StackRadar

CVE-2026-41178

Unscored

Advisory

Published 24 Jul 2026In the index since 5 Sept 2026
Severity
Unscored
worst across findings
CVSS
—
base score, highest
EPSS
0.003
27th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
480
of 17,787 indexed, latest versions
Container images
444
deployed by those charts
Fix available
1 of 1
affected package

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

Carried by container images the latest versions of 480 of 17,787 indexed charts deploy, on 444 images.

Affected packageAffected versionsFixed inImages
go.opentelemetry.io/otelgolangv1.41.0, v1.43.01.42.0444
OSV records
GO-2026-5158
Also known as
GHSA-5wrp-cwcj-q835

Charts affected

480 by stars
ChartLatestAffected imagesRadar Score
kamajiclastixVerified publisher0.0.0+latest1 of 4See more

kamaji clastix 0.0.0+latest

1 of the 4 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
clastix/kamaji:latesta7c5d108810b
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

4,630
cloudfront-tenant-operatorcloudfront-tenant-operatorVerified publisher0.3.01 of 1See more

cloudfront-tenant-operator cloudfront-tenant-operator 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/dsp0x4/cloudfront-tenant-operator:0.3.0eb40174cd20d
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

269
hcloud-ccm-mgmtcloudhippieVerified publisher1.11.01 of 1See more

hcloud-ccm-mgmt cloudhippie 1.11.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
hetznercloud/hcloud-cloud-controller-manager:v1.37.0c139e7220dbc
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

247
hcloud-csi-mgmtcloudhippieVerified publisher2.10.01 of 5See more

hcloud-csi-mgmt cloudhippie 2.10.0

1 of the 5 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-resizer:v2.2.1ea1d25e23479
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

583
ocs-operatorcloud-native-toolkit0.2.41 of 1See more

ocs-operator cloud-native-toolkit 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

369
refarch-infraconfigcloud-native-toolkit0.2.21 of 1See more

refarch-infraconfig cloud-native-toolkit 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

369
pulsarcloudve0.2.01 of 2See more

pulsar cloudve 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
library/docker:dind5efed980cba3
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

5,994
argo-cdcluster-deploy0.3.21 of 3See more

argo-cd cluster-deploy 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-image-updater:v1.2.13c56f354fac5
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

3,733
authentikcluster-deploy0.2.01 of 1See more

authentik cluster-deploy 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

2,457
coder-ai-gatewaycoder-v2Verified publisher2.37.11 of 1See more

coder-ai-gateway coder-v2 2.37.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/coder/coder:v2.37.10c6994bb4c5a
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

187
coder-provisionercoder-v2OfficialVerified publisher2.37.11 of 1See more

coder-provisioner coder-v2 2.37.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/coder/coder:v2.37.10c6994bb4c5a
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

187
cohdicohdi0.2.21 of 3See more

cohdi cohdi 0.2.2

1 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/cohdi/composable-resource-operator:v0.2.23f45bf0a1bc0
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

3,680
loki-stackcommon-chartsVerified publisher1.0.34 of 12See more

loki-stack common-charts 1.0.3

4 of the 12 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
grafana/grafana:13.1.17cb8c64c4d57
go.opentelemetry.io/otel@v1.43.0
1.42.0
grafana/loki:3.6.1144148ad243c0
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/prometheus-operator/prometheus-config-reloader:v0.91.07d9e4eea5f11
go.opentelemetry.io/otel@v1.43.0
1.42.0
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.185108987d044
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

5,370
autovpacontainerooVerified publisher0.4.21 of 1See more

autovpa containeroo 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/containeroo/autovpa:v0.0.3425b801d8d1f7
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

298
kube-ephemeral-container-exportercontainerooVerified publisher0.2.31 of 1See more

kube-ephemeral-container-exporter containeroo 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/containeroo/kube-ephemeral-container-exporter:v0.0.14b238f3c58d83
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

298
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
library/docker:dind5efed980cba3
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

