StackRadar

CVE-2026-41178

Unscored

Advisory

Published 24 Jul 2026In the index since 5 Sept 2026
Severity
Unscored
worst across findings
CVSS
—
base score, highest
EPSS
0.003
27th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
480
of 17,790 indexed, latest versions
Container images
444
deployed by those charts
Fix available
1 of 1
affected package

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

Carried by container images the latest versions of 480 of 17,790 indexed charts deploy, on 444 images.

Affected packageAffected versionsFixed inImages
go.opentelemetry.io/otelgolangv1.41.0, v1.43.01.42.0444
OSV records
GO-2026-5158
Also known as
GHSA-5wrp-cwcj-q835

Charts affected

480 by stars
ChartLatestAffected imagesRadar Score
trident-protecttrident-protect100.2606.01 of 2See more

trident-protect trident-protect 100.2606.0

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
netapp/controller:26.06.08235a77cfc92
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,347
trident-protect-consoletrident-protect100.2608.0-console1 of 3See more

trident-protect-console trident-protect 100.2608.0-console

1 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
netapp/controller:26.08.0-console09c6cc6b5f71
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,338
tyk-control-planetyk-helm5.3.03 of 7See more

tyk-control-plane tyk-helm 5.3.0

3 of the 7 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
tykio/tyk-dashboard:v5.13.10e03b94c153d
go.opentelemetry.io/otel@v1.43.0
1.42.0
tykio/tyk-gateway-ee:v5.13.13e907e675bf9
go.opentelemetry.io/otel@v1.43.0
1.42.0
tykio/tyk-mdcb-docker:v2.12.0942a5b8bf847
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

2,977
tyk-dashboardtyk-helm5.3.01 of 1See more

tyk-dashboard tyk-helm 5.3.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
tykio/tyk-dashboard:v5.13.10e03b94c153d
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

676
tyk-data-planetyk-helm5.3.01 of 3See more

tyk-data-plane tyk-helm 5.3.0

1 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
tykio/tyk-gateway-ee:v5.13.13e907e675bf9
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

871
tyk-dev-portaltyk-helm5.3.01 of 2See more

tyk-dev-portal tyk-helm 5.3.0

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
tykio/portal:v1.18.092509e00e618
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

890
tyk-mdcbtyk-helm5.3.01 of 1See more

tyk-mdcb tyk-helm 5.3.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
tykio/tyk-mdcb-docker:v2.12.0942a5b8bf847
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

156
tyk-stacktyk-helm5.3.02 of 7See more

tyk-stack tyk-helm 5.3.0

2 of the 7 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
tykio/tyk-dashboard:v5.13.10e03b94c153d
go.opentelemetry.io/otel@v1.43.0
1.42.0
tykio/tyk-gateway-ee:v5.13.13e907e675bf9
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

2,921
upcloud-csiupcloud-csiVerified publisher1.18.05 of 7See more

upcloud-csi upcloud-csi 1.18.0

5 of the 7 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-attacher:v4.12.0b9dc9a714a48
go.opentelemetry.io/otel@v1.43.0
1.42.0
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.17.0f9de845b1701
go.opentelemetry.io/otel@v1.43.0
1.42.0
registry.k8s.io/sig-storage/csi-resizer:v2.2.0a2d40c1c3ccb
go.opentelemetry.io/otel@v1.41.0
1.42.0
registry.k8s.io/sig-storage/csi-snapshotter:v8.6.042af0929bcd6
go.opentelemetry.io/otel@v1.43.0
1.42.0
registry.k8s.io/sig-storage/snapshot-controller:v8.6.081e79f205083
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,888
vault-sync-operatorvault-sync-operatorVerified publisher0.1.11 of 1See more

vault-sync-operator vault-sync-operator 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/danieldonoghue/vault-sync-operator:v0.0.1-beta.38d7ec69a193c
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

269
velero-clientvelero-clientVerified publisher1.4.21 of 1See more

velero-client velero-client 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/velero-client/velero-client:1.4.203015f863a3e
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

