StackRadar

CVE-2026-39832

Critical

Advisory

Published 22 May 2026In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
0.006
47th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,522
of 17,828 indexed, latest versions
Container images
2,853
deployed by those charts
Fix available
1 of 1
affected package

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

Carried by container images the latest versions of 2,522 of 17,828 indexed charts deploy, on 2,853 images.

Affected packageAffected versionsFixed inImages
golang.org/x/cryptogolangv0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+154 more0.52.02,853
OSV records
GHSA-f5wc-c3c7-36mc
Also known as
GO-2026-5006

Charts affected

2,522 by stars
ChartLatestAffected imagesRadar Score
node-exporternode-exporterVerified publisher0.1.101 of 1See more

node-exporter node-exporter 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
prom/node-exporter:v1.6.0d2e48098c364
golang.org/x/crypto@v0.8.0
0.52.0

Open the chart page →

1,229
octopuso7studios-octopus-helm-chartsOfficialVerified publisher1.2.33 of 5See more

octopus o7studios-octopus-helm-charts 1.2.3

3 of the 5 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
library/nats:2.11.9-alpine777787bbb4c7
golang.org/x/crypto@v0.41.0
0.52.0
natsio/nats-box:0.18.0abdc9f9f0120
golang.org/x/crypto@v0.38.0
0.52.0
percona/percona-server-mongodb-operator:1.20.1d09453ce7886
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

6,142
oadaoadaVerified publisher5.0.61 of 11See more

oada oada 5.0.6

1 of the 11 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
groundnuty/k8s-wait-for:no-root-v2.0a26d3d3f6e1c
golang.org/x/crypto@v0.0.0-20220315160706-3147a52a75dd
0.52.0

Open the chart page →

13,380
transfer.shobeoneVerified publisher1.0.51 of 1See more

transfer.sh obeone 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
dutchcoders/transfer.sh:v1.6.1-noroot8db9ade72a0d
golang.org/x/crypto@v0.14.0
0.52.0

Open the chart page →

1,179
growthbookone-acre-fundVerified publisher0.3.01 of 3See more

growthbook one-acre-fund 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
jwilder/dockerize:latestf94fb59fb4f6
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

1,161
kruiseopenkruise1.9.11 of 2See more

kruise openkruise 1.9.1

1 of the 2 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
openkruise/kruise-manager:v1.9.1f81ae78a36a4
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

1,656
librechatopenshift1.9.01 of 3See more

librechat openshift 1.9.0

1 of the 3 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
library/mongo:8.0.20098862b1339f
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

5,943
openstack-kamaji-clusteropenstack-kamaji-clusterVerified publisher0.2.41 of 1See more

openstack-kamaji-cluster openstack-kamaji-cluster 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
registry.k8s.io/autoscaling/cluster-autoscaler:v1.34.07b172f42533c
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

770
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.01 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.0

1 of the 34 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
ghcr.io/open-feature/flagd:v0.16.032234e63c1d0
golang.org/x/crypto@v0.49.0
0.52.0

Open the chart page →

20,236
opikopikOfficialVerified publisher2.2.722 of 13See more

opik opik 2.2.72

2 of the 13 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
cloudpirates/image-minio:RELEASE.2025-10-15T17-29-55Z-hardened8dc02a7e5093
golang.org/x/crypto@v0.43.0
0.52.0
ghcr.io/comet-ml/opik/opik-python-backend:2.2.723345830b0178
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

14,981
opsopsVerified publisher1.2.02 of 2See more

ops ops 1.2.0

2 of the 2 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
shaowenchen/ops-controller-manager:latest35575d4f2bfe
golang.org/x/crypto@v0.37.0
0.52.0
shaowenchen/ops-server:latest6bac5cebd125
golang.org/x/crypto@v0.37.0
0.52.0

Open the chart page →

91,111
orbitalregorbitalregVerified publisher0.3.01 of 4See more

orbitalreg orbitalreg 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
orbitalreg/orbitalreg-api:0.1.045f2620337af
golang.org/x/crypto@v0.26.0
0.52.0

