StackRadar

CVE-2026-24051

High

Advisory

Published 2 Feb 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.0
base score, highest
EPSS
0.002
6th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
554
of 17,787 indexed, latest versions
Container images
563
deployed by those charts
Fix available
1 of 1
affected package

OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

Carried by container images the latest versions of 554 of 17,787 indexed charts deploy, on 563 images.

Affected packageAffected versionsFixed inImages
go.opentelemetry.io/otel/sdkgolangv1.21.0, v1.22.0, v1.23.0, v1.23.1+16 more1.40.0563
OSV records
GHSA-9h8m-3fm2-qjrq
Also known as
GO-2026-4394

Charts affected

554 by stars
ChartLatestAffected imagesRadar Score
jaegerwikimedia3.1.21 of 4See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
jaegertracing/jaeger-query:1.53.0049bb0d64ea3
go.opentelemetry.io/otel/sdk@v1.21.0
1.40.0

Open the chart page →

9,296
registrywiremindVerified publisher0.1.11 of 1See more

registry wiremind 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
ghcr.io/distribution/distribution:3.0.04ba3adf47f5c
go.opentelemetry.io/otel/sdk@v1.32.0
1.40.0

Open the chart page →

1,187
xonodepoolsxonodepoolsOfficialVerified publisher1.0.71 of 1See more

xonodepools xonodepools 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
xosphere/xonodepools:1.0.71458097b6f85
go.opentelemetry.io/otel/sdk@v1.36.0
1.40.0

Open the chart page →

388
ygdrassil-monitoringygdrassilVerified publisher0.4.02 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-24051.

Container imageDigestPackageFixed in
grafana/grafana:11.5.15781759b3d27
go.opentelemetry.io/otel/sdk@v1.33.0
1.40.0
quay.io/prometheus/prometheus:v3.1.06559acbd5d77
go.opentelemetry.io/otel/sdk@v1.33.0
1.40.0

