StackRadar

CVE-2026-24051

High

Advisory

Published 2 Feb 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.0
base score, highest
EPSS
0.002
6th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
548
of 17,787 indexed, latest versions
Container images
552
deployed by those charts
Fix available
1 of 1
affected package

OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

Carried by container images the latest versions of 548 of 17,787 indexed charts deploy, on 552 images.

Affected packageAffected versionsFixed inImages
go.opentelemetry.io/otel/sdkgolangv1.21.0, v1.22.0, v1.23.0, v1.23.1+16 more1.40.0552
OSV records
GHSA-9h8m-3fm2-qjrq
Also known as
GO-2026-4394

Charts affected

548 by stars
ChartLatestAffected imagesRadar Score
argo-cdargoOfficialVerified publisher10.9.11See more

argo-cd argo 10.9.1

1 container image this version deploys carries CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.45.18499afd690c4
go.opentelemetry.io/otel/sdk@v1.39.0
1.40.0

Open the chart page →

—
artifact-hubartifact-hubVerified publisher1.23.01 of 7See more

artifact-hub artifact-hub 1.23.0

1 of the 7 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
artifacthub/tracker:v1.23.05368d21a6e5c
go.opentelemetry.io/otel/sdk@v1.37.0
1.40.0

Open the chart page →

10,755
argo-cdargo-cd-oci10.9.11See more

argo-cd argo-cd-oci 10.9.1

1 container image this version deploys carries CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.45.18499afd690c4
go.opentelemetry.io/otel/sdk@v1.39.0
1.40.0

Open the chart page →

—
mimir-distributedgrafana6.2.01 of 6See more

mimir-distributed grafana 6.2.0

1 of the 6 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2024-12-18T13-15-44Z1dce27c494a1
go.opentelemetry.io/otel/sdk@v1.32.0
1.40.0

Open the chart page →

4,517
dexdexVerified publisher0.24.11 of 1See more

dex dex 0.24.1

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.44.05d0656fce7d4
go.opentelemetry.io/otel/sdk@v1.36.0
1.40.0

Open the chart page →

1,765
argo-eventsargoOfficialVerified publisher2.4.271 of 1See more

argo-events argo 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
go.opentelemetry.io/otel/sdk@v1.36.0
1.40.0

Open the chart page →

969
openebsopenebsOfficialVerified publisher4.6.16 of 35See more

openebs openebs 4.6.1

6 of the 35 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
grafana/alloy:v1.8.17790f6f7fbd8
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0
grafana/loki:3.4.258a6c186ce78
go.opentelemetry.io/otel/sdk@v1.33.0
1.40.0
openebs/etcd:3.6.4-debian-12-r0c86c06f1ce6a
go.opentelemetry.io/otel/sdk@v1.34.0
1.40.0
quay.io/minio/minio:RELEASE.2024-12-18T13-15-44Z1dce27c494a1
go.opentelemetry.io/otel/sdk@v1.32.0
1.40.0
registry.k8s.io/sig-storage/csi-provisioner:v6.1.0e5900dc98b0d
go.opentelemetry.io/otel/sdk@v1.37.0
1.40.0
registry.k8s.io/sig-storage/csi-resizer:v2.0.04a95d94e57ad
go.opentelemetry.io/otel/sdk@v1.34.0
1.40.0

Open the chart page →

23,894
prometheus-adapterprometheus-communityOfficialVerified publisher5.3.01 of 1See more

prometheus-adapter prometheus-community 5.3.0

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
registry.k8s.io/prometheus-adapter/prometheus-adapter:v0.12.0932eae60e2bc
go.opentelemetry.io/otel/sdk@v1.21.0
1.40.0

Open the chart page →

930
apisixapisix2.17.01 of 3See more

apisix apisix 2.17.0

1 of the 3 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
bitnamilegacy/etcd:latest99b408c15272
go.opentelemetry.io/otel/sdk@v1.34.0
1.40.0

Open the chart page →

3,045
miniominio-official5.4.01 of 2See more

minio minio-official 5.4.0

1 of the 2 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2024-12-18T13-15-44Z1dce27c494a1
go.opentelemetry.io/otel/sdk@v1.32.0
1.40.0

Open the chart page →

2,483
jaeger-operatorjaegertracingOfficialVerified publisher2.57.01 of 1See more

jaeger-operator jaegertracing 2.57.0

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
jaegertracing/jaeger-operator:1.61.03f036ec60e61
go.opentelemetry.io/otel/sdk@v1.30.0
1.40.0

