StackRadar

CVE-2026-24051

High

Advisory

Published 2 Feb 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.0
base score, highest
EPSS
0.002
6th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
554
of 17,787 indexed, latest versions
Container images
563
deployed by those charts
Fix available
1 of 1
affected package

OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

Carried by container images the latest versions of 554 of 17,787 indexed charts deploy, on 563 images.

Affected packageAffected versionsFixed inImages
go.opentelemetry.io/otel/sdkgolangv1.21.0, v1.22.0, v1.23.0, v1.23.1+16 more1.40.0563
OSV records
GHSA-9h8m-3fm2-qjrq
Also known as
GO-2026-4394

Charts affected

554 by stars
ChartLatestAffected imagesRadar Score
secretssecrets-proxy1.0.61 of 1See more

secrets secrets-proxy 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
udhos/secrets:1.0.6daa2b4eaac09
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0

Open the chart page →

987
semaphoresemaphore-light1.0.01 of 1See more

semaphore semaphore-light 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
semaphoreui/semaphore:latest3996804607eb
go.opentelemetry.io/otel/sdk@v1.38.0
1.40.0

Open the chart page →

1,674
ccx-monitoringseveralnines0.6.211 of 7See more

ccx-monitoring severalnines 0.6.21

1 of the 7 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
grafana/grafana:12.3.12175aaa91c96
go.opentelemetry.io/otel/sdk@v1.38.0
1.40.0

Open the chart page →

7,709
bffshortlink0.2.11 of 1See more

bff shortlink 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
registry.gitlab.com/shortlink-org/shortlink/bff:latestf2194e526915
go.opentelemetry.io/otel/sdk@v1.39.0
1.40.0

Open the chart page →

1,691
linkshortlink0.7.31 of 1See more

link shortlink 0.7.3

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
go.opentelemetry.io/otel/sdk@v1.39.0
1.40.0

Open the chart page →

1,675
olmsikalabs0.3.01 of 2See more

olm sikalabs 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
quay.io/operator-framework/olmdigest-pinned40d0363f4aa6
go.opentelemetry.io/otel/sdk@v1.23.1
1.40.0

Open the chart page →

1,146
mongosyncsinextraVerified publisher0.4.01 of 1See more

mongosync sinextra 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/mongosync:1.15.0fa99ed475f03
go.opentelemetry.io/otel/sdk@v1.36.0
1.40.0

Open the chart page →

2,854
tailscalesinextraVerified publisher0.18.11 of 2See more

tailscale sinextra 0.18.1

1 of the 2 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
registry.k8s.io/coredns/coredns:v1.13.294caebb89dcf
go.opentelemetry.io/otel/sdk@v1.38.0
1.40.0

Open the chart page →

1,047
teamcitysinextraVerified publisher1.0.21 of 3See more

teamcity sinextra 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
library/docker:26.1-dinddd43b430341a
go.opentelemetry.io/otel/sdk@v1.21.0
1.40.0

Open the chart page →

2,429
skypilot-prometheus-serverskypilotVerified publisher0.11.11 of 3See more

skypilot-prometheus-server skypilot 0.11.1

1 of the 3 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v3.4.19abc6cf6aea7
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0

Open the chart page →

2,344
snspingsnsping1.2.91 of 1See more

snsping snsping 1.2.9

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
udhos/snsping:1.2.96ae70677b6a3
go.opentelemetry.io/otel/sdk@v1.33.0
1.40.0

Open the chart page →

1,326
cost-analyzersoftonic2.5.53 of 6See more

cost-analyzer softonic 2.5.5

3 of the 6 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
grafana/grafana:11.5.28b37a2f028f1
go.opentelemetry.io/otel/sdk@v1.33.0
1.40.0
gcr.io/kubecost1/cost-model:prod-2.5.502b90651367f
go.opentelemetry.io/otel/sdk@v1.29.0
1.40.0
quay.io/prometheus/prometheus:v3.2.16927e0919a14
go.opentelemetry.io/otel/sdk@v1.34.0
1.40.0

Open the chart page →

7,935
kedasoftonic2.17.02 of 3See more

keda softonic 2.17.0

2 of the 3 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/kedacore/keda:2.17.0112fc427d933
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0
ghcr.io/kedacore/keda-metrics-apiserver:2.17.0167fd532bd43
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0