Open the chart page →

9,381

Container images carrying it

563 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/kedacore/keda:2.17.272dc058e478d
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0
1
ghcr.io/kedacore/keda-metrics-apiserver:2.17.0167fd532bd43
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0
1
ghcr.io/kedacore/keda-metrics-apiserver:2.16.073a2ebae4413
go.opentelemetry.io/otel/sdk@v1.31.0
1.40.0
1
ghcr.io/kedacore/keda-metrics-apiserver:2.17.2f312f50ddc57
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0
1
ghcr.io/kgma74/dockyard:0.4.0b40439329191
go.opentelemetry.io/otel/sdk@v1.28.0
1.40.0
1
ghcr.io/kluster-manager/cluster-gateway:v1.12.158bed8d1e7fc
go.opentelemetry.io/otel/sdk@v1.38.0
1.40.0
1
ghcr.io/kluster-manager/cluster-gateway-manager:v1.12.1f22cae0e6cf3
go.opentelemetry.io/otel/sdk@v1.38.0
1.40.0
1
ghcr.io/kluster-manager/fluxcd-addon:v0.0.103475404bef5c
go.opentelemetry.io/otel/sdk@v1.37.0
1.40.0
1
ghcr.io/kluster-manager/registration-operator:v1.2.00cbced8e6240
go.opentelemetry.io/otel/sdk@v1.38.0
1.40.0
1
ghcr.io/kuberecord/kuberecord:v0.4.02a19792ad2ec
go.opentelemetry.io/otel/sdk@v1.39.0
1.40.0
1
ghcr.io/kubiyabot/tool-manager:0.5.80cca6760763a
go.opentelemetry.io/otel/sdk@v1.37.0
1.40.0
1
ghcr.io/kubiyabot/workflow-engine:v1.46.2560a16a56d4e
go.opentelemetry.io/otel/sdk@v1.33.0
1.40.0
1
ghcr.io/kuoss/ingress-annotator:v0.3.0ae179f65d869
go.opentelemetry.io/otel/sdk@v1.34.0
1.40.0
1
ghcr.io/kyverno/background-controller:v1.12.506ed5db6cd33
go.opentelemetry.io/otel/sdk@v1.24.0
1.40.0
1
ghcr.io/kyverno/cleanup-controller:v1.12.5b914032ef9ad
go.opentelemetry.io/otel/sdk@v1.24.0
1.40.0
1
ghcr.io/kyverno/kyverno:v1.12.5a61c7022abcf
go.opentelemetry.io/otel/sdk@v1.24.0
1.40.0
1
ghcr.io/kyverno/kyverno-cli:v1.12.5832a32779e6d
go.opentelemetry.io/otel/sdk@v1.24.0
1.40.0
1
ghcr.io/kyverno/kyvernopre:v1.12.563f7eaf5aa8a
go.opentelemetry.io/otel/sdk@v1.24.0
1.40.0
1
ghcr.io/kyverno/reports-controller:v1.12.5c62e3347611c
go.opentelemetry.io/otel/sdk@v1.24.0
1.40.0
1
ghcr.io/llm-d/llm-d-model-service:v0.0.158b99a8104a2f
go.opentelemetry.io/otel/sdk@v1.34.0
1.40.0
1
ghcr.io/loafoe/caddy-token:v0.3.0528f2174fa2f
go.opentelemetry.io/otel/sdk@v1.21.0
1.40.0
1
ghcr.io/loafoe/go-hello-world:v2.13.0d3fb171f20e1
go.opentelemetry.io/otel/sdk@v1.38.0
1.40.0
1
ghcr.io/lockdep/stackradar-scanner:0.3.0dd8a35d50c2d
go.opentelemetry.io/otel/sdk@v1.39.0
1.40.0
1
ghcr.io/loft-sh/central-hostpath-mapper:0.2.9fa6dba122171
go.opentelemetry.io/otel/sdk@v1.27.0
1.40.0
1
ghcr.io/loft-sh/devpod-pro:0.0.0-ci.4-do-not-use5dfa86b6451f
go.opentelemetry.io/otel/sdk@v1.22.0
1.40.0
1
ghcr.io/loft-sh/kubernetes:v1.35.090097a08b87c
go.opentelemetry.io/otel/sdk@v1.36.0
1.40.0
1
ghcr.io/loft-sh/vcluster-control-plane:0.0.0-ci.4-do-not-use45e744fc623f
go.opentelemetry.io/otel/sdk@v1.22.0
1.40.0
1
ghcr.io/loft-sh/vcluster-hpm:0.2.7f65f6810ea23
go.opentelemetry.io/otel/sdk@v1.34.0
1.40.0
1
ghcr.io/loft-sh/vnode-runtime:0.3.3b065ec5a5239
go.opentelemetry.io/otel/sdk@v1.31.0
1.40.0
1
ghcr.io/lukaszraczylo/jobs-manager-operator:0.1.15e6239e2838d7
go.opentelemetry.io/otel/sdk@v1.39.0
1.40.0
1
ghcr.io/lukaszraczylo/kubernetes-images-sync-operator:0.5.57a424948c8143
go.opentelemetry.io/otel/sdk@v1.39.0
1.40.0
1
ghcr.io/luzifer/cert-manager-desec-webhook:v1.0.1fa1f6b2e9a6e
go.opentelemetry.io/otel/sdk@v1.26.0
1.40.0
1
ghcr.io/manzil-infinity180/deploydefender:ea3ab0bb646cdbeddd1aca483ecf650f9ac0d0847fbc6855c8b3
go.opentelemetry.io/otel/sdk@v1.28.0
1.40.0
1
ghcr.io/melancholictheory/wellcake:0.8.12fd2678f07ef
go.opentelemetry.io/otel/sdk@v1.36.0
1.40.0
1
ghcr.io/middleware-labs/mw-kube-agent:1.12.09c7bc0f9bb35
go.opentelemetry.io/otel/sdk@v1.32.0
1.40.0
1
ghcr.io/mosn/htnn-controller:v0.3.1c379e66246be
go.opentelemetry.io/otel/sdk@v1.21.0
1.40.0
1
ghcr.io/movetokube/postgres-operator:2.4.0def57d85a2da
go.opentelemetry.io/otel/sdk@v1.34.0
1.40.0
1
ghcr.io/nginx/nginx-gateway-fabric:2.4.180f3a0a51af5
go.opentelemetry.io/otel/sdk@v1.39.0
1.40.0
1
ghcr.io/nnstd/glauth:2.52e6e09fa77dd
go.opentelemetry.io/otel/sdk@v1.37.0
1.40.0
1
ghcr.io/o0th/cert-manager-webhook-bunny:1.0.2fe7ce555a12d
go.opentelemetry.io/otel/sdk@v1.34.0
1.40.0
1
ghcr.io/oguzhan-yilmaz/argocd-backup-s3:latestb61c750ade19
go.opentelemetry.io/otel/sdk@v1.29.0
1.40.0
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.2035bc5ca66d55a
go.opentelemetry.io/otel/sdk@v1.35.0
1.40.0
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.55d7f93d2182fe
go.opentelemetry.io/otel/sdk@v1.26.0
1.40.0
1
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--steampipe:latestc0c8d53df9f3
go.opentelemetry.io/otel/sdk@v1.28.0
1.40.0
1
ghcr.io/openfaasltd/headroom-controller:v0.0.467d587cc2c39
go.opentelemetry.io/otel/sdk@v1.33.0
1.40.0
1
ghcr.io/open-feature/flagd:v0.11.1a7ea52f87446
go.opentelemetry.io/otel/sdk@v1.28.0
1.40.0
1
ghcr.io/openlit/openlit:1.24.02434560e8f0e
go.opentelemetry.io/otel/sdk@v1.39.0
1.40.0
1
ghcr.io/openlit/openlit-operator:0.0.2457bb5ada68b
go.opentelemetry.io/otel/sdk@v1.33.0
1.40.0
1
ghcr.io/open-telemetry/demo:1.12.0-productcatalogservice008b9b662289
go.opentelemetry.io/otel/sdk@v1.27.0
1.40.0
1
ghcr.io/open-telemetry/demo:1.12.0-checkoutservice380eccdc29e9
go.opentelemetry.io/otel/sdk@v1.27.0
1.40.0
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.