High · 7.8 CVE-2026-39822 BIT-golang-2026-39822EUVD-2026-42316GHSA-xcgv-8mv7-v8c7GO-2026-4970

Root escape via symlink plus trailing slash in os

Published Jul 8, 2026 · Updated Jul 8, 2026 · Assigned by Go

Vendor: Go standard library Product: os Package: actions-runner-controller Package: amazon-k8s-cni Package: apko Package: argo-cd-3.3-compat Package: aws-network-policy-agent Package: azurefile-csi-1.35 Package: blob-csi-1.27 Package: buildah Package: buildctl Package: buildkitd Package: caddy Package: cerbos Package: cerbosctl Package: cert-manager-cainjector-1.20 Package: cilium-1.19 Package: cilium-1.19-clustermesh-apiserver Package: cilium-1.19-hubble-relay Package: cilium-1.19-operator-aws Package: cilium-1.19-operator-generic Package: cilium-cli Package: cni-plugins Package: cni-plugins-aws-k8s-compat Package: cni-plugins-ipam Package: cni-plugins-main Package: cni-plugins-meta Package: consul-k8s-1.9 Package: containerd-1 Package: containerd-2 Package: containerd-2.3 Package: containerd-shim-runc-v2-1 Package: containerd-shim-runc-v2-2 Package: containerd-shim-runc-v2-2.3 Package: containerd-stress-1 Package: containerd-stress-2.3 Package: cri-tools Package: ctr-1 Package: ctr-2.3 Package: dask-gateway-server Package: datadog-agent-7.72 Package: datadog-agent-7.73 Package: dataplaneapi Package: distribution Package: docker-cli-buildx Package: docker-config-mirror-gcr-28 Package: docker-dind-compat-28 Package: dockerd-28 Package: dockerd-29 Package: dogstatsd-7.72 Package: dogstatsd-7.73 Package: emissary Package: falco-no-driver Package: flux-2.7 Package: flux-2.8 Package: flux-2.9 Package: frp Package: fuse-overlayfs-snapshotter Package: gitaly-18.11 Package: gitaly-19.0 Package: glab Package: go Package: go-1.24 Package: go-1.24-covdata Package: go-1.24-test2json Package: golang Package: golang-1.10 Package: golang-1.13 Package: golang-1.14 Package: golang-1.16 Package: golang-1.17 Package: golang-1.18 Package: golang-1.20 Package: golang-1.21 Package: golang-1.22 Package: golang-1.23 Package: golang-1.24 Package: golang-1.24 Package: golang-1.25 Package: golang-1.26 Package: golang-1.27 Package: golang-1.6 Package: golang-1.8 Package: golang-1.9 Package: gpu-feature-discovery Package: grafana-12.4 Package: grafana-alloy Package: grafana-operator Package: grype Package: helm-3 Package: hubble Package: ipfs-cluster Package: k3d Package: k3s Package: k3s-1.32 Package: k3s-1.35 Package: k3s-multicall Package: k3s-multicall-1.32 Package: k3s-multicall-1.35 Package: k3s-static Package: k3s-static-1.32 Package: k3s-static-1.35 Package: karpenter-1.11 Package: karpenter-1.12 Package: katib-earlystopping Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-nas-enas Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: katib-tfevent-metricscollector Package: kine Package: kots Package: kube-apiserver-1.34 Package: kube-apiserver-1.35 Package: kube-apiserver-1.36 Package: kube-controller-manager-1.34 Package: kube-controller-manager-1.35 Package: kube-controller-manager-1.36 Package: kube-fluentd-operator Package: kube-proxy-1.34 Package: kube-proxy-1.35 Package: kube-proxy-1.35-default-compat Package: kube-proxy-1.36 Package: kube-scheduler-1.34 Package: kube-scheduler-1.35 Package: kube-scheduler-1.35-default-compat Package: kube-scheduler-1.36 Package: kubeadm-1.34 Package: kubeadm-1.35 Package: kubeadm-1.36 Package: kubectl-1.32 Package: kubectl-1.34 Package: kubectl-1.35 Package: kubectl-1.36 Package: kubectl-bash-completion-1.35 Package: kubelet-1.34 Package: kubelet-1.35 Package: kubelet-1.36 Package: kubernetes-1.34 Package: kubernetes-1.35 Package: kubernetes-1.36 Package: kubernetes-dashboard Package: kubernetes-pause-compat-1.35 Package: kyverno-1.17 Package: kyverno-1.18 Package: kyverno-background-controller-1.17 Package: kyverno-background-controller-1.18 Package: kyverno-cleanup-controller-1.17 Package: kyverno-cleanup-controller-1.18 Package: kyverno-cli-1.17 Package: kyverno-cli-1.18 Package: kyverno-init-container-1.17 Package: kyverno-init-container-1.18 Package: kyverno-readiness-checker-1.17 Package: kyverno-readiness-checker-1.18 Package: kyverno-reports-controller-1.17 Package: kyverno-reports-controller-1.18 Package: libnvidia-container Package: loki-3.6 Package: loki-3.6-logcli Package: loki-3.6-loki-canary Package: loki-3.6-promtail Package: loki-3.7 Package: loki-3.7-logcli Package: loki-3.7-loki-canary Package: mattermost-11.5 Package: mattermost-11.6 Package: mattermost-11.7 Package: melange Package: metallb Package: mongo-tools Package: mountpoint-s3-csi-driver-2.5 Package: mountpoint-s3-csi-driver-2.6 Package: mps-control-daemon Package: multus-cni Package: nerdctl Package: newrelic-infrastructure-agent Package: node-feature-discovery-0.18 Package: nvidia-container-toolkit-nvidia-cdi-hook Package: nvidia-container-toolkit-nvidia-container-runtime Package: nvidia-container-toolkit-nvidia-container-runtime-cdi Package: nvidia-container-toolkit-nvidia-container-runtime-legacy Package: nvidia-container-toolkit-nvidia-ctk Package: nvidia-container-toolkit-nvidia-ctk-installer Package: nvidia-device-plugin Package: opentelemetry-collector Package: opentelemetry-operator-otel-allocator Package: opentofu-1.9 Package: pinact Package: prometheus-3.12 Package: prometheus-3.8 Package: prometheus-3.9 Package: prometheus-admission-webhook Package: prometheus-alertmanager Package: prometheus-config-reloader Package: prometheus-operator Package: prometheus-operator-iamguarded-compat Package: promxy Package: pulumi Package: pulumi-language-dotnet Package: pulumi-language-go Package: pulumi-language-nodejs Package: pulumi-language-yaml Package: redka Package: rekor-backfill-index Package: rekor-cli Package: rekor-server Package: rootlesskit Package: ruby3.3-fluent-plugin-grafana-loki-3.7 Package: scorecard Package: sigstore-scaffolding-tuf-createsecret Package: snyk-cli Package: spqr Package: src Package: stdlib Package: telegraf-1.38 Package: teleport-18.6 Package: tfsec Package: timestamp-authority-cli Package: timestamp-authority-server Package: traefik-3.6 Package: traefik-3.7 Package: trino Package: undock Package: vcluster Package: velero-plugin-for-csi Package: velero-plugin-for-microsoft-azure Package: vexctl Package: vitess-23 Package: vitess-24 Package: vitess-24-binaries Package: whereabouts Package: zarf Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

