StackRadar

CVE-2026-41178

Unscored

Advisory

Published 24 Jul 2026In the index since 5 Sept 2026
Severity
Unscored
worst across findings
CVSS
—
base score, highest
EPSS
0.003
27th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
475
of 17,787 indexed, latest versions
Container images
438
deployed by those charts
Fix available
1 of 1
affected package

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

Carried by container images the latest versions of 475 of 17,787 indexed charts deploy, on 438 images.

Affected packageAffected versionsFixed inImages
go.opentelemetry.io/otelgolangv1.41.0, v1.43.01.42.0438
OSV records
GO-2026-5158
Also known as
GHSA-5wrp-cwcj-q835

Charts affected

475 by stars
ChartLatestAffected imagesRadar Score
kubetailkubetailVerified publisher0.26.01 of 3See more

kubetail kubetail 0.26.0

1 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/kubetail-org/kubetail-dashboard:0.17.08617f0a7f703
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,850
kitcaddykvalitetsitVerified publisher1.5.111 of 2See more

kitcaddy kvalitetsit 1.5.11

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
kvalitetsit/kitcaddy:1.5.110e66907ea266
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

124
kymaroskymarosVerified publisher0.6.91 of 1See more

kymaros kymaros 0.6.9

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/kymaroshq/kymaros:0.6.9fb3b88633381
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

269
chibisafel4gVerified publisher0.1.11 of 3See more

chibisafe l4g 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
library/caddy:2-alpine5f5c8640aae0
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

5,654
lgtmlgtmVerified publisher0.27.01See more

lgtm lgtm 0.27.0

1 container image this version deploys carries CVE-2026-41178.

Container imageDigestPackageFixed in
grafana/grafana:13.2.1-distroless3600073f45a9
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

—
lgtm-stacklgtm-stackVerified publisher0.1.31 of 8See more

lgtm-stack lgtm-stack 0.1.3

1 of the 8 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

5,576
lumenvoxlumenvox7.1.01 of 11See more

lumenvox lumenvox 7.1.0

1 of the 11 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
lumenvox/license:7.135d0b1ac053e
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

4,283
cert-manager-webhook-infomaniakm0nsterrr-cert-manager-webhook-infomaniakVerified publisher1.1.21 of 1See more

cert-manager-webhook-infomaniak m0nsterrr-cert-manager-webhook-infomaniak 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/m0nsterrr/cert-manager-webhook-infomaniak:v0.1.5990dbf506d41
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

169
opentelemetry-demoopentelemetry-helmVerified publisher0.41.12 of 34See more

opentelemetry-demo opentelemetry-helm 0.41.1

2 of the 34 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
go.opentelemetry.io/otel@v1.43.0
1.42.0
ghcr.io/open-feature/flagd:v0.16.032234e63c1d0
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

22,420
opikopikOfficialVerified publisher2.2.611See more

opik opik 2.2.61

1 container image this version deploys carries CVE-2026-41178.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.27.1a802b3a19d20
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

—
osc-bsu-csi-driverosc-bsu-csi-driverVerified publisher2.2.02 of 6See more

osc-bsu-csi-driver osc-bsu-csi-driver 2.2.0

2 of the 6 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-attacher:v4.12.0b9dc9a714a48
go.opentelemetry.io/otel@v1.43.0
1.42.0
registry.k8s.io/sig-storage/csi-resizer:v2.2.1ea1d25e23479
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

2,335
podtracepodtraceOfficialVerified publisher0.14.81 of 2See more

podtrace podtrace 0.14.8

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
alpine/k8s:1.37.0b421c2e9419e
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

589
projectionprojectionVerified publisher0.3.21 of 1See more

projection projection 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/projection-operator/projection:0.3.2d06374430a17
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

204
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

8,158
go-kube-downscalerpy-kube-downscalerVerified publisher1.3.41 of 1See more

go-kube-downscaler py-kube-downscaler 1.3.4

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/caas-team/gokubedownscaler:1.3.4cea3dd2f1312
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

220
caddyquench-caddyVerified publisher0.0.141 of 1See more

caddy quench-caddy 0.0.14

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/caddydigest-pinned73689c430946
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

81
ravendb-operatorravendb-operatorOfficialVerified publisher2.1.01 of 1See more

ravendb-operator ravendb-operator 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ravendb/ravendb-operator:2.1.0511050205ac5
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

341
reportportalreportportal-ioOfficialVerified publisher26.8.122 of 15See more

reportportal reportportal-io 26.8.12

2 of the 15 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
rancher/kubectl:v1.36.206c7a7a97727
go.opentelemetry.io/otel@v1.41.0
1.42.0
reportportal/k8s-wait-for:latest06cdf299b397
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

11,869
retyc-csiretyc-csi0.2.01 of 3See more

retyc-csi retyc-csi 0.2.0

1 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.17.0f9de845b1701
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,327
sceptresceptreai0.1.121 of 5See more

sceptre sceptreai 0.1.12

1 of the 5 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
maponyacharles/sceptreai:seaweedfs-0.1.127c8a525f08e9
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

4,369
simply-dns-webhooksimply-dns-webhookVerified publisher1.10.01 of 1See more

simply-dns-webhook simply-dns-webhook 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/runnerm/simply-dns-webhook:v1.10.0fdfffa3984a5
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