14,587
grafana-mcpcowboysysopVerified publisher2.0.01 of 1See more

grafana-mcp cowboysysop 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
mcp/grafana:latest9362bcf6aa0e
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,193
csghubcsghubVerified publisher2.4.35 of 34See more

csghub csghub 2.4.3

5 of the 34 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
opencsghq/csghub-server:v2.4.0-ee302c9d45d8a8
go.opentelemetry.io/otel@v1.43.0
1.42.0
opencsghq/kube-state-metrics:v2.19.15ea147562ec8
go.opentelemetry.io/otel@v1.43.0
1.42.0
temporalio/auto-setup:1.29.7f14912b699cf
go.opentelemetry.io/otel@v1.43.0
1.42.0
gcr.io/knative-releases/knative.dev/operator/cmd/operator:v1.22.1ea30f1ce8dc4
go.opentelemetry.io/otel@v1.43.0
1.42.0
gcr.io/knative-releases/knative.dev/operator/cmd/webhook:v1.22.195d1a4fc8cd0
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

59,131
csi-driver-ipfscsi-driver-ipfs0.2.01 of 6See more

csi-driver-ipfs csi-driver-ipfs 0.2.0

1 of the 6 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/ptrvsrg/csi-driver-ipfs:latest97d2d9ccd7a5
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

3,630
ipfs-clustercsi-driver-ipfs0.2.01 of 2See more

ipfs-cluster csi-driver-ipfs 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ipfs/ipfs-cluster:v1.1.6a83266c524f1
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,475
custom-rhcl-consolecustom-rhcl-consoleVerified publisher0.1.21 of 3See more

custom-rhcl-console custom-rhcl-console 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,931
cw-container-insightcwci0.7.01 of 1See more

cw-container-insight cwci 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
amazon/cloudwatch-agent:latest-arm649dea6643715a
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

274
cloudflaredcyberjakeVerified publisher0.3.201 of 1See more

cloudflared cyberjake 0.3.20

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
cloudflare/cloudflared:2026.6.16d91c121b803
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

601
dapr-agentsdapr-agents-devVerified publisher0.1.52 of 31See more

dapr-agents dapr-agents-dev 0.1.5

2 of the 31 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
mcp/grafana:latest9362bcf6aa0e
go.opentelemetry.io/otel@v1.43.0
1.42.0
public.ecr.aws/diagrid-dev/diagrid-dashboard:latestf1348a65664a
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

22,223
monitoring-stackdata354-helmVerified publisher1.4.21 of 4See more

monitoring-stack data354-helm 1.4.2

1 of the 4 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

3,189
csi-driver-smbdeimosfr-charts1.20.34 of 5See more

csi-driver-smb deimosfr-charts 1.20.3

4 of the 5 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.17.0f9de845b1701
go.opentelemetry.io/otel@v1.43.0
1.42.0
registry.k8s.io/sig-storage/csi-resizer:v2.2.0a2d40c1c3ccb
go.opentelemetry.io/otel@v1.41.0
1.42.0
registry.k8s.io/sig-storage/livenessprobe:v2.19.006da0d5b8908
go.opentelemetry.io/otel@v1.43.0
1.42.0
registry.k8s.io/sig-storage/smbplugin:v1.20.3dc7746bb081e
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

2,952
caddy-reverse-proxydevtron0.10.11 of 1See more

caddy-reverse-proxy devtron 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
library/caddy:latest13ba145cba2f
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

846
devtron-enterprisedevtron48.0.07 of 28See more

devtron-enterprise devtron 48.0.0

7 of the 28 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/devtron/chart-sync:94237c18-1021-3941960566529446a
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/devtron/cost-sync:172ef62b-1159-39429edf210d763ca
go.opentelemetry.io/otel@v1.41.0
1.42.0
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/devtron/kubelink:94237c18-314-394179d25865295af
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/devtron/lens:3b3d6d0e-333-39292e886b8d2b54b
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

66,542
caddy-reverse-proxydevtron-labs0.10.11 of 1See more

caddy-reverse-proxy devtron-labs 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
library/caddy:latestdf7f1c2fb114
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

846
devtron-enterprisedevtron-labs48.0.07 of 28See more

devtron-enterprise devtron-labs 48.0.0

7 of the 28 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/devtron/chart-sync:94237c18-1021-3941960566529446a
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/devtron/cost-sync:172ef62b-1159-39429edf210d763ca
go.opentelemetry.io/otel@v1.41.0
1.42.0
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/devtron/kubelink:94237c18-314-394179d25865295af
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/devtron/lens:3b3d6d0e-333-39292e886b8d2b54b
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

