StackRadar

CVE-2026-29181

High

Advisory

Published 7 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.008
54th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
344
of 17,781 indexed, latest versions
Container images
339
deployed by those charts
Fix available
1 of 1
affected package

OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

Carried by container images the latest versions of 344 of 17,781 indexed charts deploy, on 339 images.

Affected packageAffected versionsFixed inImages
go.opentelemetry.io/otelgolangv1.36.0, v1.37.0, v1.38.0, v1.39.0+2 more1.41.0339
OSV records
GHSA-mh2q-q3fh-2475
Also known as
GO-2026-5506

Charts affected

344 by stars
ChartLatestAffected imagesRadar Score
argo-workflowsargo-helm-charts1.0.02 of 2See more

argo-workflows argo-helm-charts 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
quay.io/argoproj/argocli:v3.7.16efd1cb89dc1
go.opentelemetry.io/otel@v1.36.0
1.41.0
quay.io/argoproj/workflow-controller:v3.7.166388d1b2f08
go.opentelemetry.io/otel@v1.36.0
1.41.0

Open the chart page →

1,826
celestia-localastria9.0.02 of 2See more

celestia-local astria 9.0.0

2 of the 2 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-app:v6.1.0-rc0a604aefa3fae
go.opentelemetry.io/otel@v1.38.0
1.41.0
ghcr.io/celestiaorg/celestia-node:v0.27.5-mocha4768ea1c5fd2
go.opentelemetry.io/otel@v1.37.0
1.41.0

Open the chart page →

3,281
celestia-nodeastria0.7.11 of 1See more

celestia-node astria 0.7.1

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-node:v0.27.5-mocha4768ea1c5fd2
go.opentelemetry.io/otel@v1.37.0
1.41.0

Open the chart page →

1,502
csi-driver-nfsbook-k8sinfra-v24.12.11 of 6See more

csi-driver-nfs book-k8sinfra-v2 4.12.1

1 of the 6 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.15.011f199f6bec4
go.opentelemetry.io/otel@v1.36.0
1.41.0

Open the chart page →

6,220
boundary-softsciboundary-softsci0.2.41 of 1See more

boundary-softsci boundary-softsci 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
hashicorp/boundary:latest76a201954ca0
go.opentelemetry.io/otel@v1.39.0
1.41.0

Open the chart page →

727
caddycaddyVerified publisher0.0.41 of 1See more

caddy caddy 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
library/caddy:2.11.2-alpine834468128c76
go.opentelemetry.io/otel@v1.40.0
1.41.0

Open the chart page →

1,677
caninecanine0.1.101 of 7See more

canine canine 0.1.10

1 of the 7 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
ghcr.io/caninehq/canine:latesta058034ca006
go.opentelemetry.io/otel@v1.36.0
1.41.0

Open the chart page →

14,130
capsule-argo-addoncapsule-argo-addonVerified publisher0.7.51 of 2See more

capsule-argo-addon capsule-argo-addon 0.7.5

1 of the 2 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
ghcr.io/peak-scale/capsule-argo-addon:0.7.5087a80163971
go.opentelemetry.io/otel@v1.36.0
1.41.0

Open the chart page →

2,038
kube-ceemsceemsOfficialVerified publisher1.40.01 of 5See more

kube-ceems ceems 1.40.0

1 of the 5 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
grafana/grafana:13.2.1-distroless3600073f45a9
go.opentelemetry.io/otel@v1.40.0
1.41.0

Open the chart page →

640
cert-manager-alidns-webhookcert-manager-alidns-webhook0.1.41 of 1See more

cert-manager-alidns-webhook cert-manager-alidns-webhook 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
ghcr.io/crazygit/cert-manager-alidns-webhook:0.1.4976be6506eb6
go.opentelemetry.io/otel@v1.37.0
1.41.0

Open the chart page →

1,320
cert-manager-webhook-pdnscert-manager-webhook-pdns3.2.51 of 1See more

cert-manager-webhook-pdns cert-manager-webhook-pdns 3.2.5

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
zachomedia/cert-manager-webhook-pdns:v2.5.54940e227a39b
go.opentelemetry.io/otel@v1.40.0
1.41.0

Open the chart page →

1,072
charon-relaycharonOfficialVerified publisher0.8.01 of 2See more

charon-relay charon 0.8.0

1 of the 2 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
alpine/kubectl:1.35.2ec8f734b0a10
go.opentelemetry.io/otel@v1.36.0
1.41.0

