VDB

GO-2026-6225

GO-2026-6225 PUBLISHED

Record from OSV · Published August 18, 2026

Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
tekton-pipelines-fips-1.6Chainguard1.6.7-r2
crossplane-2.1Chainguard2.1.8-r7
tekton-pipelines-1.10Chainguard1.10.3-r9, 1.10.3-r12
crossplane-fips-2.0Chainguard2.0.8-r22
tekton-pipelines-fips-1.4Chainguard1.4.0-r26
crossplane-2.2Wolfi2.2.5-r1
knative-serving-1.23Chainguard1.23.0-r4
knative-serving-1.22Wolfi1.22.1-r12, 1.22.1-r11
kanikoWolfi1.25.20-r0
tekton-pipelines-1.5Chainguard1.5.0-r25
tekton-pipelines-1.4Chainguard1.4.0-r26
crossplane-2.1Wolfi2.1.8-r7

31 more packages have a fixed version. See every fix in Lookup.

Affected products

VendorProductVersions
chainguardkubescape-server-fips*
chainguardtekton-pipelines-fips-1.60
chainguardcrossplane-2.10
chainguardtekton-pipelines-1.100, 0
chainguardcrossplane-fips-2.00
chainguardtekton-chains*
chainguardkyverno-fips-1.18*
wolfigitsign*
chainguardtekton-pipelines-fips-1.40
chainguardkyverno-policy-reporter-plugins-kyverno*
wolfitekton-chains*
chainguardtekton-chains-fips*
wolficrossplane-2.20
chainguardknative-serving-1.230
chainguardreports-server*
wolfiknative-serving-1.220, 0
wolfikaniko0
chainguardtekton-pipelines-1.50
chainguardzarf*
chainguardchainctl*

…and 50 more

Timeline

  • Aug 18, 2026 CVE Published

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GO-2026-6225
vulnetix vdb fixes GO-2026-6225

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GO-2026-6225/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›