StackRadar

CVE-2026-39833

Critical

Advisory

Published 22 May 2026In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
0.004
35th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,492
of 17,821 indexed, latest versions
Container images
2,818
deployed by those charts
Fix available
1 of 1
affected package

golang.org/x/crypto doesn't enforce invoking key constraints

Carried by container images the latest versions of 2,492 of 17,821 indexed charts deploy, on 2,818 images.

Affected packageAffected versionsFixed inImages
golang.org/x/cryptogolangv0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+154 more0.52.02,818
OSV records
GHSA-jppx-rxg9-jmrx
Also known as
GO-2026-5005

Charts affected

2,492 by stars
ChartLatestAffected imagesRadar Score
consulwarjiang1.3.02 of 2See more

consul warjiang 1.3.0

2 of the 2 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
hashicorp/consul:1.17.0712fe02d2f84
golang.org/x/crypto@v0.14.0
0.52.0
hashicorp/consul-k8s-control-plane:1.3.00e4452f0f265
golang.org/x/crypto@v0.0.0-20220411220226-7b82a4e95df4
0.52.0

Open the chart page →

4,102
eth-validatorwateim1.4.51 of 3See more

eth-validator wateim 1.4.5

1 of the 3 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
wateim/lighthouse-launch:latest2520149ee574
golang.org/x/crypto@v0.31.0
0.52.0

Open the chart page →

5,142
wavefront-hpa-adapterwavefront0.2.101 of 1See more

wavefront-hpa-adapter wavefront 0.2.10

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
wavefronthq/wavefront-hpa-adapter:0.9.12af5fef9a4768
golang.org/x/crypto@v0.14.0
0.52.0

Open the chart page →

1,692
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.14.45a065930682d
golang.org/x/crypto@v0.0.0-20200510223506-06a226fb4e37
0.52.0

Open the chart page →

5,623
wazuh-manager-filebeatwazuh-manager-filebeat0.1.0-gamma1 of 1See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
iosifache/wazuh-manager-filebeat:latest85df3f04b5da
golang.org/x/crypto@v0.0.0-20200510223506-06a226fb4e37
0.52.0

Open the chart page →

11,209
istio-service-meshwbstack0.0.11 of 1See more

istio-service-mesh wbstack 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
istio/pilot:1.17.1ce9d87606701
golang.org/x/crypto@v0.5.0
0.52.0

Open the chart page →

6,302
azure-janitorwebdevopsVerified publisher1.0.131 of 1See more

azure-janitor webdevops 1.0.13

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
webdevops/azure-janitor:24.9.02446baee7b69
golang.org/x/crypto@v0.27.0
0.52.0

Open the chart page →

802
azure-keyvault-exporterwebdevopsVerified publisher1.0.121 of 1See more

azure-keyvault-exporter webdevops 1.0.12

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
webdevops/azure-keyvault-exporter:24.9.1f333704ecd60
golang.org/x/crypto@v0.27.0
0.52.0

Open the chart page →

801
azure-loganalytics-exporterwebdevopsVerified publisher1.0.131 of 1See more

azure-loganalytics-exporter webdevops 1.0.13

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
webdevops/azure-loganalytics-exporter:25.12.0051845d06d85
golang.org/x/crypto@v0.46.0
0.52.0

Open the chart page →

509
azure-resourcegraph-exporterwebdevopsVerified publisher1.1.51 of 1See more

azure-resourcegraph-exporter webdevops 1.1.5

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
webdevops/azure-resourcegraph-exporter:24.9.0381136dda026
golang.org/x/crypto@v0.27.0
0.52.0

Open the chart page →

786
azure-resourcemanager-exporterwebdevopsVerified publisher1.3.61 of 1See more

azure-resourcemanager-exporter webdevops 1.3.6

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
webdevops/azure-resourcemanager-exporter:26.1.0d3e1842ad419
golang.org/x/crypto@v0.46.0
0.52.0

Open the chart page →

536
pagerduty-exporterwebdevopsVerified publisher1.1.81 of 1See more

pagerduty-exporter webdevops 1.1.8

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
webdevops/pagerduty-exporter:25.12.183b95faf10a0
golang.org/x/crypto@v0.46.0
0.52.0