Open the chart page →

4,396
dv-podcharonOfficialVerified publisher0.19.11 of 5See more

dv-pod charon 0.19.1

1 of the 5 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
obolnetwork/charon-dkg-sidecar:maine263be0a7440
go.opentelemetry.io/otel@v1.38.0
1.41.0

Open the chart page →

7,405
goldpingerchristianhuthVerified publisher1.4.01 of 1See more

goldpinger christianhuth 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
bloomberg/goldpinger:3.11.2a1fb87c2e9d9
go.opentelemetry.io/otel@v1.39.0
1.41.0

Open the chart page →

280
kubevirt-cloud-controller-managerchristianhuthVerified publisher0.0.21 of 1See more

kubevirt-cloud-controller-manager christianhuth 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
quay.io/kubevirt/kubevirt-cloud-controller-manager:v0.6.037ad4c475941
go.opentelemetry.io/otel@v1.39.0
1.41.0

Open the chart page →

656
kubevirt-managerchristianhuthVerified publisher0.7.01 of 1See more

kubevirt-manager christianhuth 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
kubevirtmanager/kubevirt-manager:1.5.41b98f1b5977a
go.opentelemetry.io/otel@v1.39.0
1.41.0

Open the chart page →

1,986
ethereum-metrics-exporterchronicleVerified publisher0.1.41 of 1See more

ethereum-metrics-exporter chronicle 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
samcm/ethereum-metrics-exporter:0.29.291a2d9a015c1
go.opentelemetry.io/otel@v1.37.0
1.41.0

Open the chart page →

684
spirechronicleVerified publisher0.3.61 of 1See more

spire chronicle 0.3.6

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
ghcr.io/chronicleprotocol/spire:0.68.379df4fb20322
go.opentelemetry.io/otel@v1.38.0
1.41.0

Open the chart page →

1,515
clairclair-helmVerified publisher0.12.01 of 3See more

clair clair-helm 0.12.0

1 of the 3 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
quay.io/projectquay/clair:4.9.023329c3368e4
go.opentelemetry.io/otel@v1.39.0
1.41.0

Open the chart page →

1,617
kamajiclastixVerified publisher0.0.0+latest1 of 4See more

kamaji clastix 0.0.0+latest

1 of the 4 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
quay.io/coreos/etcd:v3.6.12702d7b4881c6
go.opentelemetry.io/otel@v1.40.0
1.41.0

Open the chart page →

4,630
kamaji-etcdclastixVerified publisher0.17.01 of 4See more

kamaji-etcd clastix 0.17.0

1 of the 4 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
quay.io/coreos/etcd:v3.6.12702d7b4881c6
go.opentelemetry.io/otel@v1.40.0
1.41.0

Open the chart page →

11,995
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad1 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

1 of the 6 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
ghcr.io/formancehq/membership:v1.11.024a0113d5fb0
go.opentelemetry.io/otel@v1.37.0
1.41.0

Open the chart page →

18,293
cloud-provider-kubevirtcloud-provider-kubevirtVerified publisher0.2.01 of 1See more

cloud-provider-kubevirt cloud-provider-kubevirt 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
quay.io/kubevirt/kubevirt-cloud-controller-manager:v0.6.037ad4c475941
go.opentelemetry.io/otel@v1.39.0
1.41.0

Open the chart page →

656
argo-eventscluster-deploy0.1.01 of 1See more

argo-events cluster-deploy 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.10a83d2699ae53
go.opentelemetry.io/otel@v1.38.0
1.41.0

Open the chart page →

1,035
mla-external-secretscluster-deploy0.3.01 of 1See more

mla-external-secrets cluster-deploy 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/external-secrets:v2.1.0ec40c3d9c48f
go.opentelemetry.io/otel@v1.38.0
1.41.0

Open the chart page →

716
monitoringcluster-deploy0.3.06 of 11See more

monitoring cluster-deploy 0.3.0

6 of the 11 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
grafana/grafana:12.4.1e932bd6ed0e0
go.opentelemetry.io/otel@v1.39.0
1.41.0
grafana/loki:3.6.73c8fd3570dd9
go.opentelemetry.io/otel@v1.38.0
1.41.0
grafana/loki-canary:3.6.70dac7d5cb383
go.opentelemetry.io/otel@v1.38.0
1.41.0
quay.io/prometheus-operator/prometheus-config-reloader:v0.89.0cb4ac6a56555
go.opentelemetry.io/otel@v1.39.0
1.41.0
quay.io/prometheus/prometheus:v3.10.07571a304e67f
go.opentelemetry.io/otel@v1.40.0
1.41.0
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.01545919b72e3
go.opentelemetry.io/otel@v1.37.0
1.41.0

