StackRadar

CVE-2026-41178

Unscored

Advisory

Published 24 Jul 2026In the index since 5 Sept 2026
Severity
Unscored
worst across findings
CVSS
—
base score, highest
EPSS
0.003
27th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
480
of 17,787 indexed, latest versions
Container images
444
deployed by those charts
Fix available
1 of 1
affected package

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

Carried by container images the latest versions of 480 of 17,787 indexed charts deploy, on 444 images.

Affected packageAffected versionsFixed inImages
go.opentelemetry.io/otelgolangv1.41.0, v1.43.01.42.0444
OSV records
GO-2026-5158
Also known as
GHSA-5wrp-cwcj-q835

Charts affected

480 by stars
ChartLatestAffected imagesRadar Score
listener-operatorkubedoopVerified publisher0.4.02 of 6See more

listener-operator kubedoop 0.4.0

2 of the 6 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/zncdatadev/listener-csi-driver:0.4.0b69bed123b02
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/zncdatadev/listener-operator:0.4.068b92dae8d75
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

4,430
nifi-operatorkubedoopVerified publisher0.4.01 of 1See more

nifi-operator kubedoop 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/zncdatadev/nifi-operator:0.4.0bb4e26ff5e2f
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

359
spark-k8s-operatorkubedoopVerified publisher0.4.01 of 1See more

spark-k8s-operator kubedoop 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/zncdatadev/spark-k8s-operator:0.4.0d3f2b10c4a6d
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

382
superset-operatorkubedoopVerified publisher0.4.01 of 1See more

superset-operator kubedoop 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/zncdatadev/superset-operator:0.4.0102e66e32218
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

359
trino-operatorkubedoopVerified publisher0.4.01 of 1See more

trino-operator kubedoop 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/zncdatadev/trino-operator:0.4.04f516757aee3
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

347
zookeeper-operatorkubedoopVerified publisher0.4.01 of 1See more

zookeeper-operator kubedoop 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/zncdatadev/zookeeper-operator:0.4.0b4f33d89ac45
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

359
kuberay-apiserverkuberay-operator1.7.01 of 2See more

kuberay-apiserver kuberay-operator 1.7.0

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/kuberay/apiserver:v1.7.05bb3ad7621c8
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

245
kuberecordkuberecordVerified publisher0.4.01 of 1See more

kuberecord kuberecord 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/kuberecord/kuberecord:v0.4.02a19792ad2ec
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

176
pocket-idkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 1See more

pocket-id kubernetes-homelab-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/pocket-id/pocket-id:v2.7.045bdeaf3fcd6
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,513
forkliftkubevirt-forkliftVerified publisher0.3.01 of 2See more

forklift kubevirt-forklift 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/kubev2v/forklift-operator:release-2.1268657c36c086
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,435
everest-lakefs-csi-driverlakefsVerified publisher1.3.01 of 3See more

everest-lakefs-csi-driver lakefs 1.3.0

1 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
treeverse/everest-lakefs-csi-driver:1.3.0bda61b3fe5d8
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

841
linode-blockstorage-csi-driverlinode-blockstorage-csi-driverOfficialVerified publisher1.1.41 of 5See more

linode-blockstorage-csi-driver linode-blockstorage-csi-driver 1.1.4

1 of the 5 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
linode/linode-blockstorage-csi-driver:v1.1.409f3282bf53d
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

2,933
mt-mcp-grafanaloafoe0.10.01 of 2See more

mt-mcp-grafana loafoe 0.10.0

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
grafana/mcp-grafana:0.14.042f541f22063
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,845
nightingalelogic3579Verified publisher0.3.11 of 6See more

nightingale logic3579 0.3.1

1 of the 6 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
flashcatcloud/categraf:latest42e6ab16472e
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

9,021
novosgamarcusrepo0.1.11 of 2See more

novosga marcusrepo 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
novosga/novosga:latest34b9acbe6e51
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

3,707
mdai-event-hubmdai-event-hubVerified publisher0.1.111 of 1See more

mdai-event-hub mdai-event-hub 0.1.11

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
public.ecr.aws/p3k6k6h3/mdai-event-hub:0.1.1118cae836e9c7
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

403
mdai-gatewaymdai-gatewayVerified publisher0.1.101 of 1See more

mdai-gateway mdai-gateway 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
public.ecr.aws/p3k6k6h3/mdai-gateway:0.1.100dfb323978f6
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