Open the chart page →

509
jenkinswebencryptor1.9.181 of 1See more

jenkins webencryptor 1.9.18

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

2,549
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
golang.org/x/crypto@v0.25.0
0.52.0

Open the chart page →

28,827
webresourcecataloguswebresourcecatalogus1.1.01 of 4See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/webresourcecatalogus-php:latest8f1bbd5cda85
golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904
0.52.0

Open the chart page →

7,563
ambassadorwener6.9.51 of 2See more

ambassador wener 6.9.5

1 of the 2 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
golang.org/x/crypto@v0.0.0-20201221181555-eec23a3978ad
0.52.0

Open the chart page →

4,130
apisixwener2.17.01 of 3See more

apisix wener 2.17.0

1 of the 3 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
bitnamilegacy/etcd:latest99b408c15272
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

3,187
argo-cdwener10.9.22 of 3See more

argo-cd wener 10.9.2

2 of the 3 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.45.18499afd690c4
golang.org/x/crypto@v0.47.0
0.52.0
quay.io/argoproj/argocd:v3.5.3dd3f47d5a5e4
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

3,043
argo-eventswener2.4.271 of 1See more

argo-events wener 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

1,093
athens-proxywener0.5.22 of 2See more

athens-proxy wener 0.5.2

2 of the 2 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
gomods/athens:v0.11.0efb811df7844
golang.org/x/crypto@v0.0.0-20191206172530-e9b2fee46413
0.52.0
jaegertracing/all-in-one:latestab6f1a1f0fb4
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

5,009
cadencewener0.23.01 of 5See more

cadence wener 0.23.0

1 of the 5 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
ubercadence/server:0.23.22ac5491d13bb
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

10,152
filebrowserwener1.0.01 of 1See more

filebrowser wener 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.13.0c5d0a75a0041
golang.org/x/crypto@v0.0.0-20200510223506-06a226fb4e37
0.52.0

Open the chart page →

3,175
juicefs-csi-driverwener0.33.02 of 5See more

juicefs-csi-driver wener 0.33.0

2 of the 5 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
juicedata/csi-dashboard:v0.33.05e5edb62a010
golang.org/x/crypto@v0.51.0
0.52.0
juicedata/juicefs-csi-driver:v0.33.0f918e7331c05
golang.org/x/crypto@v0.49.0
0.52.0

Open the chart page →

9,078
kubernetes-dashboardwener7.14.03 of 5See more

kubernetes-dashboard wener 7.14.0

3 of the 5 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
kubernetesui/dashboard-api:1.14.096a702cfd339
golang.org/x/crypto@v0.38.0
0.52.0
kubernetesui/dashboard-auth:1.4.053e9917898bf
golang.org/x/crypto@v0.36.0
0.52.0
kubernetesui/dashboard-web:1.7.0cc7c31bd2d84
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

3,163
logging-operatorwener3.17.101 of 1See more

logging-operator wener 3.17.10

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
ghcr.io/banzaicloud/logging-operator:3.17.101b530cf7c07f
golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5
0.52.0

Open the chart page →

1,647
longhornwener1.2.31 of 2See more

longhorn wener 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
longhornio/longhorn-manager:v1.2.3dca34321452c
golang.org/x/crypto@v0.0.0-20201216223049-8b5274cf687f
0.52.0

Open the chart page →

15,485
minio-operatorwener4.3.71 of 2See more

minio-operator wener 4.3.7

1 of the 2 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
minio/operator:v4.3.754393e03f3b2
golang.org/x/crypto@v0.0.0-20210421170649-83a5a9bb288b
0.52.0

Open the chart page →

6,088
natswener2.14.61 of 3See more

nats wener 2.14.6

1 of the 3 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
natsio/nats-box:0.19.7ffce8bd10338
golang.org/x/crypto@v0.50.0
0.52.0

Open the chart page →

2,310
nats-account-serverwener0.8.11 of 1See more

nats-account-server wener 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
natsio/nats-account-server:1.0.0a3381560aab6
golang.org/x/crypto@v0.0.0-20210616213533-5ff15b29337e
0.52.0

Open the chart page →

2,635
nfs-subdir-external-provisionerwener4.0.181 of 1See more

nfs-subdir-external-provisioner wener 4.0.18

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.263d5e04551ec
golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975
0.52.0