Affected products

Vendor	Product	Affected	Fixed
Go standard library	os	< 1.25.12, 1.26.0-0 – < 1.26.5, 1.27.0-0 – < 1.27.0-rc.2	1.25.12

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	golang-1.26	1.26.5-1	—
Debian 14	golang-1.27	1.27~rc2-1	—
Debian 13	golang-1.24	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.04 LTS	golang-1.23 +2	No fix yet	—
Ubuntu 25.10	golang-1.23 +2	No fix yet	—
Ubuntu 24.04 LTS	golang-1.21 +4	No fix yet	—
Ubuntu 22.04 LTS	golang-1.17 +7	No fix yet	—
Ubuntu 20.04 LTS	golang-1.13 +5	No fix yet	—

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	golang-1.8 +2	No fix yet	—
Ubuntu 16.04 LTS	golang-1.6 +1	No fix yet	—
Ubuntu 14.04 LTS	golang-1.10	No fix yet	—
Ubuntu Pro 22.04 LTS	golang-1.13	No fix yet	—
Ubuntu Pro 20.04 LTS	golang-1.16	No fix yet	—
Ubuntu Pro 18.04 LTS	golang-1.13 +2	No fix yet	—
Ubuntu Pro 16.04 LTS	golang-1.13 +1	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	buildah +1	2:1.43.1-4.el10_2	RHSA-2026:38494
RHEL 10	golang +7	1.26.5-1.el10_2	RHSA-2026:37436
RHEL 10	podman +3	7:5.8.2-5.el10_2	RHSA-2026:38495
RHEL 9	buildah +1	2:1.43.1-4.el9_8	RHSA-2026:38493
RHEL 9	golang +7	1.26.5-1.el9_8	RHSA-2026:37435
RHEL 9	podman +4	6:5.8.2-5.el9_8	RHSA-2026:38878
RHEL 8	delve	1.26.1-1.module+el8.10.0+24516+40554724	RHSA-2026:38995
RHEL 8	golang +7	1.26.5-1.module+el8.10.0+24506+6809f2d9	RHSA-2026:38995