Open the chart page →

8,183
clusterfactoryclusterfactory0.2.01 of 5See more

clusterfactory clusterfactory 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
gitea/act_runner:0.3.1c2a169c5e998
go.opentelemetry.io/otel@v1.40.0
1.41.0

Open the chart page →

7,168
coder-logstream-kubecoder-logstream-kube0.0.151 of 1See more

coder-logstream-kube coder-logstream-kube 0.0.15

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
ghcr.io/coder/coder-logstream-kube:v0.0.1510ae596d296e
go.opentelemetry.io/otel@v1.39.0
1.41.0

Open the chart page →

885
csghubcsghubVerified publisher2.4.34 of 34See more

csghub csghub 2.4.3

4 of the 34 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
casbin/casdoor:3.62.0e08231f16c00
go.opentelemetry.io/otel@v1.40.0
1.41.0
opencsghq/csghub-xnet:v2.4.0-ee04121fd19ef9
go.opentelemetry.io/otel@v1.39.0
1.41.0
quay.io/argoproj/argocli:v3.7.11577fc18f86ad
go.opentelemetry.io/otel@v1.40.0
1.41.0
quay.io/argoproj/workflow-controller:v3.7.11c46aa0ded8ed
go.opentelemetry.io/otel@v1.40.0
1.41.0

Open the chart page →

58,897
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
casbin/casdoor:3.62.17729da148c61
go.opentelemetry.io/otel@v1.40.0
1.41.0

Open the chart page →

11,335
csi-driver-ipfscsi-driver-ipfs0.2.05 of 6See more

csi-driver-ipfs csi-driver-ipfs 0.2.0

5 of the 6 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.16.0ab482308a492
go.opentelemetry.io/otel@v1.40.0
1.41.0
registry.k8s.io/sig-storage/csi-provisioner:v6.1.1d992c36d4ddd
go.opentelemetry.io/otel@v1.37.0
1.41.0
registry.k8s.io/sig-storage/csi-resizer:v2.1.0589e525cddef
go.opentelemetry.io/otel@v1.39.0
1.41.0
registry.k8s.io/sig-storage/csi-snapshotter:v8.5.0da081c27e8a6
go.opentelemetry.io/otel@v1.40.0
1.41.0
registry.k8s.io/sig-storage/livenessprobe:v2.18.0c4cc074199c0
go.opentelemetry.io/otel@v1.39.0
1.41.0

Open the chart page →

3,629
dapr-agentsdapr-agents-devVerified publisher0.1.513 of 31See more

dapr-agents dapr-agents-dev 0.1.5

13 of the 31 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
grafana/grafana:12.3.39e1e77ade304
go.opentelemetry.io/otel@v1.39.0
1.41.0
grafana/loki:3.6.5847c287ada0e
go.opentelemetry.io/otel@v1.38.0
1.41.0
grafana/loki-canary:3.6.5fbb984bab741
go.opentelemetry.io/otel@v1.38.0
1.41.0
grafana/tempo:2.9.065a578975943
go.opentelemetry.io/otel@v1.38.0
1.41.0
otel/opentelemetry-collector-contrib:0.145.0a7343f018690
go.opentelemetry.io/otel@v1.39.1-0.20260115134311-f809f7d71e2d
1.41.0
ghcr.io/dapr/injector:1.17.0-rc.37a2fd888ed5f
go.opentelemetry.io/otel@v1.39.0
1.41.0
ghcr.io/dapr/operator:1.17.0-rc.3d5cc61cbe735
go.opentelemetry.io/otel@v1.39.0
1.41.0
ghcr.io/dapr/placement:1.17.0-rc.3a237b43cd5c6
go.opentelemetry.io/otel@v1.39.0
1.41.0
ghcr.io/dapr/scheduler:1.17.0-rc.36c62e01e736b
go.opentelemetry.io/otel@v1.39.0
1.41.0
ghcr.io/dapr/sentry:1.17.0-rc.3bf79b03591e0
go.opentelemetry.io/otel@v1.39.0
1.41.0
ghcr.io/kagent-dev/kagent/tools:0.0.13c8882543f693
go.opentelemetry.io/otel@v1.38.0
1.41.0
quay.io/prometheus-operator/prometheus-operator:v0.88.1d3d65efa3bee
go.opentelemetry.io/otel@v1.39.0
1.41.0
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.01545919b72e3
go.opentelemetry.io/otel@v1.37.0
1.41.0