Open the chart page →

566
vault-secrets-operatorhashicorpVerified publisher1.5.11 of 2See more

vault-secrets-operator hashicorp 1.5.1

1 of the 2 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
quay.io/brancz/kube-rbac-proxy:v0.18.1e6a323504999
go.opentelemetry.io/otel/sdk@v1.28.0
1.40.0

Open the chart page →

1,040
ceph-csi-cephfsceph-csiOfficialVerified publisher3.17.12 of 6See more

ceph-csi-cephfs ceph-csi 3.17.1

2 of the 6 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-attacher:v4.11.0b74b05b39501
go.opentelemetry.io/otel/sdk@v1.36.0
1.40.0
registry.k8s.io/sig-storage/csi-resizer:v2.1.0589e525cddef
go.opentelemetry.io/otel/sdk@v1.39.0
1.40.0

Open the chart page →

4,061
ceph-csi-rbdceph-csiOfficialVerified publisher3.17.12 of 6See more

ceph-csi-rbd ceph-csi 3.17.1

2 of the 6 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-attacher:v4.11.0b74b05b39501
go.opentelemetry.io/otel/sdk@v1.36.0
1.40.0
registry.k8s.io/sig-storage/csi-resizer:v2.1.0589e525cddef
go.opentelemetry.io/otel/sdk@v1.39.0
1.40.0

Open the chart page →

4,061
atlantisatlantis6.15.11See more

atlantis atlantis 6.15.1

1 container image this version deploys carries CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/runatlantis/atlantis:v0.47.1511231955463
go.opentelemetry.io/otel/sdk@v1.30.0
1.40.0

Open the chart page →

—
grafana-agentgrafana0.44.21 of 2See more

grafana-agent grafana 0.44.2

1 of the 2 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
grafana/agent:v0.44.23364714a2f64
go.opentelemetry.io/otel/sdk@v1.24.0
1.40.0

Open the chart page →

3,475
semaphoresemaphoreuiOfficialVerified publisher16.2.21 of 1See more

semaphore semaphoreui 16.2.2

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
semaphoreui/semaphore:v2.18.3e9260bfa8255
go.opentelemetry.io/otel/sdk@v1.38.0
1.40.0

Open the chart page →

2,221
node-local-dnsdeliveryheroVerified publisher2.9.21 of 1See more

node-local-dns deliveryhero 2.9.2

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
registry.k8s.io/dns/k8s-dns-node-cache:1.26.78b9a78d101a1
go.opentelemetry.io/otel/sdk@v1.37.0
1.40.0

Open the chart page →

1,685
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0

Open the chart page →

19,391
opensearch-operatoropensearch-operatorVerified publisher3.0.21 of 1See more

opensearch-operator opensearch-operator 3.0.2

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
opensearchproject/opensearch-operator:3.0.0-alphaf78bbdd1a386
go.opentelemetry.io/otel/sdk@v1.33.0
1.40.0

Open the chart page →

603
pulsarapache4.7.03 of 10See more

pulsar apache 4.7.0

3 of the 10 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
go.opentelemetry.io/otel/sdk@v1.39.0
1.40.0
grafana/grafana:12.4.1e932bd6ed0e0
go.opentelemetry.io/otel/sdk@v1.39.0
1.40.0
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.01545919b72e3
go.opentelemetry.io/otel/sdk@v1.37.0
1.40.0

Open the chart page →

9,864
miniocloudpirates-minioVerified publisher0.13.41 of 1See more

minio cloudpirates-minio 0.13.4

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
cloudpirates/image-minio:RELEASE.2025-10-15T17-29-55Z-hardened8dc02a7e5093
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0

Open the chart page →

961
pyroscopegrafana2.3.11 of 3See more

pyroscope grafana 2.3.1

1 of the 3 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
grafana/alloy:v1.12.2f94b1c82957a
go.opentelemetry.io/otel/sdk@v1.38.0
1.40.0

Open the chart page →

3,157
volsyncbackube-helm-chartsVerified publisher0.16.01 of 1See more

volsync backube-helm-charts 0.16.0

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
quay.io/backube/volsync:0.16.00d03a6aad575
go.opentelemetry.io/otel/sdk@v1.36.0
1.40.0

Open the chart page →

1,346
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
grafana/grafana:11.1.4886b56d5534e
go.opentelemetry.io/otel/sdk@v1.27.0
1.40.0

