StackRadar

CVE-2026-41178

Unscored

Advisory

Published 24 Jul 2026In the index since 5 Sept 2026
Severity
Unscored
worst across findings
CVSS
—
base score, highest
EPSS
0.003
27th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
480
of 17,787 indexed, latest versions
Container images
444
deployed by those charts
Fix available
1 of 1
affected package

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

Carried by container images the latest versions of 480 of 17,787 indexed charts deploy, on 444 images.

Affected packageAffected versionsFixed inImages
go.opentelemetry.io/otelgolangv1.41.0, v1.43.01.42.0444
OSV records
GO-2026-5158
Also known as
GHSA-5wrp-cwcj-q835

Charts affected

480 by stars
ChartLatestAffected imagesRadar Score
pet-battle-tournamentpetbattle1.0.401 of 3See more

pet-battle-tournament petbattle 1.0.40

1 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

15,466
pgcopydb-operatorpgcopydb-operatorVerified publisher0.13.11 of 1See more

pgcopydb-operator pgcopydb-operator 0.13.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/ydixken/pgcopydb-operator:v0.13.16d020133a535
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

33
loki-stackpyalive-cdmswebappVerified publisher2.6.51 of 4See more

loki-stack pyalive-cdmswebapp 2.6.5

1 of the 4 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

6,526
qualys-scannerqualys-helm-chartVerified publisher2.1.01 of 1See more

qualys-scanner qualys-helm-chart 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
qualys/qscanner:5.1.0-59ff255352422
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

246
apisixquench-apisixVerified publisher0.0.31 of 2See more

apisix quench-apisix 0.0.3

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/etcddigest-pinned05765ee83074
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

79
cadencequench-cadenceVerified publisher0.0.101 of 2See more

cadence quench-cadence 0.0.10

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/cadencedigest-pinnede45a5fcdf1a4
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

132
chartmuseumquench-chartmuseumVerified publisher0.0.11 of 1See more

chartmuseum quench-chartmuseum 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/chartmuseumdigest-pinned3af8698e0524
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

94
coolifyquench-coolifyVerified publisher0.0.181 of 4See more

coolify quench-coolify 0.0.18

1 of the 4 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/coolify-realtimedigest-pinnedf128e512c9c0
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

450
coolify-realtimequench-coolify-realtimeVerified publisher0.0.71 of 1See more

coolify-realtime quench-coolify-realtime 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/coolify-realtimedigest-pinnedf128e512c9c0
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

306
corootquench-corootVerified publisher0.1.41 of 1See more

coroot quench-coroot 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/corootdigest-pinned6aceb380776c
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

67
dexquench-dexVerified publisher0.0.111 of 1See more

dex quench-dex 0.0.11

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/dexdigest-pinned8b41a7c5f1bf
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

70
external-dnsquench-external-dnsVerified publisher0.0.11 of 1See more

external-dns quench-external-dns 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/external-dnsdigest-pinnedaeab520e775b
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

59
kube-state-metricsquench-kube-state-metricsVerified publisher0.0.21 of 1See more

kube-state-metrics quench-kube-state-metrics 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/kube-state-metricsdigest-pinned9cf36d15744d
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

57
lgtm-stackquench-lgtm-stackVerified publisher0.0.191 of 9See more

lgtm-stack quench-lgtm-stack 0.0.19

1 of the 9 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/alertmanagerdigest-pinned7131b1e72afc
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

376
observability-stackquench-observability-stackVerified publisher0.0.141 of 5See more

observability-stack quench-observability-stack 0.0.14

1 of the 5 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/alertmanagerdigest-pinned7131b1e72afc
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

267
rad-pluginsradOfficialVerified publisher2.4.144 of 5See more

rad-plugins rad 2.4.14

4 of the 5 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
public.ecr.aws/n8h5y2v5/rad-security/rad-bootstrapper:v1.1.34adc2f5d5996b
go.opentelemetry.io/otel@v1.41.0
1.42.0
public.ecr.aws/n8h5y2v5/rad-security/rad-guard:v1.1.44f30f0dc32205
go.opentelemetry.io/otel@v1.43.0
1.42.0
public.ecr.aws/n8h5y2v5/rad-security/rad-sync:v1.1.38bbba62c5a110
go.opentelemetry.io/otel@v1.41.0
1.42.0
public.ecr.aws/n8h5y2v5/rad-security/rad-watch:v1.1.504e25d84332fc
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

54
rancher-auto-registerrancher-auto-registerVerified publisher0.1.01 of 1See more

rancher-auto-register rancher-auto-register 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

1,855
rawfile-localpvrawfile0.15.24 of 6See more

rawfile-localpv rawfile 0.15.2

4 of the 6 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.17.0f9de845b1701
go.opentelemetry.io/otel@v1.43.0
1.42.0
registry.k8s.io/sig-storage/csi-resizer:v2.2.1ea1d25e23479
go.opentelemetry.io/otel@v1.41.0
1.42.0
registry.k8s.io/sig-storage/csi-snapshotter:v8.6.042af0929bcd6
go.opentelemetry.io/otel@v1.43.0
1.42.0
registry.k8s.io/sig-storage/snapshot-controller:v8.6.081e79f205083
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

2,794
reactive-policyreactive-policy0.4.11 of 1See more

reactive-policy reactive-policy 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/vedooo/reactive-policy:0.4.1d92eda891c91
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

70
gitops-operatorredhat-cop0.10.61 of 1See more

gitops-operator redhat-cop 0.10.6

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

369
ploigosredhat-cop0.0.91 of 2See more

ploigos redhat-cop 0.0.9

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

11,437
longhornrelease-longhorn1.12.01 of 3See more

longhorn release-longhorn 1.12.0

1 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
longhornio/longhorn-manager:v1.12.0fd245bae2e82
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,538
restic-pvc-backuprestic-pvc-backupVerified publisher0.2.12 of 2See more

restic-pvc-backup restic-pvc-backup 0.2.1

2 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ngosang/restic-exporter:2.1.2a8f9cfa30162
go.opentelemetry.io/otel@v1.43.0
1.42.0
restic/restic:0.19.1136600b6ff68
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

940
harvester-csi-driverrke2-charts0.1.31004 of 6See more

harvester-csi-driver rke2-charts 0.1.3100

4 of the 6 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
rancher/harvester-csi-driver:v0.2.9f9099b5ef8cb
go.opentelemetry.io/otel@v1.41.0
1.42.0
rancher/mirrored-longhornio-csi-attacher:v4.11.0-20260428fe417c28a6b8
go.opentelemetry.io/otel@v1.43.0
1.42.0
rancher/mirrored-longhornio-csi-resizer:v2.1.0-2026042841cb674d1154
go.opentelemetry.io/otel@v1.43.0
1.42.0
rancher/mirrored-longhornio-csi-snapshotter:v8.5.0-202604281975fac3890f
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

2,688
caddy-reverse-proxyromholdings0.10.11 of 1See more

caddy-reverse-proxy romholdings 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
library/caddy:latestdf7f1c2fb114
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

846
devtron-enterpriseromholdings48.0.07 of 28See more

devtron-enterprise romholdings 48.0.0

7 of the 28 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/devtron/chart-sync:94237c18-1021-3941960566529446a
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/devtron/cost-sync:172ef62b-1159-39429edf210d763ca
go.opentelemetry.io/otel@v1.41.0
1.42.0
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/devtron/kubelink:94237c18-314-394179d25865295af
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/devtron/lens:3b3d6d0e-333-39292e886b8d2b54b
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

66,542
devtron-operatorromholdings0.23.33 of 11See more

devtron-operator romholdings 0.23.3

3 of the 11 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
quay.io/devtron/chart-sync:3b3d6d0e-836-39296721b5c9634d4
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
go.opentelemetry.io/otel@v1.43.0
1.42.0
quay.io/devtron/kubelink:09867a9c-564-39289ea6dd1e4ce71
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

31,447
beaconrotationalVerified publisher0.2.01 of 1See more

beacon rotational 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
rotationalio/beacon:0.2.0f8d8b694515a
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

951
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

7,491
cloudflare-tunnelrubxkubeVerified publisher0.3.31 of 1See more

cloudflare-tunnel rubxkube 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
cloudflare/cloudflared:2026.6.16d91c121b803
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

601
gotifyrubxkubeVerified publisher1.3.31 of 1See more

gotify rubxkube 1.3.3

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
gotify/server:3.1.0be44495e4609
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

320
memorubxkubeVerified publisher1.2.11 of 1See more

memo rubxkube 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
neosmemo/memos:0.293e1253477066
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

555
spindlerubxkubeVerified publisher0.1.12 of 2See more

spindle rubxkube 0.1.1

2 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
library/docker:29.7.2-dind3ef33f2e220b
go.opentelemetry.io/otel@v1.43.0
1.42.0
ghcr.io/qjoly/spindle:v1.16.1-alphaaab0c99d313f
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,439
uptime-kumarubxkubeVerified publisher1.2.11 of 1See more

uptime-kuma rubxkube 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.4.091e963bfda56
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

29,870
runwhen-localrunwhen-contribVerified publisher0.6.171 of 3See more

runwhen-local runwhen-contrib 0.6.17

1 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
otel/opentelemetry-collector:0.153.06ed874ea083d
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

3,673
speedtestsantisbon0.1.01 of 3See more

speedtest santisbon 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

11,314
scaleway-certmanager-webhookscaleway-charts0.4.31 of 1See more

scaleway-certmanager-webhook scaleway-charts 0.4.3

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
scaleway/cert-manager-webhook-scaleway:v0.1.36d94c970e710
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

132
s3-backupschichtelVerified publisher0.10.01 of 1See more

s3-backup schichtel 0.10.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/pschichtel/s3-backup:0.7.017666811f6a7
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

2,322
photoprismschoolguys-helmcharts0.3.81 of 1See more

photoprism schoolguys-helmcharts 0.3.8

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
photoprism/photoprism:260601650c6ad5a651
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

10,429
service-exampleservice-example-jt0.1.11 of 9See more

service-example service-example-jt 0.1.1

1 of the 9 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
bitnami/mongodb-exporter:latestf7034c13af4e
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

7,105
local-static-provisionersig-storage-local-static-provisioner2.9.01 of 1See more

local-static-provisioner sig-storage-local-static-provisioner 2.9.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/local-volume-provisioner:v2.9.0f9d65db8bda2
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

1,180
tsasigstoreVerified publisher2.1.31 of 1See more

tsa sigstore 2.1.3

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/sigstore/timestamp-server:v2.1.08637f0482ed1
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

603
vertical-pod-autoscalerstevehipwellVerified publisher1.12.13 of 3See more

vertical-pod-autoscaler stevehipwell 1.12.1

3 of the 3 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
registry.k8s.io/autoscaling/vpa-admission-controller:1.7.1be29624f7f12
go.opentelemetry.io/otel@v1.43.0
1.42.0
registry.k8s.io/autoscaling/vpa-recommender:1.7.189cea705535f
go.opentelemetry.io/otel@v1.43.0
1.42.0
registry.k8s.io/autoscaling/vpa-updater:1.7.1feb42a526970
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

228
pulsar-resources-operatorstreamnative0.21.11 of 1See more

pulsar-resources-operator streamnative 0.21.1

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
streamnative/pulsar-resources-operator:v0.21.11886043c24d0
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

119
stunner-premiumstunner1.2.12 of 2See more

stunner-premium stunner 1.2.1

2 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
l7mp/stunner-auth-server:1.2.10d2094060b72
go.opentelemetry.io/otel@v1.43.0
1.42.0
l7mp/stunner-gateway-operator-premium:1.2.14383766e66c5
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

263
stunner-prometheusstunner0.2.11 of 4See more

stunner-prometheus stunner 0.2.1

1 of the 4 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

3,026
superset-operatorsuperset-kubernetes-operatorVerified publisher0.2.01 of 1See more

superset-operator superset-kubernetes-operator 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/apache/superset-kubernetes-operator:0.2.04351831f757f
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

97
the0the0Verified publisher0.9.81 of 9See more

the0 the0 0.9.8

1 of the 9 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
ghcr.io/alexanderwanyoike/the0/runtime:1.14.7459010a02aff
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

7,336
tile38tile380.6.11 of 2See more

tile38 tile38 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
tile38/tile38:1.38.05b61c6f3b32e
go.opentelemetry.io/otel@v1.41.0
1.42.0

Open the chart page →

414
todolist-charttodolist-chart0.1.71 of 10See more

todolist-chart todolist-chart 0.1.7

1 of the 10 container images this version deploys carry CVE-2026-41178.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
go.opentelemetry.io/otel@v1.43.0
1.42.0

Open the chart page →

6,974

Container images carrying it

444 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

No deployed image carries CVE-2026-41178.

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.