Show 6 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 10.0 EUS	golang +7	1.26.5-1.el10_0	RHSA-2026:49702
RHEL 9.6 EUS	golang +7	1.26.5-1.el9_6	RHSA-2026:49712
RHEL 9.4 E4S	golang +7	1.26.5-1.el9_4	RHSA-2026:57649
RHEL 9.2 E4S	golang +7	1.26.5-1.el9_2	RHSA-2026:61253
Red Hat OpenShift 4	cri-o	1.35.6-5.rhaos4.22.git41f610b.el9	RHSA-2026:57361
Red Hat OpenShift 4	cri-tools	1.35.0-3.el9	RHSA-2026:57361
Red Hat OpenShift 4	openshift +5	4.20.0-202609041738.p2.g4012064.assembly.stream.el8	RHSA-2026:66375, RHSA-2026:66350, RHSA-2026:57361
Red Hat OpenShift 4	openshift-clients +1	4.21.0-202609071555.p2.gd0bf7cc.assembly.stream.el8	RHSA-2026:66350, RHSA-2026:57361
Red Hat OpenShift 4	ose-aws-ecr-image-credential-provider	4.22.0-202608131626.p2.gb4bad3f.assembly.stream.el8	RHSA-2026:57361
Red Hat OpenShift 4	ose-azure-acr-image-credential-provider	4.22.0-202608131626.p2.ga17a3e3.assembly.stream.el8	RHSA-2026:57361
Red Hat OpenShift 4	ose-crio-credential-provider	4.21.0-202609021357.p2.g83d4961.assembly.stream.el8	RHSA-2026:66350
Red Hat OpenShift 4	ose-gcp-gcr-image-credential-provider	4.22.0-202608131626.p2.gea31ab8.assembly.stream.el8	RHSA-2026:57361
Red Hat Hardened Images 1	golang1.25 +5	1.25.12-0.1.hum1	RHSA-2026:36510
Red Hat Hardened Images 1	golang1.26 +5	1.26.5-0.1.hum1	RHSA-2026:36477

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 10	buildah +1	2:1.43.1-4.el10_2	ALSA-2026:38494
AlmaLinux 10	golang +7	1.26.5-1.el10_2.alma.1	ALSA-2026:37436
AlmaLinux 10	podman +3	7:5.8.2-5.el10_2.alma.1	ALSA-2026:38495
AlmaLinux 9	buildah +1	2:1.43.1-4.el9_8	ALSA-2026:38493
AlmaLinux 9	golang +7	1.26.5-1.el9_8	ALSA-2026:37435
AlmaLinux 9	podman +4	6:5.8.2-5.el9_8	ALSA-2026:38878
AlmaLinux 8	delve	1.26.1-1.module_el8.10.0+4223+bd807c2e	ALSA-2026:38995
AlmaLinux 8	golang +7	1.26.5-1.module_el8.10.0+4223+bd807c2e	ALSA-2026:38995

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 10	buildah	2:1.43.1-4.el10_2	RLSA-2026:38494
Rocky Linux 10	golang	1.26.5-1.el10_2	RLSA-2026:37436
Rocky Linux 10	podman	7:5.8.2-5.el10_2	RLSA-2026:38495
Rocky Linux 9	buildah	2:1.43.1-4.el9_8	RLSA-2026:38493
Rocky Linux 9	golang	1.26.5-1.el9_8	RLSA-2026:37435
Rocky Linux 9	podman	6:5.8.2-5.el9_8	RLSA-2026:38878
Rocky Linux 8	delve	1.26.1-1.module+el8.10.0+40244+e7cb3ff8	RLSA-2026:38995
Rocky Linux 8	golang	1.26.5-1.module+el8.10.0+40244+e7cb3ff8	RLSA-2026:38995