Open the chart page →

2,583
kube-prometheus-stacksoftonic81.5.12 of 6See more

kube-prometheus-stack softonic 81.5.1

2 of the 6 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
grafana/grafana:12.3.2ba93c9d192e5
go.opentelemetry.io/otel/sdk@v1.38.0
1.40.0
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.01545919b72e3
go.opentelemetry.io/otel/sdk@v1.37.0
1.40.0

Open the chart page →

4,975
datadogspartan0.1.01 of 1See more

datadog spartan 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
gcr.io/datadoghq/cluster-agent:7.61.06efe04ba4e06
go.opentelemetry.io/otel/sdk@v1.32.0
1.40.0

Open the chart page →

3,272
ambassador-manifestssqream-chartsVerified publisher0.6.31 of 1See more

ambassador-manifests sqream-charts 0.6.3

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
datawire/aes:3.11.195ec30b3c732
go.opentelemetry.io/otel/sdk@v1.25.0
1.40.0

Open the chart page →

2,415
retail-store-sample-catalog-chartstacksimplifyVerified publisher2.0.01 of 1See more

retail-store-sample-catalog-chart stacksimplify 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-catalog:1.3.0b654b266fa32
go.opentelemetry.io/otel/sdk@v1.37.0
1.40.0

Open the chart page →

759
stakefishstakefish0.1.01 of 8See more

stakefish stakefish 0.1.0

1 of the 8 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
prom/prometheus:v2.52.05c435642ca4d
go.opentelemetry.io/otel/sdk@v1.25.0
1.40.0

Open the chart page →

18,426
ipfsstakewise2.2.01 of 2See more

ipfs stakewise 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ipfs/kubo:v0.33.21a30f5ed8579
go.opentelemetry.io/otel/sdk@v1.31.0
1.40.0

Open the chart page →

1,239
ssv-nodestakewise2.2.01 of 2See more

ssv-node stakewise 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
bloxstaking/ssv-node:v2.2.0bf6d7d2fdc93
go.opentelemetry.io/otel/sdk@v1.32.0
1.40.0

Open the chart page →

6,531
v3-backendstakewise3.6.01 of 5See more

v3-backend stakewise 3.6.0

1 of the 5 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ipfs/kubo:v0.33.21a30f5ed8579
go.opentelemetry.io/otel/sdk@v1.31.0
1.40.0

Open the chart page →

1,239
supabase-operatorstrrl-helm2026.7.251 of 1See more

supabase-operator strrl-helm 2026.7.25

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/strrl/supabase-operator:2026.7.2587d083ab8980
go.opentelemetry.io/otel/sdk@v1.37.0
1.40.0

Open the chart page →

223
stunner-prometheusstunner0.2.11 of 4See more

stunner-prometheus stunner 0.2.1

1 of the 4 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
quay.io/brancz/kube-rbac-proxy:v0.18.1e6a323504999
go.opentelemetry.io/otel/sdk@v1.28.0
1.40.0

Open the chart page →

3,026
group-challengesubshell-labVerified publisher2.1.01 of 2See more

group-challenge subshell-lab 2.1.0

1 of the 2 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
darthsim/imgproxy:v3.29.17d12c7c8fc66
go.opentelemetry.io/otel/sdk@v1.37.0
1.40.0

Open the chart page →

2,579
supabase-operatorsupabse0.1.31 of 1See more

supabase-operator supabse 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/supabase-community/supabase-operator:v0.1.3253a6dcbf4f0
go.opentelemetry.io/otel/sdk@v1.36.0
1.40.0

Open the chart page →

223
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
go.opentelemetry.io/otel/sdk@v1.37.0
1.40.0

Open the chart page →

3,372
stash-boxswuuper-githubVerified publisher0.1.11 of 2See more

stash-box swuuper-github 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
stashapp/stash-box:latesta534c8afdf39
go.opentelemetry.io/otel/sdk@v1.33.0
1.40.0

Open the chart page →

8,251
agentssynapse0.1.301 of 9See more

agents synapse 0.1.30

1 of the 9 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/omnirpc:latest5217e3d1fc70
go.opentelemetry.io/otel/sdk@v1.28.0
1.40.0