Open the chart page →

16,251
k8sgpt-operatork8sgptOfficialVerified publisher0.2.291 of 2See more

k8sgpt-operator k8sgpt 0.2.29

1 of the 2 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
quay.io/brancz/kube-rbac-proxy:v0.19.19f21034731c7
go.opentelemetry.io/otel/sdk@v1.28.0
1.40.0

Open the chart page →

966
imgproxyimgproxy1.1.01 of 1See more

imgproxy imgproxy 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/imgproxy/imgproxy:v3.30.074c1bee92e04
go.opentelemetry.io/otel/sdk@v1.38.0
1.40.0

Open the chart page →

2,321
argocdnicklasfrahm-argocdVerified publisher0.3.01 of 2See more

argocd nicklasfrahm-argocd 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
go.opentelemetry.io/otel/sdk@v1.36.0
1.40.0

Open the chart page →

5,240
netbirdjaconiVerified publisher0.15.13 of 4See more

netbird jaconi 0.15.1

3 of the 4 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
netbirdio/management:0.45.10c9994b393ea
go.opentelemetry.io/otel/sdk@v1.26.0
1.40.0
netbirdio/relay:0.45.1872e3add0e1e
go.opentelemetry.io/otel/sdk@v1.26.0
1.40.0
netbirdio/signal:0.45.146ce5a45538f
go.opentelemetry.io/otel/sdk@v1.26.0
1.40.0

Open the chart page →

8,390
falcosidekickfalcosecurity0.14.01 of 1See more

falcosidekick falcosecurity 0.14.0

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
falcosecurity/falcosidekick:2.32.01976da721518
go.opentelemetry.io/otel/sdk@v1.38.0
1.40.0

Open the chart page →

1,633
plane-cemakeplaneOfficialVerified publisher1.8.11 of 11See more

plane-ce makeplane 1.8.1

1 of the 11 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2025-09-07T16-13-09Z14cea493d9a3
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0

Open the chart page →

4,854
milvusmilvus-helm5.0.282See more

milvus milvus-helm 5.0.28

2 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
milvusdb/etcd:3.5.25-r1fededb2f2d63
go.opentelemetry.io/otel/sdk@v1.34.0
1.40.0
quay.io/minio/minio:RELEASE.2024-12-18T13-15-44Z1dce27c494a1
go.opentelemetry.io/otel/sdk@v1.32.0
1.40.0

Open the chart page →

—
ansible-semaphorecloudhippieVerified publisher15.2.101 of 1See more

ansible-semaphore cloudhippie 15.2.10

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
semaphoreui/semaphore:v2.19.1498ad9bc7a2a0
go.opentelemetry.io/otel/sdk@v1.30.0
1.40.0

Open the chart page →

1,235
codefreshcodefresh-onpremOfficialVerified publisher2.12.131 of 42See more

codefresh codefresh-onprem 2.12.13

1 of the 42 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
bitnamilegacy/consul:1.21.4-debian-12-r133ae872fc99d
go.opentelemetry.io/otel/sdk@v1.24.0
1.40.0

Open the chart page →

14,956
supabasetokens-studioVerified publisher1.0.02 of 14See more

supabase tokens-studio 1.0.0

2 of the 14 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
darthsim/imgproxy:v3.26476cb08c816a
go.opentelemetry.io/otel/sdk@v1.31.0
1.40.0
supabase/gotrue:v2.163.0ba4ddc594b0b
go.opentelemetry.io/otel/sdk@v1.26.0
1.40.0

Open the chart page →

23,123
budibasebudibase0.0.0-master1 of 7See more

budibase budibase 0.0.0-master

1 of the 7 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0

Open the chart page →

10,775
jaeger-all-in-onejaeger-all-in-oneVerified publisher0.1.121 of 1See more

jaeger-all-in-one jaeger-all-in-one 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
jaegertracing/all-in-one:1.55f6b5d09073f1
go.opentelemetry.io/otel/sdk@v1.24.0
1.40.0

Open the chart page →

1,216
tailing-sidecar-operatortailing-sidecar-operatorOfficialVerified publisher0.111.01 of 2See more

tailing-sidecar-operator tailing-sidecar-operator 0.111.0

1 of the 2 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
quay.io/brancz/kube-rbac-proxy:v0.19.19f21034731c7
go.opentelemetry.io/otel/sdk@v1.28.0
1.40.0