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP7	go1.25	1.25.12-150000.1.44.1	SUSE-SU-2026:2817-1
SLES 15 SP7	go1.25-openssl	1.25.12-150600.13.21.1	SUSE-SU-2026:3151-1
SLES 15 SP7	go1.26	1.26.5-150000.1.18.1	SUSE-SU-2026:2818-1
SLES 15 SP7	go1.26-openssl	1.26.5-150600.13.9.1	SUSE-SU-2026:3102-1
SLES 15 SP6	go1.25	1.25.12-150000.1.44.1	SUSE-SU-2026:2817-1
SLES 15 SP6	go1.25-openssl	1.25.12-150600.13.21.1	SUSE-SU-2026:3151-1
SLES 15 SP6	go1.26	1.26.5-150000.1.18.1	SUSE-SU-2026:2818-1
SLES 15 SP6	go1.26-openssl	1.26.5-150600.13.9.1	SUSE-SU-2026:3102-1
SLES 15 SP5	go1.25	1.25.12-150000.1.44.1	SUSE-SU-2026:2817-1
SLES 15 SP5	go1.25-openssl	1.25.12-150000.1.27.1	SUSE-SU-2026:3046-1
SLES 15 SP5	go1.26	1.26.5-150000.1.18.1	SUSE-SU-2026:2818-1
SLES 15 SP5	go1.26-openssl	1.26.5-150000.1.12.1	SUSE-SU-2026:3047-1
SLES 15 SP4	go1.25	1.25.12-150000.1.44.1	SUSE-SU-2026:2817-1
SLES 15 SP4	go1.25-openssl	1.25.12-150000.1.27.1	SUSE-SU-2026:3046-1
SLES 15 SP4	go1.26	1.26.5-150000.1.18.1	SUSE-SU-2026:2818-1
SLES 15 SP4	go1.26-openssl	1.26.5-150000.1.12.1	SUSE-SU-2026:3047-1

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 16.0	go1.25 +1	1.25.12-160000.1.1	SUSE-SU-2026:22643-1, SUSE-SU-2026:22638-1
SLES for SAP 16.0	go1.26 +1	1.26.5-160000.1.1	SUSE-SU-2026:22656-1, SUSE-SU-2026:22641-1
SLES for SAP 15 SP6	go1.25	1.25.12-150000.1.44.1	SUSE-SU-2026:2817-1
SLES for SAP 15 SP6	go1.25-openssl	1.25.12-150600.13.21.1	SUSE-SU-2026:3151-1
SLES for SAP 15 SP6	go1.26	1.26.5-150000.1.18.1	SUSE-SU-2026:2818-1
SLES for SAP 15 SP6	go1.26-openssl	1.26.5-150600.13.9.1	SUSE-SU-2026:3102-1
SLES for SAP 15 SP5	go1.25	1.25.12-150000.1.44.1	SUSE-SU-2026:2817-1
SLES for SAP 15 SP5	go1.25-openssl	1.25.12-150000.1.27.1	SUSE-SU-2026:3046-1
SLES for SAP 15 SP5	go1.26	1.26.5-150000.1.18.1	SUSE-SU-2026:2818-1
SLES for SAP 15 SP5	go1.26-openssl	1.26.5-150000.1.12.1	SUSE-SU-2026:3047-1
SLES for SAP 15 SP4	go1.25	1.25.12-150000.1.44.1	SUSE-SU-2026:2817-1
SLES for SAP 15 SP4	go1.25-openssl	1.25.12-150000.1.27.1	SUSE-SU-2026:3046-1
SLES for SAP 15 SP4	go1.26	1.26.5-150000.1.18.1	SUSE-SU-2026:2818-1
SLES for SAP 15 SP4	go1.26-openssl	1.26.5-150000.1.12.1	SUSE-SU-2026:3047-1
SLES 16.0	go1.25 +1	1.25.12-160000.1.1	SUSE-SU-2026:22643-1, SUSE-SU-2026:22638-1
SLES 16.0	go1.26 +1	1.26.5-160000.1.1	SUSE-SU-2026:22656-1, SUSE-SU-2026:22641-1
SLE HPC 15 SP5	go1.25	1.25.12-150000.1.44.1	SUSE-SU-2026:2817-1
SLE HPC 15 SP5	go1.25-openssl	1.25.12-150000.1.27.1	SUSE-SU-2026:3046-1
SLE HPC 15 SP5	go1.26	1.26.5-150000.1.18.1	SUSE-SU-2026:2818-1
SLE HPC 15 SP5	go1.26-openssl	1.26.5-150000.1.12.1	SUSE-SU-2026:3047-1
SLE HPC 15 SP4	go1.25	1.25.12-150000.1.44.1	SUSE-SU-2026:2817-1
SLE HPC 15 SP4	go1.25-openssl	1.25.12-150000.1.27.1	SUSE-SU-2026:3046-1
SLE HPC 15 SP4	go1.26	1.26.5-150000.1.18.1	SUSE-SU-2026:2818-1
SLE HPC 15 SP4	go1.26-openssl	1.26.5-150000.1.12.1	SUSE-SU-2026:3047-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	go1.25	1.25.12-1.1	openSUSE-SU-2026:11212-1
openSUSE Tumbleweed	go1.26	1.26.5-1.1	openSUSE-SU-2026:11232-1
openSUSE Tumbleweed	loki	3.7.4-1.1	openSUSE-SU-2026:11393-1
openSUSE Leap 16.0	go1.25 +1	1.25.12-160000.1.1	openSUSE-SU-2026:21324-1, openSUSE-SU-2026:21319-1
openSUSE Leap 16.0	go1.26 +1	1.26.5-160000.1.1	openSUSE-SU-2026:21341-1, openSUSE-SU-2026:21321-1
openSUSE Leap 16.0	govulncheck-vulndb	0.0.20260723T184607-160000.1.1	openSUSE-SU-2026:21483-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	go	1.26.8-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	amazon-cloudwatch-agent	1.300069.1-1.amzn2023	ALAS2023-2026-2025
Amazon Linux 2023	amazon-ecr-credential-helper	0.12.0-4.amzn2023	ALAS2023-2026-3180
Amazon Linux 2023	containerd +1	2.2.7-1.amzn2023.0.1	ALAS2023-2026-2131
Amazon Linux 2023	credentials-fetcher	2.0.3-1.amzn2023.0.2	ALAS2023-2026-1975
Amazon Linux 2023	docker	25.0.16-1.amzn2023.0.5	ALAS2023-2026-3205
Amazon Linux 2023	golang +6	1.25.12-1.amzn2023.0.1	ALAS2023-2026-1979
Amazon Linux 2023	golang-github-burntsushi-toml +1	1.5.0-1.amzn2023.0.3	ALAS2023-2026-1978
Amazon Linux 2023	golang-github-burntsushi-toml-test +1	0.2.0-8.amzn2023.0.5	ALAS2023-2026-1977
Amazon Linux 2023	golang-github-cpuguy83-md2man +2	2.0.2-24.amzn2023.0.9	ALAS2023-2026-1989
Amazon Linux 2023	golist	0.10.4-12.amzn2023.0.11	ALAS2023-2026-1976
Amazon Linux 2023	nerdctl	2.3.5-1.amzn2023.0.1	ALAS2023-2026-2129
Amazon Linux 2023	oci-add-hooks	0-0.1.20200504git268e3bb.amzn2023.0.12	ALAS2023-2026-3206
Amazon Linux 2023	rclone	1.75.1-1.amzn2023	ALAS2023-2026-3129
Amazon Linux 2023	runc	1.3.6-1.amzn2023.0.1	ALAS2023-2026-2138
Amazon Linux 2023	runfinch-finch	1.17.2-1.amzn2023.0.3	ALAS2023-2026-2023
Amazon Linux 2023	soci-snapshotter	0.16.0-1.amzn2023.0.1	ALAS2023-2026-3153
Amazon Linux 2	amazon-cloudwatch-agent	1.300069.1-1.amzn2	ALAS2-2026-3844
Amazon Linux 2	golang +6	1.25.12-1.amzn2.0.1	ALAS2-2026-3819
Amazon Linux 2	golist	0.10.1-10.amzn2.0.15	ALAS2-2026-3818
Amazon Linux 2	nerdctl	2.3.5-1.amzn2.0.1	ALAS2-2026-3903

