StackRadar

CVE-2026-41602

High

Advisory

Published 28 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.012
65th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
184
of 17,781 indexed, latest versions
Container images
170
deployed by those charts
Fix available
1 of 1
affected package

Apache Thrift TFramedTransport Go language implementation has an Integer Overflow or Wraparound vulnerability

Carried by container images the latest versions of 184 of 17,781 indexed charts deploy, on 170 images.

Affected packageAffected versionsFixed inImages
github.com/apache/thriftgolangv0.0.0-20151001171628-53dd39833a08, v0.0.0-20161221203622-b2a4d4ae21c7, v0.0.0-20170131211753-2d6060d88206, v0.0.0-20181211084444-2b7365c54f82+13 more0.23.0170
OSV records
GHSA-wf45-q9ch-q8gh
Also known as
BIT-thrift-2026-41602

Charts affected

184 by stars
ChartLatestAffected imagesRadar Score
parcaparca-rr0.1.01 of 2See more

parca parca-rr 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
ghcr.io/parca-dev/parca:v0.24.23776500fde82
github.com/apache/thrift@v0.22.0
0.23.0

Open the chart page →

2,366
pet-battle-nsffpetbattle0.0.21 of 4See more

pet-battle-nsff petbattle 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

3,678
cdmswebapppyalive-cdmswebappVerified publisher0.1.01 of 3See more

cdmswebapp pyalive-cdmswebapp 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
sarwansharma/minio:v359d1da9385d1
github.com/apache/thrift@v0.15.0
0.23.0

Open the chart page →

6,668
radar-grafanaradar-baseVerified publisher0.1.41 of 2See more

radar-grafana radar-base 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
grafana/grafana:11.6.062d2b9d20a19
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

1,667
fleet-vendoredrock8sVerified publisher6.5.11 of 1See more

fleet-vendored rock8s 6.5.1

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
fleetdm/fleet:v4.66.012e644b7f40e
github.com/apache/thrift@v0.18.1
0.23.0

Open the chart page →

1,581
monitoringrocketchat-server0.0.171 of 9See more

monitoring rocketchat-server 0.0.17

1 of the 9 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.143.03bc07732530c
github.com/apache/thrift@v0.22.0
0.23.0

Open the chart page →

6,859
jaegerromanow-helm-chartsVerified publisher1.7.31 of 1See more

jaeger romanow-helm-charts 1.7.3

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
jaegertracing/jaeger:2.9.0e128b9adbb29
github.com/apache/thrift@v0.22.0
0.23.0

Open the chart page →

1,597
clairromholdings0.1.141 of 2See more

clair romholdings 0.1.14

1 of the 2 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
quay.io/devtron/clair:4.3.675fb847ac045
github.com/apache/thrift@v0.13.0
0.23.0

Open the chart page →

6,237
dgraphromholdings0.0.201 of 1See more

dgraph romholdings 0.0.20

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
dgraph/dgraph:v21.12.03b55ea83fffe
github.com/apache/thrift@v0.12.0
0.23.0

Open the chart page →

11,909
grafanasb-helm-charts0.4.01 of 1See more

grafana sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
grafana/grafana:12.2.22ebef928d7e5
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

1,795
opentelemetry-collectorsb-helm-charts0.3.01 of 1See more

opentelemetry-collector sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
github.com/apache/thrift@v0.19.0
0.23.0

Open the chart page →

1,721
temposb-helm-charts0.4.01 of 1See more

tempo sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
grafana/tempo:2.9.065a578975943
github.com/apache/thrift@v0.22.0
0.23.0

Open the chart page →

923
ed-traefikscaleway-charts0.2.01 of 1See more

ed-traefik scaleway-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
library/traefik:v1.7.345d47b7bb2546
github.com/apache/thrift@v0.12.0
0.23.0

Open the chart page →

2,133
miniosergiotocaliniVerified publisher1.0.01 of 1See more

minio sergiotocalini 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2023-07-21T21-12-44Z8e5e9490cd50
github.com/apache/thrift@v0.18.1
0.23.0

Open the chart page →

4,203
ccx-monitoringseveralnines0.6.211 of 7See more

ccx-monitoring severalnines 0.6.21

1 of the 7 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
grafana/grafana:12.3.12175aaa91c96
github.com/apache/thrift@v0.22.0
0.23.0

Open the chart page →

7,708
mimirskyloud-helm-chartsVerified publisher5.5.11 of 5See more

mimir skyloud-helm-charts 5.5.1

1 of the 5 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2023-09-30T07-02-29Z6262bc9a2730
github.com/apache/thrift@v0.19.0
0.23.0

