CVE-2026-34986
HighAdvisory
Published 3 Apr 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.007
- 49th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 405
- of 17,781 indexed, latest versions
- Container images
- 402
- deployed by those charts
- Fix available
- 2 of 3
- affected packages
Go JOSE Panics in JWE decryption
Carried by container images the latest versions of 405 of 17,781 indexed charts deploy, on 402 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v4.0.1, v4.0.2, v4.0.4, v4.0.5+4 more | 4.1.4 | 280 |
| github.com/ | v3.0.0, v3.0.1, v3.0.1-0.20221117193127-916db76e8214, v3.0.2+2 more | 3.0.5 | 169 |
| github.com/ | v2.6.3+incompatible | no fix listed | 4 |
- OSV records
- GHSA-78h2-9frx-2jm8
- Also known as
- GO-2026-4945
Charts affected
405 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| istio-service-meshwbstack | 0.0.1 | 1 of 1See more | 6,232 |
| argo-eventswenerme | 2.4.27 | 1 of 1See more | 969 |
| wexa-studiowexa-studio | 1.2.0 | 4 of 15See more | 14,983 |
| registrywiremindVerified publisher | 0.1.1 | 1 of 1See more | 1,187 |
| ygdrassil-monitoringygdrassilVerified publisher | 0.4.0 | 1 of 10See more | 9,381 |
Container images carrying it
402 by charts deploying them
A fixed version is listed for 2 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| flanksource/ | 689687a7cf95 | github.com/ | 4.1.4 | 1 |
| galaxy/ | e50a890e24c9 | github.com/ | 4.1.4 | 1 |
| goalert/ | 08d57388b0cb | github.com/ | 3.0.5 | 1 |
| goharbor/ | a30e5a8be3d9 | github.com/ | 4.1.4 | 1 |
| goharbor/ | c017dd84ee96 | github.com/ | 4.1.4 | 1 |
| goharbor/ | 5c6f7162804c | github.com/ | 4.1.4 | 1 |
| grafana/ | 3364714a2f64 | github.com/ | 3.0.5 | 1 |
| grafana/ | f6cbec9409be | github.com/ | 3.0.5 | 1 |
| grafana/ | 01a63f4e032c | github.com/ | 3.0.5 | 1 |
| grafana/ | 06bdcbb51fc2 | github.com/ | 3.0.5 | 1 |
| grafana/ | 8c7256f412fe | github.com/ | 4.1.4 | 1 |
| grafana/ | c3dac4e26471 | github.com/ | 3.0.5 | 1 |
| grafana/ | f50931848bd8 | github.com/ | 4.1.4 | 1 |
| grafana/ | 0679e877ba20 | github.com/ | 3.0.5 | 1 |
| grafana/ | 1b9ca4bbc4a2 | github.com/ | 3.0.5 | 1 |
| grafana/ | 2ebef928d7e5 | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| grafana/ | 35c41e0fd029 | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| grafana/ | 39c849cebccc | github.com/ | 3.0.5 | 1 |
| grafana/ | 464eac539793 | github.com/ | 3.0.5 | 1 |
| grafana/ | 5781759b3d27 | github.com/ | 3.0.5 | 1 |
| grafana/ | 62d2b9d20a19 | github.com/ | 3.0.5 | 1 |
| grafana/ | 6b5b37eb35bb | github.com/ | 3.0.5 | 1 |
| grafana/ | 70d9599b186c | github.com/ | 4.1.4 | 1 |
| grafana/ | 74144189b384 | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| grafana/ | 8640e5038e83 | github.com/ | 3.0.5 | 1 |
| grafana/ | 8b37a2f028f1 | github.com/ | 3.0.5 | 1 |
| grafana/ | a1701c218024 | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| grafana/ | a9043254ba16 | github.com/ | 3.0.5 | 1 |
| grafana/ | b23b588cf7cb | github.com/ | 3.0.5 | 1 |
| grafana/ | b5b59bfc7561 | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| grafana/ | ba93c9d192e5 | github.com/ | 4.1.4 | 1 |
| grafana/ | f9811e4e687f | github.com/ | 3.0.5 | 1 |
| grafana/ | fa801ab6e1ae | github.com/ | 3.0.5 | 1 |
| grafana/ | 847c287ada0e | github.com/ | 4.1.4 | 1 |
| grafana/ | 92bd5700577b | github.com/ | 4.1.4 | 1 |
| grafana/ | cd6e176883a9 | github.com/ | 4.1.4 | 1 |
| grafana/ | 7476e456c738 | github.com/ | 3.0.5 | 1 |
| grafana/ | 85f55510e0d3 | github.com/ | 4.1.4 | 1 |
| grafana/ | 09d8c3ce4f3a | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| gresearch/ | 16d1228220fc | github.com/ | 4.1.4 | 1 |
| hashicorp/ | 339b78b61750 | github.com/ | 3.0.5 | 1 |
| hashicorp/ | 37bf86488b74 | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| hashicorp/ | 0b01ed3924e6 | github.com/ | 3.0.5 | 1 |
| hashicorp/ | b2177a8bfe85 | github.com/ | 3.0.5 | 1 |
| hashicorp/ | bbb7f98dc67d | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| headscale/ | a7a8ae9616bb | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| headscale/ | cd37b3001857 | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| igrantio/ | 2d2ea6546ffe | github.com/ | 3.0.5 | 1 |
| instill/ | b53eaa51c523 | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| instill/ | c4a393e601ed | github.com/ | 4.1.4 | 1 |