 3.22.0-r0 —
Wolfi rolling helm-docs 1.14.2-r18 —
Wolfi rolling helm-operator 1.42.0-r4 —
Wolfi rolling helm-set-status 0.3.0-r9 —
Wolfi rolling hey 0.1.5-r1 —
Wolfi rolling hivemind 1.1.0-r13 —
Wolfi rolling http-echo 1.0.0-r20 —
Wolfi rolling hubble 1.18.5-r1 —
Wolfi rolling hubble-ui-backend 0.13.3-r4 —
Wolfi rolling hydra 25.4.0-r3 —
Wolfi rolling influx 2.7.5-r13 —
Wolfi rolling ingress-nginx-controller-1.12 1.12.8-r3 —
Wolfi rolling ini-file 1.4.9-r4 —
Wolfi rolling ip-masq-agent 2.12.0-r17 —
Wolfi rolling jaeger-2-jaeger +6 2.13.0-r3 —
Wolfi rolling juicefs-1.3 1.3.1-r3 —
Wolfi rolling k3d +2 5.8.3-r21 —
Wolfi rolling k3s +2 1.35.0.1-r2 —
Wolfi rolling k8s_gateway 1.6.2-r1 —
Wolfi rolling kapp 0.65.0-r3 —
Wolfi rolling kapp-controller 0.59.1-r2 —
Wolfi rolling kbld 0.47.0-r2 —
Wolfi rolling kine 0.14.11-r0 —
Wolfi rolling kor 0.6.7-r1 —
Wolfi rolling kratos +2 2.9.2-r1 —
Wolfi rolling kserve-modelmesh-serving 0.12.0-r19 —
Wolfi rolling ksops 4.4.0-r4 —
Wolfi rolling kube-bench 0.14.1-r1 —
Wolfi rolling kube-logging-operator +1 6.3.2-r1 —
Wolfi rolling kube-vip-cloud-provider 0.0.12-r8 —
Wolfi rolling kubecolor 0.5.3-r2 —
Wolfi rolling kubeflow-access-management +1 1.10.0-r11 —
Wolfi rolling kubeflow-pipelines-apiserver +4 2.15.0-r7 —
Wolfi rolling kubelet-csr-approver 1.2.12-r2 —
Wolfi rolling kuberay-operator 1.5.1-r2 —
Wolfi rolling kuberlr 0.6.1-r6 —
Wolfi rolling kubernetes-csi-driver-hostpath 1.17.0-r9 —
Wolfi rolling kubernetes-csi-driver-nfs 4.12.1-r4 —
Wolfi rolling kubernetes-csi-external-attacher 4.10.0-r4 —
Wolfi rolling kubernetes-csi-external-provisioner 6.1.0-r3 —
Wolfi rolling kubernetes-csi-external-resizer 2.0.0-r3 —
Wolfi rolling kubernetes-csi-livenessprobe 2.17.0-r3 —
Wolfi rolling kubernetes-dashboard 7.14.0-r3 —
Wolfi rolling kubernetes-dashboard-api 1.14.0-r2 —
Wolfi rolling kubernetes-dashboard-metrics-scraper 1.2.2-r15 —
Wolfi rolling kubernetes-dns-node-cache 1.26.7-r6 —
Wolfi rolling kubernetes-event-exporter 1.7-r50 —
Wolfi rolling kubernetes-release-go-runner 0.18.0-r7 —
Wolfi rolling kubernetes-replicator 2.12.2-r2 —
Wolfi rolling kubescape-operator 0.2.121-r1 —
Wolfi rolling kubo 0.39.0-r2 —
Wolfi rolling kuma-cp-2.12 +3 2.12.3-r4 —
Wolfi rolling kuma-dp-2.13 +2 2.13.0-r1 —
Wolfi rolling kustomize 5.8.0-r2 —
Wolfi rolling kyverno-policy-reporter-kyverno-plugin 1.6.4-r15 —
Wolfi rolling kyverno-policy-reporter-ui 2.5.1-r1 —
Wolfi rolling langfuse-3 +1 3.149.0-r1 —
Wolfi rolling lazygit 0.58.1-r1 —
Wolfi rolling licenseclassifier 2.0.0-r7 —
Wolfi rolling linkerd2-proxy-init 2.4.4-r1 —
Wolfi rolling litefs 0.5.14-r6 —
Wolfi rolling litestream 0.5.6-r1 —
Wolfi rolling local-path-provisioner 0.0.34-r1 —
Wolfi rolling local-static-provisioner 2.8.0-r7 —
Wolfi rolling lvm-driver 1.8.0-r2 —
Wolfi rolling mage 1.15.0-r19 —
Wolfi rolling manifest-tool 2.2.1-r4 —
Wolfi rolling maru 0.6.0-r7 —
Wolfi rolling mattermost-11.1 11.1.3-r1 —
Wolfi rolling mc 0.20250813.083541-r4 —
Wolfi rolling mesosphere-vsphere-csi-driver +1 3.5.0-r7 —
Wolfi rolling metacontroller 4.12.5-r3 —
Wolfi rolling metallb +3 0.15.3-r1 —
Wolfi rolling minio 0.20251015.172955-r3 —
Wolfi rolling minio-object-browser 2.0.4-r4 —
Wolfi rolling minio-operator +1 7.1.1-r8 —
Wolfi rolling mkcert 1.4.4-r20 —
Wolfi rolling mockgen 0.6.0-r3 —
Wolfi rolling mods 1.8.1-r6 —
Wolfi rolling mongodb-kubernetes-operator-version-upgrade-post-start-hook 0.13.0-r6 —
Wolfi rolling nats-server-config-reloader 0.21.1-r1 —
Wolfi rolling nats-top 0.6.3-r12 —
Wolfi rolling nerdctl 2.2.1-r2 —
Wolfi rolling neuvector-sigstore-interface 0_git20251212-r2 —
Wolfi rolling newrelic-fluent-bit-output 3.3.0-r1 —
Wolfi rolling newrelic-infra-operator 0.26.4-r1 —
Wolfi rolling newrelic-nri-statsd 2.12.0-r3 —
Wolfi rolling nfs-subdir-external-provisioner 4.0.18-r28 —
Wolfi rolling nri-cassandra 2.16.1-r1 —
Wolfi rolling nri-couchbase 2.8.4-r1 —
Wolfi rolling nri-haproxy 3.2.4-r1 —
Wolfi rolling nri-jmx 3.11.2-r1 —
Wolfi rolling nri-memcached 2.7.4-r1 —
Wolfi rolling nri-mongodb 2.10.2-r1 —
Wolfi rolling nri-nagios 2.11.4-r1 —
Wolfi rolling nri-nginx 3.6.4-r1 —
Wolfi rolling nri-postgresql 2.23.0-r1 —
Wolfi rolling nri-rabbitmq 2.15.4-r1 —
Wolfi rolling nri-redis 1.12.7-r1 —
Wolfi rolling octo-sts +1 0.5.4-r1 —
Wolfi rolling openbao-k8s 1.4.0-r43 —
Wolfi rolling opencost 1.119.1-r1 —
Wolfi rolling opensearch-k8s-operator 2.8.0-r6 —
Wolfi rolling opentofu-1.9 1.9.4-r5 —
Wolfi rolling osv-scanner 2.3.2-r1 —
Wolfi rolling paranoia 0.5.0-r2 —
Wolfi rolling percona-server-mongodb-operator +1 1.21.2-r1 —
Wolfi rolling petname 2.11-r19 —
Wolfi rolling pg_timetable 6.2.0-r4 —
Wolfi rolling pg_user 1.1.1-r4 —
Wolfi rolling pgpool2_exporter 1.2.2-r10 —
Wolfi rolling podcli 6.9.4-r1 —
Wolfi rolling policy-controller +2 0.14.0-r1 —
Wolfi rolling postgres-operator 1.15.1-r1 —
Wolfi rolling protoc-gen-go 1.36.11-r1 —
Wolfi rolling pvc-autoresizer 0.18.0-r3 —
Wolfi rolling rabbitmq-cluster-operator 2.19.0-r1 —
Wolfi rolling rabbitmq-default-user-credential-updater 1.0.10-r1 —
Wolfi rolling rabbitmq-messaging-topology-operator 1.18.2-r1 —
Wolfi rolling rancher-helm-3 3.19.0-r5 —
Wolfi rolling rancher-loglevel 0.1.6-r10 —
Wolfi rolling rancher-machine 0.15.0.138-r1 —
Wolfi rolling rancher-system-agent 0.3.14-r4 —
Wolfi rolling rancher-system-upgrade-controller 0.18.0-r2 —
Wolfi rolling rancher-telemetry 0.6.2-r8 —