415
thanossolidchartsVerified publisher0.12.21 of 1See more

thanos solidcharts 0.12.2

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.42.4b567818fe608
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

196
thanosstevehipwell-helm-charts-thanosVerified publisher1.24.11 of 1See more

thanos stevehipwell-helm-charts-thanos 1.24.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.42.4b567818fe608
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

196
switchboardswitchboardVerified publisher0.7.41 of 1See more

switchboard switchboard 0.7.4

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/borchero/switchboard:0.7.454a193b757da
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

839
starboard-operatortrivy-operator0.10.251 of 1See more

starboard-operator trivy-operator 0.10.25

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
aquasec/starboard-operator:0.15.38e0b1c7ddc843
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

172
tyk-operatortyk-helm1.4.21 of 1See more

tyk-operator tyk-helm 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
tykio/tyk-operator:v1.4.2e13d37f298b7
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

134
warpgate-operatorwarpgate-operator0.4.101 of 1See more

warpgate-operator warpgate-operator 0.4.10

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/thereisnotime/warpgate-operator:0.4.140f651dd95507
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

37
kube-prometheus-stackwenerme91.4.02See more

kube-prometheus-stack wenerme 91.4.0

2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
grafana/grafana:13.2.1-distroless3600073f45a9
go.opentelemetry.io/otel@v1.43.0
1.42.0
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.042cfe3723a5f
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

—
wordpress-helmwordpress-helm0.2.91 of 4See more

wordpress-helm wordpress-helm 0.2.9

1 of the 4 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
aapjeisbaas/wp-frankenphp:v0.2.26b261abc7fb0
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

8,217
memoszekker6Verified publisher0.55.01 of 1See more

memos zekker6 0.55.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
neosmemo/memos:0.30.071a5b4738d1b
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

555
accurateaccurate0.7.131 of 1See more

accurate accurate 0.7.13

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/cybozu-go/accurate:1.9.07877e91ed723
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

150
uptime-kumaadnoctemVerified publisher0.4.11 of 1See more

uptime-kuma adnoctem 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

30,028
aerospike-kubernetes-operatoraerospike4.5.01 of 1See more

aerospike-kubernetes-operator aerospike 4.5.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
aerospike/aerospike-kubernetes-operator:4.5.070a9eeb991b8
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

598
vault-operatoralekcVerified publisher1.26.11 of 1See more

vault-operator alekc 1.26.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/bank-vaults/vault-operator:v1.24.06f622c5fb8a9
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

535
gotifyalexvanderberkelVerified publisher0.7.01 of 1See more

gotify alexvanderberkel 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
gotify/server:3.1.0be44495e4609
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

320
monitoringantmediaVerified publisher1.0.01 of 6See more

monitoring antmedia 1.0.0

1 of the 6 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

2,453
accounts-uiappscodeVerified publisher2026.9.111 of 1See more

accounts-ui appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

2,592
aceappscodeVerified publisher2026.9.111 of 2See more

ace appscode 2026.9.11

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

2,894
ace-installerappscodeVerified publisher2026.9.112 of 2See more

ace-installer appscode 2026.9.11

2 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
library/registry:3.1.11be55279f18a
go.opentelemetry.io/otel@v1.43.0
1.42.0
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

3,225
ace-installer-certifiedappscodeVerified publisher2026.9.112 of 2See more

ace-installer-certified appscode 2026.9.11

2 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
library/registry:3.1.11be55279f18a
go.opentelemetry.io/otel@v1.43.0
1.42.0
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

3,225
appscode-otel-stackappscodeVerified publisher2026.7.151 of 3See more

appscode-otel-stack appscode 2026.7.15

1 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator:0.150.089490ef63b72
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,421
aws-credential-managerappscodeVerified publisher2026.4.161 of 1See more

aws-credential-manager appscode 2026.4.16

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/appscode/aws-credential-manager:v0.1.00511bbe501c3
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

605
billingappscodeVerified publisher2026.9.111 of 1See more

billing appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

2,592
cluster-presetsappscodeVerified publisher2026.9.111 of 1See more

cluster-presets appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/appscode/cluster-presets:v0.0.128fbdd2479645
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

332
cluster-profile-managerappscodeVerified publisher2026.6.261 of 1See more

cluster-profile-manager appscode 2026.6.26

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/kluster-manager/cluster-profile:v0.12.17390a215d63c
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

310
external-dns-operatorappscodeVerified publisher2026.6.221 of 1See more

external-dns-operator appscode 2026.6.22

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/appscode/external-dns-operator:v0.4.05605f97e636d
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

289
fargocdappscodeVerified publisher2026.5.221 of 1See more

fargocd appscode 2026.5.22

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/appscode/fargocd:v0.0.31f5c791fc54d
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

446
fargocd-managerappscodeVerified publisher2026.5.221 of 1See more

fargocd-manager appscode 2026.5.22

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/appscode/fargocd:v0.0.31f5c791fc54d
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

446
grafana-operatorappscodeVerified publisher2026.6.121 of 1See more

grafana-operator appscode 2026.6.12

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/appscode/grafana-tools:v0.8.077c9d29080eb
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

361
kubedb-autoscalerappscodeVerified publisher0.51.01 of 1See more

kubedb-autoscaler appscode 0.51.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/kubedb/kubedb-autoscaler:v0.51.05d1182ac21f0
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

496

Container images carrying it

438 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

No deployed image carries CVE-2026-41178.

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.