402
mdai-hubmdai-hubVerified publisher0.10.14 of 14See more

mdai-hub mdai-hub 0.10.1

4 of the 14 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
public.ecr.aws/p3k6k6h3/mdai-event-hub:0.1.1118cae836e9c7
go.opentelemetry.io/otel@v1.43.0
1.42.0
public.ecr.aws/p3k6k6h3/mdai-gateway:0.1.100dfb323978f6
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/prometheus-operator/prometheus-operator:v0.91.09e53e1313921
go.opentelemetry.io/otel@v1.43.0
1.42.0
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.06b2f0b6f2f86
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

4,746
kube-prometheus-stackmesosphere87.16.02 of 7See more

kube-prometheus-stack mesosphere 87.16.0

2 of the 7 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
go.opentelemetry.io/otel@v1.43.0
1.42.0
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.185108987d044
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

6,763
logging-operatormesosphere-stable6.7.01 of 1See more

logging-operator mesosphere-stable 6.7.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/kube-logging/logging-operator:6.7.0df10e783095e
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

108
mw-kube-agent-v3middleware-labsVerified publisher1.8.51 of 2See more

mw-kube-agent-v3 middleware-labs 1.8.5

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/mw-kube-agent:1.21.0ff23f452813a
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

2,051
milvus-operatormilvus-operator1.3.91 of 1See more

milvus-operator milvus-operator 1.3.9

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
milvusdb/milvus-operator:v1.3.95d63c8894f3a
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

86
filestashmt1905024.0.01 of 1See more

filestash mt190502 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
machines/filestash:latest0b8fc005e52e
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

3,377
grafana-chartmy-personal-grafana0.1.01 of 1See more

grafana-chart my-personal-grafana 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

721
jupyterhub-metricsncsaVerified publisher1.3.01 of 5See more

jupyterhub-metrics ncsa 1.3.0

1 of the 5 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

4,135
uptime-kumancsaVerified publisher1.7.21 of 1See more

uptime-kuma ncsa 1.7.2

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

29,687
nri-volume-qosnri-volume-qosVerified publisher0.1.31 of 1See more

nri-volume-qos nri-volume-qos 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/piraeusdatastore/nri-volume-qos:v0.1.3cbe3e1ea2b6a
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

209
gpu-operatornvidia-gpu-operator26.7.01 of 2See more

gpu-operator nvidia-gpu-operator 26.7.0

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
registry.k8s.io/nfd/node-feature-discovery:v0.19.02fa1c99ad09b
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

207
argocd-agent-addonocm-helm-chartsVerified publisher0.29.01 of 2See more

argocd-agent-addon ocm-helm-charts 0.29.0

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-operator:v0.18.0a09814522a72
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

626
cluster-managerocm-helm-chartsVerified publisher1.3.11 of 1See more

cluster-manager ocm-helm-charts 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/open-cluster-management/registration-operator:v1.3.1df6c926a2b54
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

792
klusterletocm-helm-chartsVerified publisher1.3.11 of 1See more

klusterlet ocm-helm-charts 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/open-cluster-management/registration-operator:v1.3.1df6c926a2b54
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

792
multicluster-controlplaneocm-helm-chartsVerified publisher0.8.01 of 1See more

multicluster-controlplane ocm-helm-charts 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/open-cluster-management/multicluster-controlplane:latest9888240f644b
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

612
octantoctant0.1.861 of 1See more

octant octant 0.1.86

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/mydecisive/octant:0.1.86ebbd44abae6c
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

535
pro-builderopenfaas0.6.131 of 2See more

pro-builder openfaas 0.6.13

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/openfaasltd/pro-builder:0.6.06c17297f9098
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

2,728
openlitopenlit1.24.01 of 3See more

openlit openlit 1.24.0

1 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/openlit/openlit:1.24.02434560e8f0e
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