Open the chart page →

1,205
openstack-cinder-csicloud-provider-openstack2.36.52 of 7See more

openstack-cinder-csi cloud-provider-openstack 2.36.5

2 of the 7 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-attacher:v4.10.0be59d0556508
go.opentelemetry.io/otel/sdk@v1.34.0
1.40.0
registry.k8s.io/sig-storage/csi-snapshotter:v8.4.0c7e0a3718832
go.opentelemetry.io/otel/sdk@v1.34.0
1.40.0

Open the chart page →

3,604
hcloud-csihcloud2.23.02 of 6See more

hcloud-csi hcloud 2.23.0

2 of the 6 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-attacher:v4.11.0b74b05b39501
go.opentelemetry.io/otel/sdk@v1.36.0
1.40.0
registry.k8s.io/sig-storage/csi-resizer:v2.1.0589e525cddef
go.opentelemetry.io/otel/sdk@v1.39.0
1.40.0

Open the chart page →

2,630
ilumilumOfficialVerified publisher6.7.31 of 19See more

ilum ilum 6.7.3

1 of the 19 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2025.3.12-debian-12-r0ba9f3b4b0b00
go.opentelemetry.io/otel/sdk@v1.33.0
1.40.0

Open the chart page →

23,228
kube-greenkube-green-officialOfficialVerified publisher0.7.11 of 1See more

kube-green kube-green-official 0.7.1

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
kubegreen/kube-green:0.7.12dc0f0a6034c
go.opentelemetry.io/otel/sdk@v1.33.0
1.40.0

Open the chart page →

493
k8s-infrasignoz0.17.11 of 1See more

k8s-infra signoz 0.17.1

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.139.0faf125d656fa
go.opentelemetry.io/otel/sdk@v1.38.0
1.40.0

Open the chart page →

1,039
astarte-operatorastarteOfficialVerified publisher26.5.21 of 1See more

astarte-operator astarte 26.5.2

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
astarte/astarte-kubernetes-operator:26.5.1e3ff1b3c0c98
go.opentelemetry.io/otel/sdk@v1.28.0
1.40.0

Open the chart page →

695
emqx-operatoremqx-operator2.3.22 of 2See more

emqx-operator emqx-operator 2.3.2

2 of the 2 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
alpine/k8s:1.31.49c4976d47656
go.opentelemetry.io/otel/sdk@v1.29.0
1.40.0
ghcr.io/emqx/emqx-operator:2.3.23333ed546165
go.opentelemetry.io/otel/sdk@v1.28.0
1.40.0

Open the chart page →

4,531
keptnlifecycle-toolkitOfficialVerified publisher0.11.02 of 3See more

keptn lifecycle-toolkit 0.11.0

2 of the 3 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/keptn/lifecycle-operator:v2.0.0866ced256a8c
go.opentelemetry.io/otel/sdk@v1.31.0
1.40.0
ghcr.io/keptn/metrics-operator:v2.1.0dc48471c7cf8
go.opentelemetry.io/otel/sdk@v1.31.0
1.40.0

Open the chart page →

1,927
thehivestrangebee-helmOfficialVerified publisher1.0.61 of 7See more

thehive strangebee-helm 1.0.6

1 of the 7 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2025-09-07T16-13-09Z14cea493d9a3
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0

Open the chart page →

16,210
truenas-csptruenas-cspVerified publisher1.2.41 of 11See more

truenas-csp truenas-csp 1.2.4

1 of the 11 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-resizer:v2.1.0589e525cddef
go.opentelemetry.io/otel/sdk@v1.39.0
1.40.0

Open the chart page →

5,759
uffizzi-controlleruffizzi-controller2.4.62 of 11See more

uffizzi-controller uffizzi-controller 2.4.6

2 of the 11 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-controller:v1.14.59c0527cab629
go.opentelemetry.io/otel/sdk@v1.21.0
1.40.0
quay.io/jetstack/cert-manager-webhook:v1.14.5ef419261a209
go.opentelemetry.io/otel/sdk@v1.21.0
1.40.0

Open the chart page →

14,240
kubedbappscodeVerified publisher2026.7.101 of 8See more

kubedb appscode 2026.7.10

1 of the 8 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/appscode/sidekick:v0.0.15d1036b07e348
go.opentelemetry.io/otel/sdk@v1.36.0
1.40.0

Open the chart page →

4,016

Container images carrying it

552 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/csi-attacher:v4.10.0be59d0556508
go.opentelemetry.io/otel/sdk@v1.34.0
1.40.0
1
registry.k8s.io/sig-storage/csi-resizer:v2.0.04a95d94e57ad
go.opentelemetry.io/otel/sdk@v1.34.0
1.40.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.