66,542
devtron-operatordevtron-labs0.23.33 of 11See more

devtron-operator devtron-labs 0.23.3

3 of the 11 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/devtron/chart-sync:3b3d6d0e-836-39296721b5c9634d4
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/devtron/kubelink:09867a9c-564-39289ea6dd1e4ce71
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

31,447
ownclouddjjudas21Verified publisher0.3.231 of 3See more

owncloud djjudas21 0.3.23

1 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
owncloud/server:10.16.3b3f9efdcd7f7
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

10,129
dnation-kubernetes-monitoring-stackdnationcloud4.0.22 of 17See more

dnation-kubernetes-monitoring-stack dnationcloud 4.0.2

2 of the 17 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
go.opentelemetry.io/otel@v1.43.0
1.42.0
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.185108987d044
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

21,455
uptime-kumaegebackVerified publisher2.0.121 of 1See more

uptime-kuma egeback 2.0.12

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

30,167
netobserv-flowelastiflowVerified publisher0.11.01 of 1See more

netobserv-flow elastiflow 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
elastiflow/flow-collector:7.26.0fee67842e16b
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,474
cd-pipeline-operatorepmdedpVerified publisher2.32.01 of 1See more

cd-pipeline-operator epmdedp 2.32.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
epamedp/cd-pipeline-operator:2.32.0fc858071b7a1
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

129
codebase-operatorepmdedpVerified publisher2.35.01 of 1See more

codebase-operator epmdedp 2.35.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
epamedp/codebase-operator:2.35.0295a008abcef
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

118
edp-installepmdedpOfficialVerified publisher3.15.02 of 7See more

edp-install epmdedp 3.15.0

2 of the 7 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
epamedp/cd-pipeline-operator:2.32.0fc858071b7a1
go.opentelemetry.io/otel@v1.43.0
1.42.0
epamedp/codebase-operator:2.35.0295a008abcef
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

2,034
keycloak-operatorepmdedpVerified publisher1.35.01 of 1See more

keycloak-operator epmdedp 1.35.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
epamedp/keycloak-operator:1.35.0a5398eaa7b80
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

122
nexus-operatorepmdedpVerified publisher3.6.01 of 1See more

nexus-operator epmdedp 3.6.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
epamedp/nexus-operator:3.6.09fede333ef27
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

103
sonar-operatorepmdedpVerified publisher3.4.01 of 1See more

sonar-operator epmdedp 3.4.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
epamedp/sonar-operator:3.4.0661d1648a49a
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

103
erasereraser1.4.21 of 1See more

eraser eraser 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/eraser-dev/eraser-manager:v1.4.2cda6025d1152
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

97
assertoorethereum-helm-chartsVerified publisher1.2.01 of 1See more

assertoor ethereum-helm-charts 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ethpandaops/assertoor:latest1efa2fba6711
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

2,903
cbt-apiethereum-helm-chartsVerified publisher0.0.141 of 1See more

cbt-api ethereum-helm-charts 0.0.14

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ethpandaops/cbt-api:latest9dc0b50e6c27
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

402
contributoorethereum-helm-chartsVerified publisher0.0.21 of 1See more

contributoor ethereum-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ethpandaops/contributoor:latest1edd4074fd79
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

877
execution-processorethereum-helm-chartsVerified publisher0.0.31 of 1See more

execution-processor ethereum-helm-charts 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ethpandaops/execution-processor:latest5c4832e9588f
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

708
spamoorethereum-helm-chartsVerified publisher1.0.11 of 1See more

spamoor ethereum-helm-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ethpandaops/spamoor:latest5f731b20ec50
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,127
syncoor-serverethereum-helm-chartsVerified publisher0.0.11 of 1See more

syncoor-server ethereum-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/ethpandaops/syncoor:master233aa9808fc7
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

953
xatuethereum-helm-chartsVerified publisher0.0.11 of 1See more

xatu ethereum-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ethpandaops/xatu:latest74d4cf2c436c
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

585
xatu-cannonethereum-helm-chartsVerified publisher0.2.21 of 1See more

xatu-cannon ethereum-helm-charts 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ethpandaops/xatu:latest74d4cf2c436c
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

585

Container images carrying it

444 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

No deployed image carries CVE-2026-41178.

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.