Open the chart page →

22,193
monitoring-stackdata354-helmVerified publisher1.4.21 of 4See more

monitoring-stack data354-helm 1.4.2

1 of the 4 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
go.opentelemetry.io/otel@v1.40.0
1.41.0

Open the chart page →

3,176
migrantdevtron-labs0.0.31 of 1See more

migrant devtron-labs 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
migrate/migrate:latestcc4ad8e19d66
go.opentelemetry.io/otel@v1.37.0
1.41.0

Open the chart page →

734
dnation-kubernetes-monitoring-stackdnationcloud4.0.21 of 17See more

dnation-kubernetes-monitoring-stack dnationcloud 4.0.2

1 of the 17 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
go.opentelemetry.io/otel@v1.40.0
1.41.0

Open the chart page →

21,641
rook-cephdtrdnk-helm-chartsVerified publisher0.0.11 of 2See more

rook-ceph dtrdnk-helm-charts 0.0.1

1 of the 2 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
quay.io/cephcsi/ceph-csi-operator:v0.5.014fe2f1bffc3
go.opentelemetry.io/otel@v1.36.0
1.41.0

Open the chart page →

1,990
cloudflaredduck-helm1.1.31 of 1See more

cloudflared duck-helm 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
cloudflare/cloudflared:2026.3.06b599ca3e974
go.opentelemetry.io/otel@v1.40.0
1.41.0

Open the chart page →

1,437
edge-accessedge-accessVerified publisher0.1.01 of 1See more

edge-access edge-access 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
quay.io/oauth2-proxy/oauth2-proxy:v7.13.056e3daedf765
go.opentelemetry.io/otel@v1.37.0
1.41.0

Open the chart page →

670
ai-gateway-helmenvoy-ai-gateway0.0.0-003ab39f36923b5d40609a601e2951b73f6318fb1 of 1See more

ai-gateway-helm envoy-ai-gateway 0.0.0-003ab39f36923b5d40609a601e2951b73f6318fb

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
envoyproxy/ai-gateway-controller:003ab39f36923b5d40609a601e2951b73f6318fbec1f06ee29a7
go.opentelemetry.io/otel@v1.37.0
1.41.0

Open the chart page →

824
thanoseosc-lot-1Verified publisher0.2.01 of 1See more

thanos eosc-lot-1 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.39.21d022ef4b8ef
go.opentelemetry.io/otel@v1.36.0
1.41.0

Open the chart page →

834
thanos-bucketeosc-lot-1Verified publisher0.1.01 of 1See more

thanos-bucket eosc-lot-1 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.39.21d022ef4b8ef
go.opentelemetry.io/otel@v1.36.0
1.41.0

Open the chart page →

834
benchmarkoor-apiethereum-helm-chartsVerified publisher0.1.01 of 1See more

benchmarkoor-api ethereum-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
ghcr.io/ethpandaops/benchmarkoor:latest5470b2ec3161
go.opentelemetry.io/otel@v1.39.0
1.41.0

Open the chart page →

899
ethereum-metrics-exporterethereum-helm-chartsVerified publisher0.2.11 of 1See more

ethereum-metrics-exporter ethereum-helm-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
samcm/ethereum-metrics-exporter:latest91a2d9a015c1
go.opentelemetry.io/otel@v1.37.0
1.41.0

Open the chart page →

684
rpc-snooperethereum-helm-chartsVerified publisher0.0.21 of 1See more

rpc-snooper ethereum-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
ethpandaops/rpc-snooper:latestc0b30fcf64bc
go.opentelemetry.io/otel@v1.37.0
1.41.0

Open the chart page →

1,470
xatu-cbt-apiethereum-helm-chartsVerified publisher0.0.131 of 1See more

xatu-cbt-api ethereum-helm-charts 0.0.13

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
ethpandaops/xatu-cbt-api:latestf7dec2e07091
go.opentelemetry.io/otel@v1.38.0
1.41.0

Open the chart page →

1,216
exalsius-operatorexalsius-operatorVerified publisher0.12.01 of 1See more

exalsius-operator exalsius-operator 0.12.0

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
ghcr.io/exalsius/exalsius-operator:0.12.0d24a579a3c75
go.opentelemetry.io/otel@v1.37.0
1.41.0