Open the chart page →

2,589
kubernetes-dashboard-proxyosc0.7.22 of 4See more

kubernetes-dashboard-proxy osc 0.7.2

2 of the 4 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
kubernetesui/dashboard:v2.7.02e500d29e9d5
golang.org/x/crypto@v0.0.0-20220525230936-793ad666bf5e
0.52.0
quay.io/oauth2-proxy/oauth2-proxy:v7.1.3ecd26b74a01f
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

6,016
osc-bsu-csi-driverosc-bsu-csi-driverVerified publisher2.2.02 of 6See more

osc-bsu-csi-driver osc-bsu-csi-driver 2.2.0

2 of the 6 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-attacher:v4.12.0b9dc9a714a48
golang.org/x/crypto@v0.51.0
0.52.0
registry.k8s.io/sig-storage/csi-provisioner:v6.1.1d992c36d4ddd
golang.org/x/crypto@v0.41.0
0.52.0

Open the chart page →

2,391
hlf-caowkin2.1.02 of 2See more

hlf-ca owkin 2.1.0

2 of the 2 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
hyperledger/fabric-ca:1.5.1c7f3422ec1d5
golang.org/x/crypto@v0.0.0-20201117144127-c1f2f97bffc9
0.52.0
jwilder/dockerize:latestf94fb59fb4f6
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

3,433
hlf-ordowkin3.1.01 of 1See more

hlf-ord owkin 3.1.0

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
hyperledger/fabric-orderer:2.2.137294e05209b
golang.org/x/crypto@v0.0.0-20200221231518-2aa609cf4a9d
0.52.0

Open the chart page →

3,358
hlf-peerowkin5.1.01 of 1See more

hlf-peer owkin 5.1.0

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
hyperledger/fabric-peer:2.2.1bf4995c86af6
golang.org/x/crypto@v0.0.0-20200221231518-2aa609cf4a9d
0.52.0

Open the chart page →

3,695
ngrok-operatorpaganuzzi0.0.21 of 1See more

ngrok-operator paganuzzi 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
ghcr.io/paganuzzi/ngrokoperator:latest5a10cd095699
golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904
0.52.0

Open the chart page →

2,813
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
golang.org/x/crypto@v0.38.0
0.52.0

Open the chart page →

6,976
patch-operatorpatch-operator0.1.112 of 2See more

patch-operator patch-operator 0.1.11

2 of the 2 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
quay.io/redhat-cop/kube-rbac-proxy:v0.11.0c68135620167
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0
quay.io/redhat-cop/patch-operator:v0.1.11030ade9b9428
golang.org/x/crypto@v0.0.0-20220214200702-86341886e292
0.52.0

Open the chart page →

7,861
pbuf-registrypbuf-registry0.4.11 of 2See more

pbuf-registry pbuf-registry 0.4.1

1 of the 2 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
ghcr.io/pbufio/registry:v0.4.177a36c035b4b
golang.org/x/crypto@v0.43.0
0.52.0

Open the chart page →

2,096
spirephilips-labsVerified publisher0.12.23 of 6See more

spire philips-labs 0.12.2

3 of the 6 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
ghcr.io/spiffe/spire-agent:1.6.062517726d0c4
golang.org/x/crypto@v0.6.0
0.52.0
ghcr.io/spiffe/spire-controller-manager:0.2.25e90b2d092df
golang.org/x/crypto@v0.6.0
0.52.0
ghcr.io/spiffe/spire-server:1.6.0635b9024cad2
golang.org/x/crypto@v0.6.0
0.52.0

Open the chart page →

7,274
chadbotphntom0.2.31 of 1See more

chadbot phntom 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
phntom/chadbot:0.2.397c28e4178ad
golang.org/x/crypto@v0.10.0
0.52.0

Open the chart page →

1,104
chartmuseumphntom4.0.201 of 1See more

chartmuseum phntom 4.0.20

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
phntom/chartmuseum:v0.16.053883b65d9b7
golang.org/x/crypto@v0.9.0
0.52.0

Open the chart page →

2,949
pipelinewise-operatorpipelinewise-operatorVerified publisher0.5.11 of 1See more

pipelinewise-operator pipelinewise-operator 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
dirathea/pipelinewise-operator:v0.5.08d4c9f773ae1
golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83
0.52.0