538
volcanovolcano-sh1.15.23 of 3See more

volcano volcano-sh 1.15.2

3 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
volcanosh/vc-controller-manager:v1.15.26a6bc2560d51
go.opentelemetry.io/otel@v1.43.0
1.42.0
volcanosh/vc-scheduler:v1.15.2afab36286a17
go.opentelemetry.io/otel@v1.43.0
1.42.0
volcanosh/vc-webhook-manager:v1.15.22fff65aad011
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,541
eth-validatorwateim1.4.51 of 3See more

eth-validator wateim 1.4.5

1 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ethereum/client-go:latest37575ec10fbc
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

5,090
argo-workflowswenerme2.0.61 of 3See more

argo-workflows wenerme 2.0.6

1 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-workflows-crdinstaller:v4.1.394a031823f2a
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

259
gitlab-runnerwenerme0.92.21 of 1See more

gitlab-runner wenerme 0.92.2

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v19.3.25448611a3c54
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

290
haproxy-ingresswenerme0.16.11 of 1See more

haproxy-ingress wenerme 0.16.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/jcmoraisjr/haproxy-ingress:v0.16.16fd744191ef6
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

794
harborwenerme1.19.24 of 8See more

harbor wenerme 1.19.2

4 of the 8 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
goharbor/harbor-core:v2.15.2d7b780d23721
go.opentelemetry.io/otel@v1.43.0
1.42.0
goharbor/harbor-jobservice:v2.15.2f71a4452a095
go.opentelemetry.io/otel@v1.43.0
1.42.0
goharbor/harbor-registryctl:v2.15.2223d5cb49d5d
go.opentelemetry.io/otel@v1.43.0
1.42.0
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,686
juicefs-csi-driverwenerme0.32.51 of 5See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.32.595008ba63318
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

9,183
kube-state-metricswenerme8.5.01 of 1See more

kube-state-metrics wenerme 8.5.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.042cfe3723a5f
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

89
mesherywenerme1.0.701 of 1See more

meshery wenerme 1.0.70

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
meshery/meshery:stable-latest44b64ee128fb
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,438
prometheuswenerme29.30.01 of 6See more

prometheus wenerme 29.30.0

1 of the 6 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.042cfe3723a5f
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

478
rancherwenerme2.15.12 of 2See more

rancher wenerme 2.15.1

2 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
rancher/rancher:v2.15.15f6c4dc52a05
go.opentelemetry.io/otel@v1.43.0
1.42.0
rancher/shell:v0.8.1f293af9c635f
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,487
victoria-metrics-k8s-stackwenerme0.92.12 of 7See more

victoria-metrics-k8s-stack wenerme 0.92.1

2 of the 7 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
grafana/grafana:13.1.17cb8c64c4d57
go.opentelemetry.io/otel@v1.43.0
1.42.0
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.185108987d044
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,910
orcwiremindVerified publisher0.3.01 of 1See more

orc wiremind 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/orc/openstack-resource-controller:v2.5.079f22af49612
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

269
wordpress-alpinewordpress-alpine1.5.181 of 6See more

wordpress-alpine wordpress-alpine 1.5.18

1 of the 6 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
registry.k8s.io/kubectl:v1.36.2b0d792e0d8df
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

4,063
xboardxboard0.2.01 of 1See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/cedar2025/xboard:latest896e4926e0d7
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,049
xonodepoolsxonodepoolsOfficialVerified publisher1.0.71 of 1See more

xonodepools xonodepools 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
xosphere/xonodepools:1.0.71458097b6f85
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

394
prometheus-monitoring-stackyotron-helm-charts1.2.01 of 3See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

1 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

899
posthogzeet0.23.21 of 9See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
altinity/metrics-exporter:latest8940ecadae65
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

3,697
zoo-project-druzoo-projectOfficialVerified publisher0.10.41 of 6See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a9a507cb7e2dd
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

7,929

Container images carrying it

444 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

No deployed image carries CVE-2026-41178.

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.