Open the chart page →

204
datadog-apmfairwinds-incubator2.0.01 of 1See more

datadog-apm fairwinds-incubator 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
public.ecr.aws/datadog/agent:7.73.0f4925b15ce94
go.opentelemetry.io/otel@v1.38.0
1.41.0

Open the chart page →

2,785
kubebenchfairwinds-incubator1.0.51 of 2See more

kubebench fairwinds-incubator 1.0.5

1 of the 2 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
aquasec/kube-bench:v0.15.07a8fa32dce21
go.opentelemetry.io/otel@v1.39.0
1.41.0

Open the chart page →

1,187
farm-observabilityfarm-observabilityOfficialVerified publisher0.27.24 of 18See more

farm-observability farm-observability 0.27.2

4 of the 18 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
grafana/alloy:v1.12.2f94b1c82957a
go.opentelemetry.io/otel@v1.38.0
1.41.0
grafana/loki:3.6.73c8fd3570dd9
go.opentelemetry.io/otel@v1.38.0
1.41.0
grafana/loki-canary:3.6.70dac7d5cb383
go.opentelemetry.io/otel@v1.38.0
1.41.0
grafana/tempo:2.9.065a578975943
go.opentelemetry.io/otel@v1.38.0
1.41.0

Open the chart page →

13,255
ferretdbferretdb-helm-chart0.2.31 of 1See more

ferretdb ferretdb-helm-chart 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-29181.

Container imageDigestPackageFixed in
ghcr.io/ferretdb/ferretdb:2.7.05706414241eb
go.opentelemetry.io/otel@v1.38.0
1.41.0

Open the chart page →

749

Container images carrying it

339 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
grafana/grafana:latestf772d434e8fa
go.opentelemetry.io/otel@v1.40.0
1.41.0
12
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.01545919b72e3
go.opentelemetry.io/otel@v1.37.0
1.41.0
12
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.15.011f199f6bec4
go.opentelemetry.io/otel@v1.36.0
1.41.0
7
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.16.0ab482308a492
go.opentelemetry.io/otel@v1.40.0
1.41.0
7
registry.k8s.io/sig-storage/csi-resizer:v2.1.0589e525cddef
go.opentelemetry.io/otel@v1.39.0
1.41.0
7
grafana/grafana:13.2.1-distroless3600073f45a9
go.opentelemetry.io/otel@v1.40.0
1.41.0
5
registry.k8s.io/sig-storage/csi-attacher:v4.11.0b74b05b39501
go.opentelemetry.io/otel@v1.38.0
1.41.0
5
registry.k8s.io/sig-storage/csi-provisioner:v6.2.06be9f63ca4ca
go.opentelemetry.io/otel@v1.40.0
1.41.0
5
registry.k8s.io/sig-storage/csi-snapshotter:v8.5.0da081c27e8a6
go.opentelemetry.io/otel@v1.40.0
1.41.0
5
cloudflare/cloudflared:2026.3.06b599ca3e974
go.opentelemetry.io/otel@v1.40.0
1.41.0
4
grafana/grafana:13.1.0121a7a9ece6d
go.opentelemetry.io/otel@v1.40.0
1.41.0
4
grafana/loki:3.6.73c8fd3570dd9
go.opentelemetry.io/otel@v1.38.0
1.41.0
4
grafana/tempo:2.9.065a578975943
go.opentelemetry.io/otel@v1.38.0
1.41.0
4
ghcr.io/appscode/petset:v0.1.093fa0daf603c
go.opentelemetry.io/otel@v1.40.0
1.41.0
4
ghcr.io/kubestash/kubestash:v0.29.043e01ed32486
go.opentelemetry.io/otel@v1.36.0
1.41.0
4
registry.k8s.io/sig-storage/livenessprobe:v2.18.0c4cc074199c0
go.opentelemetry.io/otel@v1.39.0
1.41.0
4
grafana/loki-canary:3.6.70dac7d5cb383
go.opentelemetry.io/otel@v1.38.0
1.41.0
3
jaegertracing/all-in-one:latestab6f1a1f0fb4
go.opentelemetry.io/otel@v1.38.0
1.41.0
3
migrate/migrate:latestcc4ad8e19d66
go.opentelemetry.io/otel@v1.37.0
1.41.0
3
ghcr.io/appscode/sidekick:v0.0.15d1036b07e348
go.opentelemetry.io/otel@v1.36.0
1.41.0
3
ghcr.io/dexidp/dex:v2.45.18499afd690c4
go.opentelemetry.io/otel@v1.39.0
1.41.0
3
ghcr.io/sigstore/scaffolding/ct_server:v0.7.3166664ba563e7
go.opentelemetry.io/otel@v1.38.0
1.41.0
3
ghcr.io/voyagermesh/crd-manager:v0.3.0e67f14e5c853
go.opentelemetry.io/otel@v1.40.0
1.41.0
3
quay.io/prometheus/prometheus:v3.10.07571a304e67f
go.opentelemetry.io/otel@v1.40.0
1.41.0
3
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.14.05244abbe87e0
go.opentelemetry.io/otel@v1.36.0
1.41.0
3
alpine/k8s:1.32.12048f8d9c8cc7
go.opentelemetry.io/otel@v1.37.0
1.41.0
2
alpine/kubectl:1.35.2ec8f734b0a10
go.opentelemetry.io/otel@v1.36.0
1.41.0
2
bloomberg/goldpinger:3.11.2a1fb87c2e9d9
go.opentelemetry.io/otel@v1.39.0
1.41.0
2
coredns/coredns:1.13.19b9128672209
go.opentelemetry.io/otel@v1.37.0
1.41.0
2
grafana/alloy:v1.12.2f94b1c82957a
go.opentelemetry.io/otel@v1.38.0
1.41.0
2
grafana/grafana:12.3.12175aaa91c96
go.opentelemetry.io/otel@v1.38.0
1.41.0
2
grafana/grafana:12.3.39e1e77ade304
go.opentelemetry.io/otel@v1.39.0
1.41.0
2
grafana/grafana:12.4.1e932bd6ed0e0
go.opentelemetry.io/otel@v1.39.0
1.41.0
2
helmforge/kubectl:1.35.3c3f97e954c47
go.opentelemetry.io/otel@v1.36.0
1.41.0
2
louislam/uptime-kuma:2.3.29aeb4e51d038
go.opentelemetry.io/otel@v1.40.0
1.41.0
2
mesosphere/kubectl:v1.35.0-alpineea01a9387771
go.opentelemetry.io/otel@v1.36.0
1.41.0
2
samcm/ethereum-metrics-exporter:0.29.2:latest91a2d9a015c1
go.opentelemetry.io/otel@v1.37.0
1.41.0
2
thanosio/thanos:v0.41.0cf3e9b292e43
go.opentelemetry.io/otel@v1.38.0
1.41.0
2
ghcr.io/appscode/license-proxyserver:v0.1.1e192ad567e0b
go.opentelemetry.io/otel@v1.40.0
1.41.0
2
ghcr.io/appscode/service-provider:v0.0.2f6e481386d70
go.opentelemetry.io/otel@v1.36.0
1.41.0
2
ghcr.io/celestiaorg/celestia-node:v0.27.5-mocha4768ea1c5fd2
go.opentelemetry.io/otel@v1.37.0
1.41.0
2
ghcr.io/glassflow/glassflow-etl-k8s-operator:v3.2.1e70364e88629
go.opentelemetry.io/otel@v1.38.0
1.41.0
2
ghcr.io/juniorjpdj/containers/openssl-kubectl:1.36.1-r358afba209ea0
go.opentelemetry.io/otel@v1.39.0
1.41.0
2
ghcr.io/kluster-manager/cluster-auth:v0.5.1fba6fb872281
go.opentelemetry.io/otel@v1.38.0
1.41.0
2
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
go.opentelemetry.io/otel@v1.36.0
1.41.0
2
quay.io/argoproj/argo-rollouts:v1.10.0187630ba7228
go.opentelemetry.io/otel@v1.39.0
1.41.0
2
quay.io/coreos/etcd:v3.6.12702d7b4881c6
go.opentelemetry.io/otel@v1.40.0
1.41.0
2
quay.io/kubevirt/kubevirt-cloud-controller-manager:v0.6.037ad4c475941
go.opentelemetry.io/otel@v1.39.0
1.41.0
2
quay.io/metallb/controller:v0.16.1f51ab515de9c
go.opentelemetry.io/otel@v1.40.0
1.41.0
2
quay.io/metallb/frr-k8s:v0.0.251cb06fb2d553
go.opentelemetry.io/otel@v1.40.0
1.41.0
2

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.