Open the chart page →

2,122
secrets-store-csi-driver-provider-awsportefaix-hub0.4.01 of 1See more

secrets-store-csi-driver-provider-aws portefaix-hub 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
public.ecr.aws/aws-secrets-manager/secrets-store-csi-driver-provider-aws:1.0.r2-2021.08.13.20.34-linux-amd6402aed3370fce
golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0
0.52.0

Open the chart page →

2,214
postfix-exporterpostfix-exporterVerified publisher0.2.01 of 1See more

postfix-exporter postfix-exporter 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
ghcr.io/hsn723/postfix_exporter:0.20.0b7da7c554018
golang.org/x/crypto@v0.50.0
0.52.0

Open the chart page →

419
postgres-backuppostgres-backup0.3.01 of 2See more

postgres-backup postgres-backup 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
nerzhul/mc-arm64:2020.10.034215df511f31
golang.org/x/crypto@v0.0.0-20200820211705-5c72a883971a
0.52.0

Open the chart page →

5,471
rethinkdbpozetron1.1.91 of 1See more

rethinkdb pozetron 1.1.9

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
pozetroninc/rethinkdb-cluster:v2.4.16b06a098f994
golang.org/x/crypto@v0.0.0-20200302210943-78000ba7a073
0.52.0

Open the chart page →

2,913
JenkinsprasoonjenkinsVerified publisher0.1.01 of 1See more

Jenkins prasoonjenkins 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

2,545
home-assistantpree-helm-chartsVerified publisher1.81.01 of 1See more

home-assistant pree-helm-charts 1.81.0

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.3d89226851697
golang.org/x/crypto@v0.47.0
0.52.0

Open the chart page →

2,162
prometheus-pingmesh-exporterprometheus-communityVerified publisher0.5.01 of 1See more

prometheus-pingmesh-exporter prometheus-community 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
dongjiang1989/pingmesh-agent:v1.2.2c82de0272da0
golang.org/x/crypto@v0.28.0
0.52.0

Open the chart page →

856
prometheus-sql-exporterprometheus-communityVerified publisher0.5.01 of 1See more

prometheus-sql-exporter prometheus-community 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
ghcr.io/justwatchcom/sql_exporter:v0.8c4b1d3d0f052
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

1,353
prometheusprometheus-worawutchan13.0.03 of 6See more

prometheus prometheus-worawutchan 13.0.0

3 of the 6 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
quay.io/prometheus/alertmanager:v0.21.024a5204b418e
golang.org/x/crypto@v0.0.0-20191011191535-87dc89f01550
0.52.0
quay.io/prometheus/node-exporter:v1.0.1cf66a6bbd573
golang.org/x/crypto@v0.0.0-20200510223506-06a226fb4e37
0.52.0
quay.io/prometheus/prometheus:v2.22.1b899dbd1b901
golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0
0.52.0

Open the chart page →

9,952
kubernetes-dashboardpyalive-cdmswebappVerified publisher5.8.01 of 1See more

kubernetes-dashboard pyalive-cdmswebapp 5.8.0

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
kubernetesui/dashboard:v2.6.1290bebc3cd96
golang.org/x/crypto@v0.0.0-20220525230936-793ad666bf5e
0.52.0

Open the chart page →

1,663
phpqonstruktVerified publisher0.2.01 of 1See more

php qonstrukt 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
qonstrukt/php:8.4-v8-apache089af7925aa1
golang.org/x/crypto@v0.0.0-20200403201458-baeed622b8d8
0.52.0

Open the chart page →

56,167
velero-s3-deploymentradar-baseVerified publisher0.4.32 of 4See more

velero-s3-deployment radar-base 0.4.3

2 of the 4 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
velero/velero:v1.9.0277fbfaf8dcf
golang.org/x/crypto@v0.0.0-20210616213533-5ff15b29337e
0.52.0
quay.io/minio/mc:RELEASE.2024-11-21T17-21-54Z993e8c454a7e
golang.org/x/crypto@v0.27.0
0.52.0

Open the chart page →

4,821
ravendb-operatorravendb-operatorOfficialVerified publisher2.1.01 of 1See more

ravendb-operator ravendb-operator 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
ravendb/ravendb-operator:2.1.0511050205ac5
golang.org/x/crypto@v0.46.0
0.52.0

