GO-2026-4970 | Vulnetix

GO-2026-4970 PUBLISHED

Record from OSV · Published July 7, 2026

Root escape via symlink plus trailing slash in os

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
commercial-grafana-12.4	Chainguard	12.4.6-r0
prometheus-elasticsearch-exporter	Chainguard	1.10.0-r12
mattermost-11.5	Wolfi	11.5.7-r4
commercial-spilo-4	Chainguard	4.1.2-r6
azure-aad-pod-identity-mic	Chainguard	1.8.17-r40
nerdctl-fips	Chainguard	2.3.4-r1
cilium-envoy-fips-1.18	Chainguard	1.18.11-r1
karpenter-1.11	Wolfi	1.11.1-r7
virt-operator-fips-1.6	Chainguard	1.6.6-r4
istio-fips-1.28	Chainguard	1.28.10-r1
kyverno-1.15	Chainguard	1.15.3-r26
commercial-kyverno-1.17	Chainguard	1.17.2-r0

88 more packages have a fixed version. See every fix in Lookup.

Vendor	Product	Versions
chainguard	guac	*
chainguard	nri-nginx	*
chainguard	crossplane-provider-aws-servicediscovery	*
wolfi	howdy-yall	*
chainguard	crossplane-provider-aws-pipes-fips	*
chainguard	infinispan-operator	*
wolfi	gcp-compute-persistent-disk-csi-driver-1.23	*
chainguard	rancher-pushprox	*
wolfi	dgraph	*
chainguard	restic	*
chainguard	terraform-provider-azurerm-fips	*
wolfi	cloudflared	*
chainguard	langfuse-2	*
wolfi	node-problem-detector-1.35	*
chainguard	bom	*
chainguard	metacontroller	*
chainguard	azuredisk-csi-1.34	*
chainguard	external-secrets-operator-fips-2.3	*
chainguard	crossplane-provider-aws-elasticsearch	*
chainguard	beats-fips-9.3	*

…and 2939 more

The same record, from the CLI:

vulnetix vdb vuln GO-2026-4970
vulnetix vdb fixes GO-2026-4970

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GO-2026-4970/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart