StackRadar

CVE-2026-114603

Medium

Advisory

Published 22 Oct 2026In the index since 23 Oct 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
130
of 18,232 indexed, latest versions
Container images
149
deployed by those charts
Fix available
1 of 1
affected package

OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

Carried by container images the latest versions of 130 of 18,232 indexed charts deploy, on 149 images.

Affected packageAffected versionsFixed inImages
opentelemetry-apipypi1.11.1, 1.12.0rc2, 1.18.0, 1.20.0+24 more1.45.1149
OSV records
GHSA-xcq7-p3pf-p88h

Charts affected

130 by stars
ChartLatestAffected imagesRadar Score
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.016 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

16 of the 40 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
yetiplatform/yeti:2.9.09bcbe2650a14
opentelemetry-api@1.41.0
1.45.1
ghcr.io/openrelik/openrelik-mediator:latest50ea049b2836
opentelemetry-api@1.32.1
1.45.1
ghcr.io/openrelik/openrelik-metrics:latest3d0f1ddeebf5
opentelemetry-api@1.32.1
1.45.1
ghcr.io/openrelik/openrelik-server:latestee689861c980
opentelemetry-api@1.32.1
1.45.1
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
opentelemetry-api@1.32.1
1.45.1
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestbd496fa8c9df
opentelemetry-api@1.32.1
1.45.1
ghcr.io/openrelik/openrelik-worker-bulkextractor:latest67498ee2e639
opentelemetry-api@1.32.1
1.45.1
ghcr.io/openrelik/openrelik-worker-chromecreds:latest76d4fbcc6ff0
opentelemetry-api@1.32.1
1.45.1
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
opentelemetry-api@1.32.1
1.45.1
ghcr.io/openrelik/openrelik-worker-extraction:latestec9fc5864cd5
opentelemetry-api@1.32.1
1.45.1
ghcr.io/openrelik/openrelik-worker-grep:latest470ff3529746
opentelemetry-api@1.32.1
1.45.1
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
opentelemetry-api@1.32.1
1.45.1
ghcr.io/openrelik/openrelik-worker-plaso:latest8caaf6e36654
opentelemetry-api@1.32.1
1.45.1
ghcr.io/openrelik/openrelik-worker-strings:latest6e05055b701f
opentelemetry-api@1.32.1
1.45.1
ghcr.io/openrelik/openrelik-worker-timesketch:latest4cb88b603cdc
opentelemetry-api@1.32.1
1.45.1
ghcr.io/openrelik/openrelik-worker-yara:latestbd7fbf4505b5
opentelemetry-api@1.32.1
1.45.1

Open the chart page →

307,187
yetiosdfir-infrastructureVerified publisher1.0.51 of 4See more

yeti osdfir-infrastructure 1.0.5

1 of the 4 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
yetiplatform/yeti:latest8673609841e3
opentelemetry-api@1.41.0
1.45.1

Open the chart page →

7,094
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
opentelemetry-api@1.39.1
1.45.1

Open the chart page →

7,094
prowlerprowler0.1.11 of 1See more

prowler prowler 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
toniblyx/prowler:stable9dbcc3c9abd7
opentelemetry-api@1.41.1
1.45.1

Open the chart page →

2,403
airflowquench-airflowVerified publisher0.1.391 of 2See more

airflow quench-airflow 0.1.39

1 of the 2 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/airflowdigest-pinneda5b99d7c37be
opentelemetry-api@1.44.0
1.45.1

Open the chart page →

147
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
opentelemetry-api@1.27.0
1.45.1

Open the chart page →

24,458
rhbk-neurofacerhbk-neurofaceVerified publisher1.0.01 of 4See more

rhbk-neuroface rhbk-neuroface 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
opentelemetry-api@1.29.0
1.45.1

Open the chart page →

5,213
rommromm-helm-chartVerified publisher1.5.51 of 3See more

romm romm-helm-chart 1.5.5

1 of the 3 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
rommapp/romm:5.2.03512f2ca4557
opentelemetry-api@1.36.0
1.45.1

Open the chart page →

2,284
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
opentelemetry-api@1.39.1
1.45.1

Open the chart page →

10,136
airflowsb-helm-charts0.3.01 of 1See more

airflow sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
apache/airflow:2.8.1e5560ad0b86e
opentelemetry-api@1.22.0
1.45.1

Open the chart page →

12,007
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
opentelemetry-api@1.28.0
1.45.1

Open the chart page →

6,420
backendsignalen4.25.01 of 4See more

backend signalen 4.25.0

1 of the 4 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
signalen/backend:2.50.1826bb090bc4e4
opentelemetry-api@1.44.0
1.45.1

Open the chart page →

36,809
pgadminsikalabs0.1.01 of 2See more

pgadmin sikalabs 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
dpage/pgadmin4:latestc332c5f6dfba
opentelemetry-api@1.44.0
1.45.1

Open the chart page →

576
home-assistantsmall-hack2.1.01 of 1See more

home-assistant small-hack 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
opentelemetry-api@1.40.0
1.45.1

Open the chart page →

6,160
verostakewise0.8.31 of 2See more

vero stakewise 0.8.3

1 of the 2 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
ghcr.io/serenita-org/vero:v0.8.3e5a7ec714acc
opentelemetry-api@1.24.0
1.45.1

Open the chart page →

3,843
asrtest-opea1.0.01 of 1See more

asr test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
opea/asr:1.025dd26d9cd09
opentelemetry-api@1.27.0
1.45.1

Open the chart page →

5,240
chatqnatest-opea1.0.05 of 11See more

chatqna test-opea 1.0.0

5 of the 11 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
opea/chatqna:1.038c51b791efa
opentelemetry-api@1.27.0
1.45.1
opea/embedding-tei:1.05c9639de61c1
opentelemetry-api@1.27.0
1.45.1
opea/llm-tgi:1.00c25aab3f106
opentelemetry-api@1.27.0
1.45.1
opea/reranking-tei:1.0e48613afb191
opentelemetry-api@1.27.0
1.45.1
opea/retriever-redis:1.0eb746b263705
opentelemetry-api@1.27.0
1.45.1

Open the chart page →

44,520
codegentest-opea1.0.02 of 5See more

codegen test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
opea/codegen:1.058f91683892d
opentelemetry-api@1.27.0
1.45.1
opea/llm-tgi:1.00c25aab3f106
opentelemetry-api@1.27.0
1.45.1

Open the chart page →

106,684
codetranstest-opea1.0.02 of 5See more

codetrans test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
opea/codetrans:1.0e2436483b73d
opentelemetry-api@1.27.0
1.45.1
opea/llm-tgi:1.00c25aab3f106
opentelemetry-api@1.27.0
1.45.1

Open the chart page →

106,203
docsumtest-opea1.0.02 of 5See more

docsum test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
opea/docsum:1.03eaa91849512
opentelemetry-api@1.27.0
1.45.1
opea/llm-docsum-tgi:1.002f9e8fa5d71
opentelemetry-api@1.27.0
1.45.1

Open the chart page →

106,706
embedding-usvctest-opea1.0.01 of 1See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
opea/embedding-tei:1.05c9639de61c1
opentelemetry-api@1.27.0
1.45.1

Open the chart page →

6,023
guardrails-usvctest-opea1.0.01 of 1See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
opea/guardrails-tgi:1.0262c6048aab8
opentelemetry-api@1.27.0
1.45.1

Open the chart page →

6,058
llm-uservicetest-opea1.0.01 of 1See more

llm-uservice test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
opea/llm-tgi:1.00c25aab3f106
opentelemetry-api@1.27.0
1.45.1

Open the chart page →

5,525
reranking-usvctest-opea1.0.01 of 1See more

reranking-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
opea/reranking-tei:1.0e48613afb191
opentelemetry-api@1.27.0
1.45.1

Open the chart page →

5,815
retriever-usvctest-opea1.0.01 of 1See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
opea/retriever-redis:1.0eb746b263705
opentelemetry-api@1.27.0
1.45.1

Open the chart page →

6,031
speecht5test-opea1.0.01 of 1See more

speecht5 test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
opea/speecht5:1.0249afad3d268
opentelemetry-api@1.27.0
1.45.1

Open the chart page →

10,769
ttstest-opea1.0.01 of 1See more

tts test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
opea/tts:1.0257ae94709e9
opentelemetry-api@1.27.0
1.45.1

Open the chart page →

5,224
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
opentelemetry-api@1.27.0
1.45.1

Open the chart page →

6,245
nemo-guardrailsupstreamyardVerified publisher0.1.11 of 1See more

nemo-guardrails upstreamyard 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
upstreamyard/nemo-guardrails:0.24.19f673183cfc0
opentelemetry-api@1.43.0
1.45.1

Open the chart page →

1,867
wasabi-s3-operatorwasabi-s3-operatorVerified publisher0.2.71 of 1See more

wasabi-s3-operator wasabi-s3-operator 0.2.7

1 of the 1 container images this version deploys carry CVE-2026-114603.

Container imageDigestPackageFixed in
kenchrcum/wasabi-s3-operator:0.2.7ce657c622ce5
opentelemetry-api@1.41.0
1.45.1

Open the chart page →

856

Container images carrying it

149 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter:0.1.38b472877847f5
opentelemetry-api@1.26.0
1.45.1
1
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
opentelemetry-api@1.35.0
1.45.1
1
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
opentelemetry-api@1.39.1
1.45.1
1
ghcr.io/goauthentik/server:2026.8.5602227a86455
opentelemetry-api@1.43.0
1.45.1
1
ghcr.io/goauthentik/server:2026.8.3ab9b4e8cc4ab
opentelemetry-api@1.43.0
1.45.1
1
ghcr.io/hemslo/chat-search:latest39d48995a5bd
opentelemetry-api@1.25.0
1.45.1
1
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
opentelemetry-api@1.40.0
1.45.1
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
opentelemetry-api@1.30.0
1.45.1
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
opentelemetry-api@1.39.1
1.45.1
1
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
opentelemetry-api@1.44.0
1.45.1
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
opentelemetry-api@1.40.0
1.45.1
1
ghcr.io/madebyman/gentleman:0.4.18ff2cffd180b
opentelemetry-api@1.44.0
1.45.1
1
ghcr.io/microboxlabs/miot-harness:0.1.0d548e9ae4b84
opentelemetry-api@1.41.1
1.45.1
1
ghcr.io/middleware-labs/odigos-odiglet:middleware-test-0.0.103c8c835ecee
opentelemetry-api@1.12.0rc2
1.45.1
1
ghcr.io/middleware-labs/vision-odiglet:middleware-test-0.0.3bce34c98668e
opentelemetry-api@1.12.0rc2
1.45.1
1
ghcr.io/mlflow-oidc/mlflow-tracking-server:3.16.1-9.0.2-20261001970ba1cc1e69
opentelemetry-api@1.45.0
1.45.1
1
ghcr.io/mskazemi/kubeintellect:2.6.01d2b74d49f63
opentelemetry-api@1.44.0
1.45.1
1
ghcr.io/obeone/parcelapp-mcp:0.2.17073131db60b
opentelemetry-api@1.44.0
1.45.1
1
ghcr.io/openrelik/openrelik-mediator:latest50ea049b2836
opentelemetry-api@1.32.1
1.45.1
1
ghcr.io/openrelik/openrelik-metrics:latest3d0f1ddeebf5
opentelemetry-api@1.32.1
1.45.1
1
ghcr.io/openrelik/openrelik-server:latestee689861c980
opentelemetry-api@1.32.1
1.45.1
1
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
opentelemetry-api@1.32.1
1.45.1
1
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestbd496fa8c9df
opentelemetry-api@1.32.1
1.45.1
1
ghcr.io/openrelik/openrelik-worker-bulkextractor:latest67498ee2e639
opentelemetry-api@1.32.1
1.45.1
1
ghcr.io/openrelik/openrelik-worker-chromecreds:latest76d4fbcc6ff0
opentelemetry-api@1.32.1
1.45.1
1
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
opentelemetry-api@1.32.1
1.45.1
1
ghcr.io/openrelik/openrelik-worker-extraction:latestec9fc5864cd5
opentelemetry-api@1.32.1
1.45.1
1
ghcr.io/openrelik/openrelik-worker-grep:latest470ff3529746
opentelemetry-api@1.32.1
1.45.1
1
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
opentelemetry-api@1.32.1
1.45.1
1
ghcr.io/openrelik/openrelik-worker-plaso:latest8caaf6e36654
opentelemetry-api@1.32.1
1.45.1
1
ghcr.io/openrelik/openrelik-worker-strings:latest6e05055b701f
opentelemetry-api@1.32.1
1.45.1
1
ghcr.io/openrelik/openrelik-worker-timesketch:latest4cb88b603cdc
opentelemetry-api@1.32.1
1.45.1
1
ghcr.io/openrelik/openrelik-worker-yara:latestbd7fbf4505b5
opentelemetry-api@1.32.1
1.45.1
1
ghcr.io/open-telemetry/demo:3.1.0-chatbot604b1f493c92
opentelemetry-api@1.44.0
1.45.1
1
ghcr.io/open-telemetry/demo:3.1.0-mcp81db69cdd0b6
opentelemetry-api@1.43.0
1.45.1
1
ghcr.io/open-telemetry/demo:1.12.0-loadgenerator85c9935ff31b
opentelemetry-api@1.25.0
1.45.1
1
ghcr.io/open-telemetry/demo:3.1.0-recommendation9dd7d7c320d2
opentelemetry-api@1.43.0
1.45.1
1
ghcr.io/open-telemetry/demo:3.1.0-load-generatorb130d6cee6cb
opentelemetry-api@1.42.0
1.45.1
1
ghcr.io/open-telemetry/demo:1.12.0-recommendationserviceb294a4278407
opentelemetry-api@1.25.0
1.45.1
1
ghcr.io/open-telemetry/demo:3.1.0-agentd0f4ae0b32a8
opentelemetry-api@1.43.0
1.45.1
1
ghcr.io/quenchworks/images/airflowa5b99d7c37be
opentelemetry-api@1.44.0
1.45.1
1
ghcr.io/securo-finance/securo-backend:0.16.50e40c6858fb3
opentelemetry-api@1.45.0
1.45.1
1
ghcr.io/serenita-org/vero:v0.8.3e5a7ec714acc
opentelemetry-api@1.24.0
1.45.1
1
ghcr.io/stac-utils/titiler-pgstac:3.2.09a35f907dc70
opentelemetry-api@1.44.0
1.45.1
1
public.ecr.aws/datadog/agent:7.73.0f4925b15ce94
opentelemetry-api@1.39.0
1.45.1
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
opentelemetry-api@1.39.1
1.45.1
1
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
opentelemetry-api@1.29.0
1.45.1
1
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
opentelemetry-api@1.29.0
1.45.1
1
quay.io/opsmxpublic/ubi8-oes-datascience:isd-spin-2025.10.01-af26a30d4-202511261054d8f66f4117fe
opentelemetry-api@1.38.0
1.45.1
1

syft 1.42.1 · advisories as of 23 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.