Wolfi rolling ratify +4 1.4.0-r10 —
Wolfi rolling redis-operator 0.23.0-r1 —
Wolfi rolling redka 1.0.1-r0 —
Wolfi rolling restic +1 0.18.1-r4 —
Wolfi rolling runc 1.4.0-r2 —
Wolfi rolling s5cmd 2.3.0-r9 —
Wolfi rolling sbom-convert 0.0.7-r7 —
Wolfi rolling sbom-scorecard 0.0.7-r26 —
Wolfi rolling sbomqs 2.0.3-r2 —
Wolfi rolling scorecard 5.4.0-r3 —
Wolfi rolling sealed-secrets +1 0.34.0-r1 —
Wolfi rolling secrets-store-csi-driver 1.5.5-r1 —
Wolfi rolling secrets-store-csi-driver-provider-aws 2.1.1-r3 —
Wolfi rolling sftpgo-plugin-auth 1.0.13-r3 —
Wolfi rolling sftpgo-plugin-geoipfilter 1.0.11-r2 —
Wolfi rolling sftpgo-plugin-kms 1.0.16-r3 —
Wolfi rolling sftpgo-plugin-pubsub 1.0.15-r3 —
Wolfi rolling slsa-verifier 2.7.1-r7 —
Wolfi rolling sonobuoy 0.57.3-r13 —
Wolfi rolling sops 3.11.0-r4 —
Wolfi rolling spark-operator 2.4.0-r3 —
Wolfi rolling spegel 0.6.0-r2 —
Wolfi rolling spire-controller-manager 0.6.3-r4 —
Wolfi rolling spqr 2.9.0-r1 —
Wolfi rolling src 6.12.0-r2 —
Wolfi rolling src-fingerprint 0.19.0-r37 —
Wolfi rolling sriov-network-device-plugin 3.11.0-r1 —
Wolfi rolling stakater-reloader 1.4.12-r1 —
Wolfi rolling steampipe 2.3.4-r1 —
Wolfi rolling step 0.29.0-r1 —
Wolfi rolling step-kms-plugin 0.16.0-r1 —
Wolfi rolling swagger 0.33.1-r4 —
Wolfi rolling temporal-ui-server 2.44.1-r1 —
Wolfi rolling terraform 1.5.7-r37 —
Wolfi rolling terraform-docs 0.21.0-r1 —
Wolfi rolling terraform-mcp-server 0.3.3-r2 —
Wolfi rolling terraform-provider-pagerduty 3.30.9-r1 —
Wolfi rolling terraform-provider-time 0.13.1-r6 —
Wolfi rolling tetra +2 1.6.0-r2 —
Wolfi rolling tfsec 1.28.14-r10 —
Wolfi rolling thanos-operator 0.3.7-r37 —
Wolfi rolling timescaledb-parallel-copy 0.12.0-r1 —
Wolfi rolling timoni 0.25.2-r4 —
Wolfi rolling tofu-controller +1 0.16.0_rc5-r9 —
Wolfi rolling traefik-3.6 3.6.7-r1 —
Wolfi rolling undock 0.11.0-r3 —
Wolfi rolling vale 3.13.0-r4 —
Wolfi rolling vault-benchmark 0.4.0-r3 —
Wolfi rolling vault-k8s 1.7.2-r1 —
Wolfi rolling vault-secrets-webhook 1.22.2-r1 —
Wolfi rolling vertical-pod-autoscaler +3 1.5.1-r3 —
Wolfi rolling volume-modifier-for-k8s 0.9.1-r1 —
Wolfi rolling wave 0.10.0-r14 —
Wolfi rolling wazero 1.11.0-r1 —
Wolfi rolling wgcf 2.2.30-r1 —
Wolfi rolling whereabouts 0.9.2-r4 —
Wolfi rolling wire-go 0.7.0-r4 —
Wolfi rolling wuzz 0.5.0-r15 —
Wolfi rolling x509-certificate-exporter 3.19.1-r8 —
Wolfi rolling xcaddy 0.4.5-r4 —
Wolfi rolling xeol 0.10.8-r21 —
Wolfi rolling yace 0.63.0-r4 —
Wolfi rolling ytt 0.52.2-r1 —
Wolfi rolling yunikorn-k8shim 1.7.0-r8 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go toolchain >= 1.25.0, < 1.25.6 1.25.6 GO-2026-4338

Advisories 33

References