Open the chart page →

7,244
explorersynapse0.2.162 of 6See more

explorer synapse 0.2.16

2 of the 6 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/explorer:latest00131e3d1eaf
go.opentelemetry.io/otel/sdk@v1.28.0
1.40.0
ghcr.io/synapsecns/sanguine/omnirpc:latest5217e3d1fc70
go.opentelemetry.io/otel/sdk@v1.28.0
1.40.0

Open the chart page →

8,556
omnirpcsynapse0.2.921 of 2See more

omnirpc synapse 0.2.92

1 of the 2 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/omnirpc:latest5217e3d1fc70
go.opentelemetry.io/otel/sdk@v1.28.0
1.40.0

Open the chart page →

1,121
screenersynapse0.2.51 of 4See more

screener synapse 0.2.5

1 of the 4 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/screener-api:latestb3de2050460a
go.opentelemetry.io/otel/sdk@v1.28.0
1.40.0

Open the chart page →

1,091
scribesynapse0.2.162 of 7See more

scribe synapse 0.2.16

2 of the 7 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/omnirpc:latest5217e3d1fc70
go.opentelemetry.io/otel/sdk@v1.28.0
1.40.0
ghcr.io/synapsecns/sanguine/scribe:latest81edba952403
go.opentelemetry.io/otel/sdk@v1.28.0
1.40.0

Open the chart page →

2,680
sinnersynapse0.1.01 of 6See more

sinner synapse 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/sinner:latest3e98a98f6074
go.opentelemetry.io/otel/sdk@v1.21.0
1.40.0

Open the chart page →

1,955
ccm-hetznersyself2.0.71 of 1See more

ccm-hetzner syself 2.0.7

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/syself/hetzner-cloud-controller-manager:v2.0.77d4a5e29c387
go.opentelemetry.io/otel/sdk@v1.33.0
1.40.0

Open the chart page →

702
the0the0Verified publisher0.9.81 of 9See more

the0 the0 0.9.8

1 of the 9 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0

Open the chart page →

7,336
netbirdtotmicro1.8.23 of 4See more

netbird totmicro 1.8.2

3 of the 4 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
netbirdio/management:0.60.252682e5f48f9
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0
netbirdio/relay:0.60.2a10762533793
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0
netbirdio/signal:0.60.267176bcbf6ab
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0

Open the chart page →

5,966
traktortraktorVerified publisher0.0.171 of 1See more

traktor traktor 0.0.17

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
gdxbsv/traktor:0.0.17675693335054
go.opentelemetry.io/otel/sdk@v1.33.0
1.40.0

Open the chart page →

368
trident-protect-bxp-previewtrident-protect100.2511.0-bxp-preview1 of 3See more

trident-protect-bxp-preview trident-protect 100.2511.0-bxp-preview

1 of the 3 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
netapp/controller:25.11.0-bxp-preview06f6c9a0653f
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0

Open the chart page →

2,184
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
go.opentelemetry.io/otel/sdk@v1.24.0
1.40.0

Open the chart page →

2,478
tfy-llm-gateway-infratruefoundryVerified publisher0.2.102 of 3See more

tfy-llm-gateway-infra truefoundry 0.2.10

2 of the 3 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.23.774315beb57db
go.opentelemetry.io/otel/sdk@v1.24.0
1.40.0
altinity/metrics-exporter:0.23.7a4d7ff0c727e
go.opentelemetry.io/otel/sdk@v1.24.0
1.40.0

Open the chart page →

1,204
truefoundry-monitoringtruefoundryVerified publisher0.1.62 of 8See more

truefoundry-monitoring truefoundry 0.1.6

2 of the 8 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
grafana/grafana:12.3.070d9599b186c
go.opentelemetry.io/otel/sdk@v1.38.0
1.40.0
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.01545919b72e3
go.opentelemetry.io/otel/sdk@v1.37.0
1.40.0

Open the chart page →

4,529
opencloudunxwaresVerified publisher0.2.32 of 13See more

opencloud unxwares 0.2.3

2 of the 13 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0
opencloudeu/opencloud-rolling:2.1.0f9634bb04905
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0

