CVE-2026-34986

High

Advisory

Published 3 Apr 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.007; 49th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 410; of 17,787 indexed, latest versions
Container images: 405; deployed by those charts
Fix available: 2 of 3; affected packages

Go JOSE Panics in JWE decryption

Carried by container images the latest versions of 410 of 17,787 indexed charts deploy, on 405 images.

Affected package	Affected versions	Fixed in	Images
github.com/go-jose/go-jose/v4golang	v4.0.1, v4.0.2, v4.0.4, v4.0.5+4 more	4.1.4	282
github.com/go-jose/go-jose/v3golang	v3.0.0, v3.0.1, v3.0.1-0.20221117193127-916db76e8214, v3.0.2+2 more	3.0.5	170
github.com/go-jose/go-josegolang	v2.6.3+incompatible	no fix listed	4

OSV records: GHSA-78h2-9frx-2jm8
Also known as: GO-2026-4945

Charts affected

410 by stars

Chart

Latest

Affected images

Radar Score

typhoontyphoon

0.2.3

1 of 2 See more

typhoon typhoon 0.2.3

1 of the 2 container images this version deploys carry CVE-2026-34986.

Container image	Digest	Package	Fixed in
ghcr.io/zeiss/typhoon/controller :0.2.3	4fdf4edfda45	github.com/go-jose/go-jose/v3@v3.0.3	3.0.5

Open the chart page →

1,672

opencloudunxwares

0.2.3

2 of 13 See more

opencloud unxwares 0.2.3

2 of the 13 container images this version deploys carry CVE-2026-34986.

Container image	Digest	Package	Fixed in
minio/minio :latest	14cea493d9a3	github.com/go-jose/go-jose/v4@v4.1.0	4.1.4
opencloudeu/opencloud-rolling :2.1.0	f9634bb04905	github.com/go-jose/go-jose/v3@v3.0.4 github.com/go-jose/go-jose/v4@v4.0.5	3.0.5 4.1.4

Open the chart page →

45,392

vals-operatorvals-operator

0.8.1

1 of 1 See more

vals-operator vals-operator 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-34986.

Container image	Digest	Package	Fixed in
ghcr.io/digitalis-io/vals-operator :v0.8.1	7c776499b8c9	github.com/go-jose/go-jose/v4@v4.1.3	4.1.4

Open the chart page →

696

vault-raft-snapshot-agentvault-raft-snapshot-agent

0.6.9

1 of 1 See more

vault-raft-snapshot-agent vault-raft-snapshot-agent 0.6.9

1 of the 1 container images this version deploys carry CVE-2026-34986.

Container image	Digest	Package	Fixed in
ghcr.io/argelbargel/vault-raft-snapshot-agent :v0.12.5	345174727a2b	github.com/go-jose/go-jose/v4@v4.0.5	4.1.4

Open the chart page →

1,114

ciliumvks-helm-charts

1.17.14

1 of 3 See more

cilium vks-helm-charts 1.17.14

1 of the 3 container images this version deploys carry CVE-2026-34986.

Container image	Digest	Package	Fixed in
quay.io/cilium/operator-generic :v1.17.14	773886ec9337	github.com/go-jose/go-jose/v4@v4.0.5	4.1.4

Open the chart page →

4,124

istio-service-meshwbstack

0.0.1

1 of 1 See more

istio-service-mesh wbstack 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-34986.

Container image	Digest	Package	Fixed in
istio/pilot :1.17.1	ce9d87606701	github.com/go-jose/go-jose/v3@v3.0.0	3.0.5

Open the chart page →

6,272

argo-eventswenerme

2.4.27

1 of 1 See more

argo-events wenerme 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-34986.

Container image	Digest	Package	Fixed in
quay.io/argoproj/argo-events :v1.9.11	fa07b2c9ece6	github.com/go-jose/go-jose/v3@v3.0.4 github.com/go-jose/go-jose/v4@v4.1.0	3.0.5 4.1.4

Open the chart page →

969

wexa-studiowexa-studio

1.2.0

4 of 15 See more

wexa-studio wexa-studio 1.2.0

4 of the 15 container images this version deploys carry CVE-2026-34986.

Container image	Digest	Package	Fixed in
hashicorp/vault :1.15.4	0b01ed3924e6	github.com/go-jose/go-jose/v3@v3.0.1	3.0.5
temporalio/admin-tools :1.29.1-tctl-1.18.4-cli-1.5.0	a3a52e6ca122	github.com/go-jose/go-jose/v4@v4.0.5	4.1.4
temporalio/server :1.29.1	c1e3326b2ce1	github.com/go-jose/go-jose/v4@v4.0.5	4.1.4
temporalio/ui :2.44.0	0b36e00aad30	github.com/go-jose/go-jose/v4@v4.0.5	4.1.4

Open the chart page →

14,618

registrywiremind

0.1.1

1 of 1 See more

registry wiremind 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-34986.

Container image	Digest	Package	Fixed in
ghcr.io/distribution/distribution :3.0.0	4ba3adf47f5c	github.com/go-jose/go-jose/v4@v4.0.5	4.1.4

Open the chart page →

1,187

ygdrassil-monitoringygdrassil

0.4.0

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-34986.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	github.com/go-jose/go-jose/v3@v3.0.3	3.0.5

Open the chart page →

9,381

Container images carrying it

405 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/seamware/did-helper :0.6.0	799c5f566952	github.com/go-jose/go-jose/v3@v3.0.1-0.20221117193127-916db76e8214	3.0.5	1
quay.io/skopeo/stable :v1.13	4853591bd1d2	github.com/go-jose/go-jose/v3@v3.0.0	3.0.5	1
quay.io/thanos/thanos :v0.40.1	aae7b2b030ed	github.com/go-jose/go-jose/v4@v4.0.5	4.1.4	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend :1.0.31	c7afac3446d6	github.com/go-jose/go-jose/v4@v4.1.3	4.1.4	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer :1.0.31	0e3cd8c7776d	github.com/go-jose/go-jose/v4@v4.1.3	4.1.4	1