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	golang	1.25.12-1	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 10	buildah +1	2:1.43.1-4.0.1.el10_2	ELSA-2026-38494
Oracle Linux 10	golang +7	1.26.5-1.0.1.el10_2	ELSA-2026-37436
Oracle Linux 10	podman +3	7:5.8.2-5.0.1.el10_2	ELSA-2026-38495
Oracle Linux 9	buildah +1	2:1.43.1-4.0.1.el9_8	ELSA-2026-38493
Oracle Linux 9	golang +7	1.26.5-1.0.1.el9_8	ELSA-2026-37435
Oracle Linux 9	podman +4	6:5.8.2-5.0.1.el9_8	ELSA-2026-38878
Oracle Linux 8	delve	1.26.1-1.0.1.module+el8.10.0+90954+4b0fdef3	ELSA-2026-38995
Oracle Linux 8	golang +7	1.26.5-1.0.1.module+el8.10.0+90954+4b0fdef3	ELSA-2026-38995

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	actions-runner-controller	0.14.2-r5	—
Wolfi rolling	amazon-k8s-cni	1.22.3-r1	—
Wolfi rolling	apko	1.2.23-r1	—
Wolfi rolling	argo-cd-3.3-compat	3.3.14-r9	—
Wolfi rolling	aws-network-policy-agent	1.3.7-r1	—
Wolfi rolling	azurefile-csi-1.35	1.35.5-r1	—
Wolfi rolling	blob-csi-1.27	1.27.7-r3	—
Wolfi rolling	buildah	1.44.0-r9	—
Wolfi rolling	buildctl +1	0.31.1-r1	—
Wolfi rolling	caddy	2.11.4-r2	—
Wolfi rolling	cerbos +1	0.53.0-r10	—
Wolfi rolling	cert-manager-cainjector-1.20	1.20.3-r18	—
Wolfi rolling	cilium-1.19 +4	1.19.5-r6	—
Wolfi rolling	cilium-cli	0.19.5-r2	—
Wolfi rolling	cni-plugins +4	1.9.1-r8	—
Wolfi rolling	consul-k8s-1.9	1.9.9-r3	—
Wolfi rolling	cri-tools	1.36.0-r7	—
Wolfi rolling	ctr-1 +3	1.7.33-r2	—
Wolfi rolling	ctr-2.3 +5	2.3.2-r2	—
Wolfi rolling	dask-gateway-server	2026.3.0-r9	—
Wolfi rolling	dataplaneapi	3.4.0-r3	—
Wolfi rolling	distribution	3.1.1-r6	—
Wolfi rolling	docker-cli-buildx	0.35.0-r3	—
Wolfi rolling	docker-dind-compat-28 +1	28.5.2-r38	—
Wolfi rolling	dockerd-28	28.5.2-r30	—
Wolfi rolling	dockerd-29	29.6.1-r16	—
Wolfi rolling	dogstatsd-7.72 +1	7.72.4-r32	—
Wolfi rolling	dogstatsd-7.73 +1	7.73.3-r20	—
Wolfi rolling	emissary	4.1.0-r6	—
Wolfi rolling	falco-no-driver	0.44.1-r5	—
Wolfi rolling	flux-2.7	2.7.5-r26	—
Wolfi rolling	flux-2.8	2.8.8-r10	—
Wolfi rolling	flux-2.9	2.9.1-r1	—
Wolfi rolling	frp	0.69.1-r4	—
Wolfi rolling	fuse-overlayfs-snapshotter	2.1.7-r18	—
Wolfi rolling	gitaly-18.11	18.11.7-r0	—
Wolfi rolling	gitaly-19.0	19.0.4-r0	—
Wolfi rolling	glab	1.107.0-r1	—
Wolfi rolling	go-1.24 +3	No fix yet	—
Wolfi rolling	grafana-12.4	12.4.5-r4	—
Wolfi rolling	grafana-alloy	1.17.1-r1	—
Wolfi rolling	grafana-operator	5.24.0-r1	—
Wolfi rolling	grype	0.115.0-r2	—
Wolfi rolling	helm-3	3.21.3-r0	—
Wolfi rolling	hubble	1.19.4-r5	—
Wolfi rolling	ipfs-cluster	1.1.6-r7	—
Wolfi rolling	k3d	5.9.0-r2	—
Wolfi rolling	k3s +2	1.36.2.1-r4	—
Wolfi rolling	k3s-1.32 +2	1.32.13.1-r23	—
Wolfi rolling	k3s-1.35 +2	1.35.6.1-r3	—
Wolfi rolling	karpenter-1.11	1.11.1-r7	—
Wolfi rolling	karpenter-1.12	1.12.1-r4	—
Wolfi rolling	katib-earlystopping +8	0.19.0-r31	—
Wolfi rolling	katib-suggestion-goptuna-compat	0.19.0-r40	—
Wolfi rolling	kine	0.16.3-r2	—
Wolfi rolling	kots	1.130.7-r1	—