Open the chart page →

2,746
openebswener3.10.02 of 3See more

openebs wener 3.10.0

2 of the 3 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
openebs/node-disk-operator:2.1.06afe2123c457
golang.org/x/crypto@v0.0.0-20220315160706-3147a52a75dd
0.52.0
openebs/provisioner-localpv:3.5.0aea39e49bb97
golang.org/x/crypto@v0.14.0
0.52.0

Open the chart page →

10,631
prometheus-blackbox-exporterwener11.18.01 of 1See more

prometheus-blackbox-exporter wener 11.18.0

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
quay.io/prometheus/blackbox-exporter:v0.28.0e753ff9f3fc4
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

600
prometheus-statsd-exporterwener1.0.01 of 1See more

prometheus-statsd-exporter wener 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
prom/statsd-exporter:v0.28.04e7a1f00b9b2
golang.org/x/crypto@v0.27.0
0.52.0

Open the chart page →

783
rancherwener2.15.11 of 2See more

rancher wener 2.15.1

1 of the 2 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
rancher/rancher:v2.15.15f6c4dc52a05
golang.org/x/crypto@v0.48.0
0.52.0

Open the chart page →

1,534
temporalwener0.15.14 of 13See more

temporal wener 0.15.1

4 of the 13 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
grafana/grafana:6.7.11ff3999e0fc0
golang.org/x/crypto@v0.0.0-20191011191535-87dc89f01550
0.52.0
prom/alertmanager:v0.20.07e4e9f7a0954
golang.org/x/crypto@v0.0.0-20190617133340-57b3e21c3d56
0.52.0
prom/prometheus:v2.16.0e4ca62c0d62f
golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2
0.52.0
temporalio/server:1.15.1e26758f5a1bf
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.52.0

Open the chart page →

22,716
traefikwener9.1.11 of 1See more

traefik wener 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
library/traefik:2.2.8f5af5a5ce17f
golang.org/x/crypto@v0.0.0-20200317142112-1b76d66859c6
0.52.0

Open the chart page →

3,379
victoria-metrics-k8s-stackwener0.93.01See more

victoria-metrics-k8s-stack wener 0.93.0

1 container image this version deploys carries CVE-2026-39833.

Container imageDigestPackageFixed in
quay.io/prometheus/node-exporter:v1.11.10f422f62c15f
golang.org/x/crypto@v0.49.0
0.52.0

Open the chart page →

—
ambassadorwenerme6.9.51 of 2See more

ambassador wenerme 6.9.5

1 of the 2 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
golang.org/x/crypto@v0.0.0-20201221181555-eec23a3978ad
0.52.0

Open the chart page →

4,130
apisixwenerme2.17.01 of 3See more

apisix wenerme 2.17.0

1 of the 3 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
bitnamilegacy/etcd:latest99b408c15272
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

3,187
argo-eventswenerme2.4.271 of 1See more

argo-events wenerme 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

1,093
athens-proxywenerme0.5.22 of 2See more

athens-proxy wenerme 0.5.2

2 of the 2 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
gomods/athens:v0.11.0efb811df7844
golang.org/x/crypto@v0.0.0-20191206172530-e9b2fee46413
0.52.0
jaegertracing/all-in-one:latestab6f1a1f0fb4
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

5,009
cadencewenerme0.23.01 of 5See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
ubercadence/server:0.23.22ac5491d13bb
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

10,152
filebrowserwenerme1.0.01 of 1See more

filebrowser wenerme 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.13.0c5d0a75a0041
golang.org/x/crypto@v0.0.0-20200510223506-06a226fb4e37
0.52.0

Open the chart page →

3,175
frpcwenerme1.0.11 of 1See more

frpc wenerme 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
wener/frpc:v0.37.0cc9fd4da44c0
golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2
0.52.0

Open the chart page →

3,360
juicefs-csi-driverwenerme0.33.02 of 5See more

juicefs-csi-driver wenerme 0.33.0

2 of the 5 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
juicedata/csi-dashboard:v0.33.05e5edb62a010
golang.org/x/crypto@v0.51.0
0.52.0
juicedata/juicefs-csi-driver:v0.33.0f918e7331c05
golang.org/x/crypto@v0.49.0
0.52.0