Open the chart page →

45,392
vals-operatorvals-operatorVerified publisher0.8.11 of 1See more

vals-operator vals-operator 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/digitalis-io/vals-operator:v0.8.17c776499b8c9
go.opentelemetry.io/otel/sdk@v1.39.0
1.40.0

Open the chart page →

696
corednsvks-helm-chartsVerified publisher1.45.01 of 1See more

coredns vks-helm-charts 1.45.0

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
coredns/coredns:1.13.19b9128672209
go.opentelemetry.io/otel/sdk@v1.37.0
1.40.0

Open the chart page →

887
aih-scannerwallarmVerified publisher2.7.111 of 2See more

aih-scanner wallarm 2.7.11

1 of the 2 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
wallarm/aih-scanner:2.7.11f1cb26db1f5b
go.opentelemetry.io/otel/sdk@v1.37.0
1.40.0

Open the chart page →

3,906
valkey-operatorwellcakeVerified publisher0.8.11 of 1See more

valkey-operator wellcake 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/melancholictheory/wellcake:0.8.12fd2678f07ef
go.opentelemetry.io/otel/sdk@v1.36.0
1.40.0

Open the chart page →

110
apisixwenerme2.17.01 of 3See more

apisix wenerme 2.17.0

1 of the 3 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
bitnamilegacy/etcd:latest99b408c15272
go.opentelemetry.io/otel/sdk@v1.34.0
1.40.0

Open the chart page →

3,096
argo-eventswenerme2.4.271 of 1See more

argo-events wenerme 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
go.opentelemetry.io/otel/sdk@v1.36.0
1.40.0

Open the chart page →

969
athens-proxywenerme0.5.21 of 2See more

athens-proxy wenerme 0.5.2

1 of the 2 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
jaegertracing/all-in-one:latestab6f1a1f0fb4
go.opentelemetry.io/otel/sdk@v1.38.0
1.40.0

Open the chart page →

4,985
wexa-studiowexa-studio1.2.02 of 15See more

wexa-studio wexa-studio 1.2.0

2 of the 15 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0
temporalio/server:1.29.1c1e3326b2ce1
go.opentelemetry.io/otel/sdk@v1.34.0
1.40.0

Open the chart page →

14,618

Container images carrying it

563 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
go.opentelemetry.io/otel/sdk@v1.39.0
1.40.0
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
go.opentelemetry.io/otel/sdk@v1.33.0
1.40.0
1
registry.gitlab.com/xrow-public/developer-operator/developer-operator-controller:2.1.2301847adfe16
go.opentelemetry.io/otel/sdk@v1.36.0
1.40.0
1
registry.k8s.io/autoscaling/cluster-autoscaler:v1.33.06ef10d108e0e
go.opentelemetry.io/otel/sdk@v1.33.0
1.40.0
1
registry.k8s.io/autoscaling/cluster-autoscaler:v1.34.07b172f42533c
go.opentelemetry.io/otel/sdk@v1.34.0
1.40.0
1
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.32.0f9f4dfd733ab
go.opentelemetry.io/otel/sdk@v1.28.0
1.40.0
1
registry.k8s.io/coredns/coredns:v1.13.294caebb89dcf
go.opentelemetry.io/otel/sdk@v1.38.0
1.40.0
1
registry.k8s.io/dns/k8s-dns-node-cache:1.26.78b9a78d101a1
go.opentelemetry.io/otel/sdk@v1.37.0
1.40.0
1
registry.k8s.io/etcd:3.6.4-0e36c08168342
go.opentelemetry.io/otel/sdk@v1.34.0
1.40.0
1
registry.k8s.io/metrics-server/metrics-server:v0.7.01c0419326500
go.opentelemetry.io/otel/sdk@v1.21.0
1.40.0
1
registry.k8s.io/metrics-server/metrics-server:v0.7.1db3800085a09
go.opentelemetry.io/otel/sdk@v1.21.0
1.40.0
1
registry.k8s.io/sig-storage/csi-attacher:v4.10.0be59d0556508
go.opentelemetry.io/otel/sdk@v1.34.0
1.40.0
1
registry.k8s.io/sig-storage/csi-resizer:v2.0.04a95d94e57ad
go.opentelemetry.io/otel/sdk@v1.34.0
1.40.0
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.