Skip to content

Security: agentapi v0.12.2 compiled with Go 1.26.3 — affected by CVE-2026-42504 and CVE-2026-39822 #235

Description

@sachinpcor

Summary

A JFrog Xray container scan of a workspace image that embeds agentapi-linux-amd64 from v0.12.2 flagged two security violations tied to the Go runtime version used to compile the binary.

Affected binary

  • Release: v0.12.2 (latest stable as of 2026-07-17)
  • Asset: agentapi-linux-amd64
  • Go version inside binary: go1.26.3 (confirmed via strings agentapi-linux-amd64 | grep "^go1\.")

CVEs

CVE CVSS v3 Severity Affected Go Fixed in Go
CVE-2026-42504 7.5 High 1.26.3 1.25.11, 1.26.4
CVE-2026-39822 7.8 High 1.26.3 1.25.12, 1.26.5, 1.27.0-rc.2

Note: Go 1.26.4 fixes CVE-2026-42504 but is itself affected by CVE-2026-39822. The minimum patched Go version that resolves both CVEs is Go 1.26.5.

Request

Please rebuild and publish a new release of agentapi compiled with Go ≥ 1.26.5. This would clear both CVEs from downstream container scans.

No code changes should be required — only a toolchain bump in the build pipeline.

How we detected it

These findings appeared in a JFrog Xray container scan. The scanner identifies the Go toolchain version embedded in the binary and cross-references it against known CVEs.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions