StackRadar

CVE-2026-41602

High

Advisory

Published 28 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.012
65th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
184
of 17,781 indexed, latest versions
Container images
170
deployed by those charts
Fix available
1 of 1
affected package

Apache Thrift TFramedTransport Go language implementation has an Integer Overflow or Wraparound vulnerability

Carried by container images the latest versions of 184 of 17,781 indexed charts deploy, on 170 images.

Affected packageAffected versionsFixed inImages
github.com/apache/thriftgolangv0.0.0-20151001171628-53dd39833a08, v0.0.0-20161221203622-b2a4d4ae21c7, v0.0.0-20170131211753-2d6060d88206, v0.0.0-20181211084444-2b7365c54f82+13 more0.23.0170
OSV records
GHSA-wf45-q9ch-q8gh
Also known as
BIT-thrift-2026-41602

Charts affected

184 by stars
ChartLatestAffected imagesRadar Score
glassflow-etlglassflowVerified publisher0.5.211 of 16See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.108.0923eb1cfae32
github.com/apache/thrift@v0.20.0
0.23.0

Open the chart page →

12,056
gnp-stackgnp-stack0.0.51 of 14See more

gnp-stack gnp-stack 0.0.5

1 of the 14 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
grafana/grafana:12.2.135c41e0fd029
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

7,659
jaegergpg-dev3.3.33 of 5See more

jaeger gpg-dev 3.3.3

3 of the 5 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
jaegertracing/jaeger-agent:1.53.00214a0ef24b1
github.com/apache/thrift@v0.19.0
0.23.0
jaegertracing/jaeger-collector:1.53.07f1269222903
github.com/apache/thrift@v0.19.0
0.23.0
jaegertracing/jaeger-query:1.53.0049bb0d64ea3
github.com/apache/thrift@v0.19.0
0.23.0

Open the chart page →

19,229
kube-prometheus-stackgpg-dev84.0.01 of 6See more

kube-prometheus-stack gpg-dev 84.0.0

1 of the 6 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
grafana/grafana:13.0.10f86bada30d6
github.com/apache/thrift@v0.22.0
0.23.0

Open the chart page →

4,288
opentelemetry-demogpg-dev0.33.82 of 27See more

opentelemetry-demo gpg-dev 0.33.8

2 of the 27 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
jaegertracing/all-in-one:1.53.060e65bfffe1f
github.com/apache/thrift@v0.19.0
0.23.0
otel/opentelemetry-collector-contrib:0.114.037fa87091cfa
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

49,025
grafana-samplinggrafana1.1.71 of 2See more

grafana-sampling grafana 1.1.7

1 of the 2 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
grafana/alloy:v1.11.38c7256f412fe
github.com/apache/thrift@v0.22.0
0.23.0

Open the chart page →

3,318
pyroscope-monitoringgrafana0.1.11 of 6See more

pyroscope-monitoring grafana 0.1.1

1 of the 6 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
grafana/otel-lgtm:0.11.1009d8c3ce4f3a
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

8,188
temporalgroundcover1.12.3571 of 2See more

temporal groundcover 1.12.357

1 of the 2 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
public.ecr.aws/groundcovercom/temporalio/server:1.29.6-mini-20260702-170f191d0a80e
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

2,013
logging-stackhelm-charts-alexis-carbillet0.1.01 of 9See more

logging-stack helm-charts-alexis-carbillet 0.1.0

1 of the 9 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
grafana/grafana:11.1.0079600c9517b
github.com/apache/thrift@v0.18.1
0.23.0

Open the chart page →

12,650
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2024-12-18T13-15-44Z1dce27c494a1
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

25,017
jaegerhuseyinbabalVerified publisher0.1.01 of 3See more

jaeger huseyinbabal 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
jaegertracing/all-in-one:latestab6f1a1f0fb4
github.com/apache/thrift@v0.22.0
0.23.0

Open the chart page →

1,477
ilum-otel-collectorilumVerified publisher0.1.01 of 1See more

ilum-otel-collector ilum 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.113.05ac3e0ba2b0b
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

1,384
lakefsinseefrlab0.0.61 of 2See more

lakefs inseefrlab 0.0.6

1 of the 2 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
treeverse/lakefs:0.69.0478f37a6cffc
github.com/apache/thrift@v0.14.1
0.23.0