Wolfi rolling	kube-fluentd-operator	1.18.2-r74	—
Wolfi rolling	kubeadm-1.34 +7	1.34.9-r1	—
Wolfi rolling	kubeadm-1.35 +7	1.35.6-r1	—
Wolfi rolling	kubeadm-1.36 +7	1.36.2-r1	—
Wolfi rolling	kubectl-1.32	1.32.13-r2	—
Wolfi rolling	kubectl-bash-completion-1.35 +3	1.35.8-r6	—
Wolfi rolling	kubernetes-dashboard	7.14.0-r11	—
Wolfi rolling	kyverno-1.17	1.17.2-r35	—
Wolfi rolling	kyverno-1.18 +6	1.18.1-r12	—
Wolfi rolling	kyverno-cli-1.17 +5	1.17.2-r18	—
Wolfi rolling	libnvidia-container	1.19.0-r6	—
Wolfi rolling	loki-3.6 +3	3.6.12-r1	—
Wolfi rolling	loki-3.7 +2	3.7.3-r1	—
Wolfi rolling	mattermost-11.5	11.5.7-r4	—
Wolfi rolling	mattermost-11.6	11.6.6-r3	—
Wolfi rolling	mattermost-11.7	11.7.6-r2	—
Wolfi rolling	melange	0.56.1-r1	—
Wolfi rolling	metallb	0.16.1-r3	—
Wolfi rolling	mongo-tools	100.17.0-r6	—
Wolfi rolling	mountpoint-s3-csi-driver-2.5	2.5.0-r11	—
Wolfi rolling	mountpoint-s3-csi-driver-2.6	2.6.0-r3	—
Wolfi rolling	mps-control-daemon +2	0.19.3-r3	—
Wolfi rolling	multus-cni	4.3.0-r1	—
Wolfi rolling	nerdctl	2.3.4-r1	—
Wolfi rolling	newrelic-infrastructure-agent	1.77.1-r1	—
Wolfi rolling	node-feature-discovery-0.18	0.18.3-r20	—
Wolfi rolling	nvidia-container-toolkit-nvidia-ctk +5	1.19.1-r6	—
Wolfi rolling	opentelemetry-collector	0.156.0-r1	—
Wolfi rolling	opentelemetry-operator-otel-allocator	0.154.0-r1	—
Wolfi rolling	opentofu-1.9	1.9.4-r21	—
Wolfi rolling	pinact	4.1.0-r2	—
Wolfi rolling	prometheus-3.12	3.12.0-r5	—
Wolfi rolling	prometheus-3.9	3.9.1-r8	—
Wolfi rolling	prometheus-alertmanager	0.33.1-r2	—
Wolfi rolling	prometheus-operator +2	0.92.1-r2	—
Wolfi rolling	prometheus-operator-iamguarded-compat	0.94.0-r0	—
Wolfi rolling	promxy	0.0.96-r2	—
Wolfi rolling	pulumi +2	3.251.0-r0	—
Wolfi rolling	pulumi-language-dotnet	3.107.3-r1	—
Wolfi rolling	pulumi-language-yaml	1.37.0-r1	—
Wolfi rolling	redka	1.0.1-r4	—
Wolfi rolling	rekor-cli +2	1.5.3-r1	—
Wolfi rolling	rootlesskit	3.0.1-r5	—
Wolfi rolling	ruby3.3-fluent-plugin-grafana-loki-3.7	3.7.7-r4	—
Wolfi rolling	scorecard	5.5.0-r11	—
Wolfi rolling	sigstore-scaffolding-tuf-createsecret	0.7.31-r20	—
Wolfi rolling	snyk-cli	1.1305.2-r2	—
Wolfi rolling	spqr	3.0.0-r1	—
Wolfi rolling	src	7.4.0-r1	—
Wolfi rolling	telegraf-1.38	1.38.4-r10	—
Wolfi rolling	teleport-18.6	18.6.8-r33	—
Wolfi rolling	tfsec	1.28.14-r40	—
Wolfi rolling	timestamp-authority-cli +1	2.1.3-r1	—
Wolfi rolling	traefik-3.6	3.6.23-r0	—
Wolfi rolling	traefik-3.7	3.7.7-r0	—
Wolfi rolling	trino	483-r7	—
Wolfi rolling	undock	0.14.0-r3	—
Wolfi rolling	vcluster	0.35.1-r4	—
Wolfi rolling	velero-plugin-for-csi	0.7.1-r53	—
Wolfi rolling	velero-plugin-for-microsoft-azure	1.14.2-r1	—
Wolfi rolling	vexctl	0.4.4-r1	—
Wolfi rolling	vitess-23	23.0.5-r2	—
Wolfi rolling	vitess-24 +1	24.0.2-r4	—
Wolfi rolling	whereabouts	0.9.4-r3	—
Wolfi rolling	zarf	0.80.0-r5	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Go	stdlib	< 1.25.12 · >= 1.26.0-0, < 1.26.5 · >= 1.27.0-0, < 1.27.0-rc.2	1.25.12, 1.26.5, 1.27.0-rc.2	GO-2026-4970