Open the chart page →

355
rbac-serverrbac-server1.19.11 of 1See more

rbac-server rbac-server 1.19.1

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
public.ecr.aws/cloudnatix/llmariner/rbac-server:1.19.1df1adeb86679
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

705
rclonercloneVerified publisher2.2.01 of 1See more

rclone rclone 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
rclone/rclone:1.6874c51b8817e5
golang.org/x/crypto@v0.25.0
0.52.0

Open the chart page →

1,681
redis-enterprise-operatorredis-enterprise-operatorVerified publisher7.13.4-121 of 1See more

redis-enterprise-operator redis-enterprise-operator 7.13.4-12

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
redislabs/operator:7.4.2-2ecb101af0506
golang.org/x/crypto@v0.17.0
0.52.0

Open the chart page →

2,638
kminionredpanda-dataOfficialVerified publisher0.15.21 of 1See more

kminion redpanda-data 0.15.2

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
redpandadata/kminion:v2.3.0c05fa976428e
golang.org/x/crypto@v0.47.0
0.52.0

Open the chart page →

924
reportportalreportportal-ioOfficialVerified publisher26.8.123 of 15See more

reportportal reportportal-io 26.8.12

3 of the 15 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2025.7.23-debian-12-r08935e75fa5d1
golang.org/x/crypto@v0.37.0
0.52.0
reportportal/migrations:5.15.4464468240d7b
golang.org/x/crypto@v0.36.0
0.52.0
reportportal/service-index:5.15.1b1860ed33071
golang.org/x/crypto@v0.51.0
0.52.0

Open the chart page →

12,327
backup-repository-serverriotkit-org4.0.01 of 1See more

backup-repository-server riotkit-org 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
ghcr.io/riotkit-org/backup-repository:v4.0.0ab41ffa78f69
golang.org/x/crypto@v0.0.0-20220331220935-ae2d96664a29
0.52.0

Open the chart page →

2,057
rke2-canalrke2-charts3.13.32 of 2See more

rke2-canal rke2-charts 3.13.3

2 of the 2 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
rancher/hardened-calico:v3.13.36d2cd61a338b
golang.org/x/crypto@v0.0.0-20190611184440-5c40567a22f8
0.52.0
rancher/hardened-flannel:v0.13.0-rancher142784bb38ed3
golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2
0.52.0

Open the chart page →

7,006
cloudflare-tunnelrlex0.8.01 of 1See more

cloudflare-tunnel rlex 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
cloudflare/cloudflared:2023.10.0c18744ae1767
golang.org/x/crypto@v0.11.0
0.52.0

Open the chart page →

1,723
hcloud-fip-controllerrlex0.2.51 of 1See more

hcloud-fip-controller rlex 0.2.5

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
cbeneke/hcloud-fip-controller:v0.4.1dc658078d7ba
golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975
0.52.0

Open the chart page →

2,964
prometheus-webhook-dingtalkrlex0.0.31 of 1See more

prometheus-webhook-dingtalk rlex 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
timonwong/prometheus-webhook-dingtalk:v1.4.0a0fcc028bd8d
golang.org/x/crypto@v0.0.0-20191205180655-e7c4368fe9dd
0.52.0

Open the chart page →

1,853
grafanaromanow-helm-chartsVerified publisher1.7.11 of 1See more

grafana romanow-helm-charts 1.7.1

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
grafana/grafana:8.3.4cf81d2c753c8
golang.org/x/crypto@v0.0.0-20210616213533-5ff15b29337e
0.52.0

Open the chart page →

2,844
jaeger-collectorromanow-helm-chartsVerified publisher1.5.01 of 1See more

jaeger-collector romanow-helm-charts 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-39832.

Container imageDigestPackageFixed in
jaegertracing/jaeger-collector:1.41.0ff81f0a9f63c
golang.org/x/crypto@v0.0.0-20220722155217-630584e8d5aa
0.52.0

Open the chart page →

1,861

Container images carrying it

2,853 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/csi-resizer:v2.0.04a95d94e57ad
golang.org/x/crypto@v0.37.0
0.52.0
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
golang.org/x/crypto@v0.36.0
0.52.0
1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.03ce0fdba4d8e
golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975
0.52.0
1

syft 1.42.1 · advisories as of 22 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.