Open the chart page →

2,645
evi-miniointelVerified publisher3.0.31 of 2See more

evi-minio intel 3.0.3

1 of the 2 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2023-02-10T18-48-39Za0a002cb113c
github.com/apache/thrift@v0.17.0
0.23.0

Open the chart page →

7,459
thehiveittrident-oss0.1.01 of 6See more

thehive ittrident-oss 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

6,122
opencloudjacobcolvinVerified publisher0.2.31 of 13See more

opencloud jacobcolvin 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

45,239
athens-proxyjenkins-x0.2.21 of 2See more

athens-proxy jenkins-x 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
jaegertracing/all-in-one:latestab6f1a1f0fb4
github.com/apache/thrift@v0.22.0
0.23.0

Open the chart page →

1,336
jx-app-athensjenkins-x0.0.181 of 1See more

jx-app-athens jenkins-x 0.0.18

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
gomods/athens:v0.8.1d714c7ff0231
github.com/apache/thrift@v0.12.0
0.23.0

Open the chart page →

4,225
kiaekiae0.1.61 of 9See more

kiae kiae 0.1.6

1 of the 9 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.63.1dfb3a55ea8c9
github.com/apache/thrift@v0.17.0
0.23.0

Open the chart page →

19,168
cdashkitwareVerified publisher0.19.01 of 3See more

cdash kitware 0.19.0

1 of the 3 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2024.12.18-debian-12-r0cce234b4381a
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

12,062
komiserkomiser-eks3.1.101 of 1See more

komiser komiser-eks 3.1.10

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
tailwarden/komiser:3.1.103f68c8ae7993
github.com/apache/thrift@v0.16.0
0.23.0

Open the chart page →

1,265
miniokubebb5.0.101 of 2See more

minio kubebb 5.0.10

1 of the 2 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
hyperledgerk8s/minio-minio:RELEASE.2023-02-10T18-48-39Zed0b0c56f1ea
github.com/apache/thrift@v0.17.0
0.23.0

Open the chart page →

7,459
chaos-meshkubeblocksVerified publisher2.7.21 of 4See more

chaos-mesh kubeblocks 2.7.2

1 of the 4 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-coredns:v0.2.678dc63bc5b89
github.com/apache/thrift@v0.13.0
0.23.0

Open the chart page →

13,497
apm-serverkube-opsVerified publisher0.1.21 of 1See more

apm-server kube-ops 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
elastic/apm-server:7.17.6c7a1c63257d0
github.com/apache/thrift@v0.14.2
0.23.0

Open the chart page →

7,157
api-serverkubeshop0.11.161 of 2See more

api-server kubeshop 0.11.16

1 of the 2 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

3,417
minio-gatewaykubesphere-testVerified publisher0.1.01 of 1See more

minio-gateway kubesphere-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

1,069
kubiya-runnerkubiya-helm-chartsOfficialVerified publisher0.9.41 of 9See more

kubiya-runner kubiya-helm-charts 0.9.4

1 of the 9 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
grafana/alloy:v1.5.101a63f4e032c
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

20,204
minioleprechaun-charts0.1.61 of 1See more

minio leprechaun-charts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2025-01-20T14-49-07Z-cpuv114b7076ca85a
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

1,312
tempo-distributedloafoe1.20.11 of 2See more

tempo-distributed loafoe 1.20.1

1 of the 2 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
grafana/tempo:2.6.0f55a8a1937ff
github.com/apache/thrift@v0.20.0
0.23.0

Open the chart page →

2,020
apica-ascentlogiqai2.0.43 of 19See more

apica-ascent logiqai 2.0.4

3 of the 19 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
logiqai/flash:v3.10.265b996bc7bdc
github.com/apache/thrift@v0.19.0
0.23.0
logiqai/tracing:v1.35.2-lq1-c3e149f6781b8
github.com/apache/thrift@v0.16.0
0.23.0
logiqai/tracing:v1.35.2-lq1-q4a746ff04d6a
github.com/apache/thrift@v0.16.0
0.23.0

Open the chart page →

23,613
telegraf-dslsst-sqre1.0.231 of 1See more

telegraf-ds lsst-sqre 1.0.23

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
library/telegraf:1.19-alpineaddb86c0c520
github.com/apache/thrift@v0.13.0
0.23.0

Open the chart page →

3,764
magistralamagistrala-devopsVerified publisher0.16.23 of 42See more

magistrala magistrala-devops 0.16.2

3 of the 42 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
jaegertracing/jaeger-agent:1.53.00214a0ef24b1
github.com/apache/thrift@v0.19.0
0.23.0
jaegertracing/jaeger-collector:1.53.07f1269222903
github.com/apache/thrift@v0.19.0
0.23.0
jaegertracing/jaeger-query:1.53.0049bb0d64ea3
github.com/apache/thrift@v0.19.0
0.23.0

Open the chart page →

24,400
mayastormayastorVerified publisher2.12.12 of 31See more

mayastor mayastor 2.12.1

2 of the 31 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
grafana/alloy:v1.8.17790f6f7fbd8
github.com/apache/thrift@v0.21.0
0.23.0
quay.io/minio/minio:RELEASE.2024-12-18T13-15-44Z1dce27c494a1
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

21,064
prometheus-operatormesosphere12.11.131 of 8See more

prometheus-operator mesosphere 12.11.13

1 of the 8 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
grafana/grafana:12.3.39e1e77ade304
github.com/apache/thrift@v0.22.0
0.23.0

Open the chart page →

11,689
kube-prometheus-stackmesosphere-stable75.9.11 of 7See more

kube-prometheus-stack mesosphere-stable 75.9.1

1 of the 7 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
grafana/grafana:12.0.2b5b59bfc7561
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

10,180
mw-kube-agentmiddleware-labsVerified publisher0.1.21 of 1See more

mw-kube-agent middleware-labs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/mw-kube-agent:master056f0953763d
github.com/apache/thrift@v0.18.1
0.23.0

Open the chart page →

1,594
miniomilvus-helm8.0.191 of 1See more

minio milvus-helm 8.0.19

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2024-05-28T17-19-04Z391d1d45fdbe
github.com/apache/thrift@v0.20.0
0.23.0

Open the chart page →

1,529
cockroachdb-operatormmontesVerified publisher0.1.01 of 1See more

cockroachdb-operator mmontes 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
cockroachdb/cockroach-operator:v2.1.0983312754620
github.com/apache/thrift@v0.0.0-20181211084444-2b7365c54f82
0.23.0

Open the chart page →

7,775
corednsmoikot1.13.31 of 1See more

coredns moikot 1.13.3

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
coredns/coredns:1.7.073ca82b4ce82
github.com/apache/thrift@v0.13.0
0.23.0

Open the chart page →

2,547
cognativemyaVerified publisher0.2403.31 of 3See more

cognative mya 0.2403.3

1 of the 3 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
github.com/apache/thrift@v0.19.0
0.23.0

Open the chart page →

7,309
lensoci-ai-incubations0.1.141 of 16See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
grafana/grafana:12.1.1a1701c218024
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

17,070
one-green-coreone-green-coreVerified publisher0.0.71 of 8See more

one-green-core one-green-core 0.0.7

1 of the 8 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
library/telegraf:1.20.428e98eece020
github.com/apache/thrift@v0.15.0
0.23.0

Open the chart page →

9,558
openlitopenlit1.24.01 of 3See more

openlit openlit 1.24.0

1 of the 3 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
ghcr.io/openlit/openlit:1.24.02434560e8f0e
github.com/apache/thrift@v0.22.0
0.23.0

Open the chart page →

5,017
minioopenobserve5.0.71 of 2See more

minio openobserve 5.0.7

1 of the 2 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2023-02-10T18-48-39Za0a002cb113c
github.com/apache/thrift@v0.17.0
0.23.0

Open the chart page →

7,459
exporteropenshift1.0.471 of 3See more

exporter openshift 1.0.47

1 of the 3 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
public.ecr.aws/perfectscale-io/psc-exporter:v1.0.45-redhat9083e60c38bc
github.com/apache/thrift@v0.16.0
0.23.0

Open the chart page →

13,000
pgaot-container-kit1.0.31 of 6See more

pga ot-container-kit 1.0.3

1 of the 6 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
grafana/grafana:11.1.0079600c9517b
github.com/apache/thrift@v0.18.1
0.23.0

Open the chart page →

5,137
tempo-standaloneot-container-kit1.0.11 of 1See more

tempo-standalone ot-container-kit 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
quay.io/opstree/tempo:2.10.4-debian13cb734024b3fd
github.com/apache/thrift@v0.22.0
0.23.0

Open the chart page →

588
vmot-container-kit0.0.31 of 7See more

vm ot-container-kit 0.0.3

1 of the 7 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
grafana/grafana:11.1.4886b56d5534e
github.com/apache/thrift@v0.18.1
0.23.0

Open the chart page →

5,411
vm-standaloneot-container-kit0.0.41 of 6See more

vm-standalone ot-container-kit 0.0.4

1 of the 6 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
quay.io/opstree/grafana:12.4.3b61c1ed2f015
github.com/apache/thrift@v0.22.0
0.23.0

Open the chart page →

3,378
adotowan-charts0.1.01 of 1See more

adot owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
public.ecr.aws/aws-observability/aws-otel-collector:v0.43.38aa9ea5f67b8
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

1,016

Container images carrying it

170 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z69b55a1c1c5d
github.com/apache/thrift@v0.21.0
0.23.0
1
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
github.com/apache/thrift@v0.22.0
0.23.0
1
ghcr.io/middleware-labs/mw-kube-agent:master056f0953763d
github.com/apache/thrift@v0.18.1
0.23.0
1
ghcr.io/middleware-labs/mw-kube-agent:1.12.09c7bc0f9bb35
github.com/apache/thrift@v0.21.0
0.23.0
1
ghcr.io/openlit/openlit:1.24.02434560e8f0e
github.com/apache/thrift@v0.22.0
0.23.0
1
ghcr.io/parca-dev/parca:v0.24.23776500fde82
github.com/apache/thrift@v0.22.0
0.23.0
1
ghcr.io/turbot/guardrails-agent-kubernetes:0.3.09d01bf9c9224
github.com/apache/thrift@v0.16.0
0.23.0
1
ghcr.io/warpstreamlabs/bento:1.8.121715979aefa
github.com/apache/thrift@v0.21.0
0.23.0
1
public.ecr.aws/aws-observability/aws-otel-collector:v0.43.38aa9ea5f67b8
github.com/apache/thrift@v0.21.0
0.23.0
1
public.ecr.aws/groundcovercom/temporalio/server:1.29.6-mini-20260702-170f191d0a80e
github.com/apache/thrift@v0.21.0
0.23.0
1
public.ecr.aws/perfectscale-io/psc-exporter:v1.0.45-redhat9083e60c38bc
github.com/apache/thrift@v0.16.0
0.23.0
1
public.ecr.aws/v0r6c2e2/minio:latest08c90bd040bf
github.com/apache/thrift@v0.21.0
0.23.0
1
quay.io/geored/spmm-collector-contrib:1.0.063baf86a49ac
github.com/apache/thrift@v0.18.1
0.23.0
1
quay.io/minio/minio:RELEASE.2023-12-20T01-00-02Z5702ea361420
github.com/apache/thrift@v0.19.0
0.23.0
1
quay.io/minio/minio:RELEASE.2024-01-11T07-46-16Z796f75ea413b
github.com/apache/thrift@v0.19.0
0.23.0
1
quay.io/minio/minio:RELEASE.2022-09-17T00-09-45Zc3d20bc2ea08
github.com/apache/thrift@v0.16.0
0.23.0
1
quay.io/minio/minio:RELEASE.2024-06-04T19-20-08Zc6b68f158628
github.com/apache/thrift@v0.20.0
0.23.0
1
quay.io/minio/minio:RELEASE.2022-10-24T18-35-07Zd853057f2800
github.com/apache/thrift@v0.16.0
0.23.0
1
quay.io/opstree/grafana:12.4.3b61c1ed2f015
github.com/apache/thrift@v0.22.0
0.23.0
1
quay.io/opstree/tempo:2.10.4-debian13cb734024b3fd
github.com/apache/thrift@v0.22.0
0.23.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.