5,056
dify-enterpriseopenshift3.9.88 of 13See more

dify-enterprise openshift 3.9.8

8 of the 13 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
langgenius/dify-ee-audit:3.9.8-ubi9e99aed151fc5
go.opentelemetry.io/otel@v1.43.0
1.42.0
langgenius/dify-ee-collector:3.9.8-ubi9a9b91fd62c94
go.opentelemetry.io/otel@v1.43.0
1.42.0
langgenius/dify-ee-enterprise:3.9.8-ubi9c392a36a4ef7
go.opentelemetry.io/otel@v1.43.0
1.42.0
langgenius/dify-ee-gateway:3.9.8-ubi99e314c29a61f
go.opentelemetry.io/otel@v1.43.0
1.42.0
langgenius/dify-ee-plugin-connector:3.9.8-ubi91848d8f1f144
go.opentelemetry.io/otel@v1.43.0
1.42.0
langgenius/dify-ee-plugin-crd:3.9.8-ubi96f4e0e5f6e5a
go.opentelemetry.io/otel@v1.43.0
1.42.0
langgenius/dify-ee-plugin-daemon-serverless:3.9.8-ubi9d2b8df196d08
go.opentelemetry.io/otel@v1.43.0
1.42.0
langgenius/dify-ee-plugin-manager:3.9.8-ubi9207b343013a0
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

4,846
harikubeopenshift0.16.32 of 3See more

harikube openshift 0.16.3

2 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/harikube/harikube:release-v0.16.3b58b6d40c3bb
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/harikube/kubernetes:v1.36.22804aabd76d2
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

2,543
kubedb-certifiedopenshift2026.7.105 of 8See more

kubedb-certified openshift 2026.7.10

5 of the 8 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/kubedb/kubedb-autoscaler:v0.51.05d1182ac21f0
go.opentelemetry.io/otel@v1.43.0
1.42.0
ghcr.io/kubedb/kubedb-crd-manager:v0.21.09506a6cb98d1
go.opentelemetry.io/otel@v1.43.0
1.42.0
ghcr.io/kubedb/kubedb-ops-manager:v0.53.06d4c9fe66e4f
go.opentelemetry.io/otel@v1.43.0
1.42.0
ghcr.io/kubedb/kubedb-provisioner:v0.66.0824d6d78d451
go.opentelemetry.io/otel@v1.43.0
1.42.0
ghcr.io/kubedb/kubedb-webhook-server:v0.42.0f7dcade6523b
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

4,048
kubestash-certifiedopenshift2026.7.101 of 2See more

kubestash-certified openshift 2026.7.10

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/kubestash/kubestash:v0.29.043e01ed32486
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,091
orkestraorkestraVerified publisher0.7.171 of 2See more

orkestra orkestra 0.7.17

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/orkspace/orkestra:0.7.1738c388cfc8d1
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

119
hydra-maesterory0.64.01 of 1See more

hydra-maester ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
oryd/hydra-maester:v0.0.420a7a2bfd0e7d
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

325
loki-standaloneot-container-kit1.0.21 of 5See more

loki-standalone ot-container-kit 1.0.2

1 of the 5 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/opstree/loki:3.6-debian13bdfee214c7ea
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

3,593
otel-operatorot-container-kit1.0.11 of 1See more

otel-operator ot-container-kit 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/opstree/opentelemetry-operator:0.149.0-debian13a21405ab9a9a
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

262
tempo-standaloneot-container-kit1.0.11 of 1See more

tempo-standalone ot-container-kit 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/opstree/tempo:2.10.4-debian13cb734024b3fd
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

588
vm-standaloneot-container-kit0.0.43 of 6See more

vm-standalone ot-container-kit 0.0.4

3 of the 6 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/opstree/grafana:12.4.3b61c1ed2f015
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/opstree/kube-state-metrics:2.18.0-debian1353525d253793
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/opstree/victoriametrics-operator:v0.69.066fe5216c278
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

3,390
istio-cniparticuleio1.1.01 of 1See more

istio-cni particuleio 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
gcr.io/istio-testing/install-cni:latestec6f9ea5757b
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

847
pax-prometheuspaxtecnologia0.7.02 of 8See more

pax-prometheus paxtecnologia 0.7.0

2 of the 8 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
grafana/grafana:13.2.1-distroless3600073f45a9
go.opentelemetry.io/otel@v1.43.0
1.42.0
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.042cfe3723a5f
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,826
stk-fluent-bit-loki-s3paxtecnologia0.2.01 of 6See more

stk-fluent-bit-loki-s3 paxtecnologia 0.2.0

1 of the 6 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
grafana/loki:3.6.1144148ad243c0
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

3,742
perses-operatorpersesOfficialVerified publisher0.5.01 of 2See more

perses-operator perses 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/brancz/kube-rbac-proxy:v0.22.1e8cad21b2f9a
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

233
pet-battle-infrapetbattle1.0.321 of 2See more

pet-battle-infra petbattle 1.0.32

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

15,466

Container images carrying it

444 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

No deployed image carries CVE-2026-41178.

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.