Advisories 50

WID-SEC-2026-2239 Golang Go: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen BSI CERT-Bund (WID) · Nov 12, 2026
ALSA-2026:37435 Important: golang security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:37436 Important: golang security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:38493 Important: buildah security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:38878 Important: podman security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:38494 Important: buildah security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:38495 Important: podman security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:38995 Important: go-toolset:rhel8 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
WID-SEC-2026-4093 Oracle TimesTen In-Memory Database: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 20, 2026
RHSA-2026:66375 Red Hat Security Advisory: OpenShift Container Platform 4.20.38 packages and security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:66350 Red Hat Security Advisory: OpenShift Container Platform 4.21.33 packages and security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:61253 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:57649 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:57361 Red Hat Security Advisory: OpenShift Container Platform 4.22.11 packages and security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:49712 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:49702 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:38995 Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:37436 Red Hat Security Advisory: golang security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:37435 Red Hat Security Advisory: golang security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:38878 Red Hat Security Advisory: podman security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
RHSA-2026:38495 Red Hat Security Advisory: podman security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
RHSA-2026:38494 Red Hat Security Advisory: buildah security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
RHSA-2026:38493 Red Hat Security Advisory: buildah security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
RHSA-2026:36510 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
RHSA-2026:36477 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
ALAS2023-2026-3153 Moderate: soci-snapshotter security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 12, 2026
ALAS2023-2026-3180 Moderate: amazon-ecr-credential-helper security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 12, 2026
ALAS2023-2026-3205 Moderate: docker security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 12, 2026
ALAS2023-2026-3206 Moderate: oci-add-hooks security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 12, 2026
ALAS2023-2026-3129 Important: rclone security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 28, 2026
WID-SEC-2026-3403 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 24, 2026
NCSC-2026-0375 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Sep 16, 2026
ALAS2023-2026-2138 Moderate: runc security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 14, 2026
ALAS2023-2026-2129 Moderate: nerdctl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 14, 2026
ALAS2-2026-3903 Moderate: nerdctl security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 14, 2026
VDE-2026-088 METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.4 CERT@VDE · Sep 10, 2026
ALAS2023-2026-2131 Important: containerd security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 9, 2026
ALAS2-2026-3844 Moderate: amazon-cloudwatch-agent security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 4, 2026
ALAS2023-2026-2023 Important: runfinch-finch security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 4, 2026
ALAS2023-2026-2025 Moderate: amazon-cloudwatch-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 4, 2026
openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
openSUSE-SU-2026:11393-1 logcli-3.7.4-1.1 on GA media SUSE / openSUSE Security Updates · Jul 29, 2026
SUSE-SU-2026:3151-1 Security update for go1.25-openssl SUSE / openSUSE Security Updates · Jul 22, 2026
ALAS2-2026-3818 Moderate: golist security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 20, 2026
ALAS2-2026-3819 Moderate: golang security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 20, 2026
ALAS2023-2026-1977 Moderate: golang-github-burntsushi-toml-test security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 20, 2026
ALAS2023-2026-1978 Moderate: golang-github-burntsushi-toml security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 20, 2026
ALAS2023-2026-1979 Moderate: golang security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 20, 2026
ALAS2023-2026-1989 Moderate: golang-github-cpuguy83-md2man security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 20, 2026
ALAS2023-2026-1975 Moderate: credentials-fetcher security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 20, 2026

EUVD	v3.1	7.8
CISA-ADP	v3.1	7.8

Root escape via symlink plus trailing slash in os

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Alpine

Amazon Linux

Azure Linux

Oracle Linux

Wolfi

Affected packages

Advisories 50

References