Open the chart page →

9,078
kubernetes-dashboardwenerme7.14.03 of 5See more

kubernetes-dashboard wenerme 7.14.0

3 of the 5 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
kubernetesui/dashboard-api:1.14.096a702cfd339
golang.org/x/crypto@v0.38.0
0.52.0
kubernetesui/dashboard-auth:1.4.053e9917898bf
golang.org/x/crypto@v0.36.0
0.52.0
kubernetesui/dashboard-web:1.7.0cc7c31bd2d84
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

3,548
logging-operatorwenerme3.17.101 of 1See more

logging-operator wenerme 3.17.10

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
ghcr.io/banzaicloud/logging-operator:3.17.101b530cf7c07f
golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5
0.52.0

Open the chart page →

1,647
longhornwenerme1.2.31 of 2See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
longhornio/longhorn-manager:v1.2.3dca34321452c
golang.org/x/crypto@v0.0.0-20201216223049-8b5274cf687f
0.52.0

Open the chart page →

15,485
miniowenerme8.0.101 of 1See more

minio wenerme 8.0.10

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2021-02-14T04-01-33Zbd11edda91f3
golang.org/x/crypto@v0.0.0-20201124201722-c8d3bf9c5392
0.52.0

Open the chart page →

6,950
minio-standalonewenerme1.0.21 of 1See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-39833.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2022-01-04T07-41-07Z1484c87239ea
golang.org/x/crypto@v0.0.0-20211209193657-4570a0811e8b
0.52.0

Open the chart page →

6,173

Container images carrying it

2,818 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/kube-scheduler:v1.26.110684e23172d9
golang.org/x/crypto@v0.14.0
0.52.0
1
registry.k8s.io/kube-scheduler:v1.28.73ae5620a33bb
golang.org/x/crypto@v0.16.0
0.52.0
1
registry.k8s.io/kube-scheduler:v1.28.1146cf7475c8da
golang.org/x/crypto@v0.21.0
0.52.0
1
registry.k8s.io/kube-scheduler:v1.25.09330c53feca7
golang.org/x/crypto@v0.0.0-20220315160706-3147a52a75dd
0.52.0
1
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.8.05658d0011a41
golang.org/x/crypto@v0.0.0-20221012134737-56aed061732a
0.52.0
1
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.8.2ec5732e28f15
golang.org/x/crypto@v0.0.0-20221012134737-56aed061732a
0.52.0
1
registry.k8s.io/kwok/kwok:v0.8.06d25aa8fbdfe
golang.org/x/crypto@v0.48.0
0.52.0
1
registry.k8s.io/metrics-server/metrics-server:v0.7.01c0419326500
golang.org/x/crypto@v0.18.0
0.52.0
1
registry.k8s.io/metrics-server/metrics-server:v0.7.1db3800085a09
golang.org/x/crypto@v0.18.0
0.52.0
1
registry.k8s.io/nfd/node-feature-discovery:v0.16.619ebca8b3804
golang.org/x/crypto@v0.23.0
0.52.0
1
registry.k8s.io/node-problem-detector/node-problem-detector:v0.8.2052f0618e9bc2
golang.org/x/crypto@v0.25.0
0.52.0
1
registry.k8s.io/node-problem-detector/node-problem-detector:v1.35.1c380751accc5
golang.org/x/crypto@v0.46.0
0.52.0
1
registry.k8s.io/prometheus-adapter/prometheus-adapter:v0.11.1e6a43c83ab16
golang.org/x/crypto@v0.1.0
0.52.0
1
registry.k8s.io/provider-os/openstack-cloud-controller-manager:v1.36.0e354e40db2d0
golang.org/x/crypto@v0.50.0
0.52.0
1
registry.k8s.io/sig-storage/csi-attacher:v4.10.0be59d0556508
golang.org/x/crypto@v0.38.0
0.52.0
1
registry.k8s.io/sig-storage/csi-resizer:v2.0.04a95d94e57ad
golang.org/x/crypto@v0.37.0
0.52.0
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
golang.org/x/crypto@v0.36.0
0.52.0
1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.03ce0fdba4d8e
golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975
0.52.0
1

syft 1.42.1 · advisories as of 20 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.