Open the chart page →

10,651
kube-prometheus-stacksoftonic81.5.11 of 6See more

kube-prometheus-stack softonic 81.5.1

1 of the 6 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
grafana/grafana:12.3.2ba93c9d192e5
github.com/apache/thrift@v0.22.0
0.23.0

Open the chart page →

4,974
servicexssl-hep1.8.51 of 16See more

servicex ssl-hep 1.8.5

1 of the 16 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2022.12.12-debian-11-r90f7c8ac484ac
github.com/apache/thrift@v0.16.0
0.23.0

Open the chart page →

66,266
cost-analyzerstatcan1.82.21 of 9See more

cost-analyzer statcan 1.82.2

1 of the 9 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
grafana/grafana:7.5.609bb407e26ab
github.com/apache/thrift@v0.13.0
0.23.0

Open the chart page →

16,506
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
github.com/apache/thrift@v0.22.0
0.23.0

Open the chart page →

3,460
agentssynapse0.1.301 of 9See more

agents synapse 0.1.30

1 of the 9 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
jaegertracing/all-in-one:1.42.07d32a4eddec7
github.com/apache/thrift@v0.17.0
0.23.0

Open the chart page →

7,244
telegraf-ds-k3stelegraf-ds-k3s1.0.01 of 1See more

telegraf-ds-k3s telegraf-ds-k3s 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
library/telegraf:1.19.0-alpine794079a7f241
github.com/apache/thrift@v0.13.0
0.23.0

Open the chart page →

3,764
temporaltemporal0.28.92 of 13See more

temporal temporal 0.28.9

2 of the 13 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.22.0836af062af30
github.com/apache/thrift@v0.18.0
0.23.0
temporalio/server:1.22.0ddeebf8bad8f
github.com/apache/thrift@v0.18.1
0.23.0

Open the chart page →

21,005
the0the0Verified publisher0.9.81 of 9See more

the0 the0 0.9.8

1 of the 9 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

7,248
truefoundry-monitoringtruefoundryVerified publisher0.1.61 of 8See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
grafana/grafana:12.3.070d9599b186c
github.com/apache/thrift@v0.22.0
0.23.0

Open the chart page →

4,526
miniouninettsigma21.2.01 of 1See more

minio uninettsigma2 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
sigma2as/minio:20240306-3a2e4f5c284ead9ec3e
github.com/apache/thrift@v0.16.0
0.23.0

Open the chart page →

4,960
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

45,239
athens-proxywenerme0.5.22 of 2See more

athens-proxy wenerme 0.5.2

2 of the 2 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
gomods/athens:v0.11.0efb811df7844
github.com/apache/thrift@v0.12.0
0.23.0
jaegertracing/all-in-one:latestab6f1a1f0fb4
github.com/apache/thrift@v0.22.0
0.23.0

Open the chart page →

4,984
cadencewenerme0.23.02 of 5See more

cadence wenerme 0.23.0

2 of the 5 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
ubercadence/server:0.23.22ac5491d13bb
github.com/apache/thrift@v0.0.0-20161221203622-b2a4d4ae21c7
0.23.0
ghcr.io/banzaicloud/tcheck:latest0147d87c2019
github.com/apache/thrift@v0.0.0-20170131211753-2d6060d88206
0.23.0

Open the chart page →

10,127
minio-standalonewenerme1.0.21 of 1See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2022-01-04T07-41-07Z1484c87239ea
github.com/apache/thrift@v0.15.0
0.23.0

Open the chart page →

6,138
temporalwenerme0.15.12 of 13See more

temporal wenerme 0.15.1

2 of the 13 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.15.135034611d981
github.com/apache/thrift@v0.0.0-20161221203622-b2a4d4ae21c7
0.23.0
temporalio/server:1.15.1e26758f5a1bf
github.com/apache/thrift@v0.0.0-20161221203622-b2a4d4ae21c7
0.23.0

Open the chart page →

22,665
wexa-studiowexa-studio1.2.04 of 15See more

wexa-studio wexa-studio 1.2.0

4 of the 15 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.40b01ed3924e6
github.com/apache/thrift@v0.16.0
0.23.0
minio/minio:RELEASE.2024-01-16T16-07-38Z4c4a4876193f
github.com/apache/thrift@v0.19.0
0.23.0
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
github.com/apache/thrift@v0.21.0
0.23.0
temporalio/server:1.29.1c1e3326b2ce1
github.com/apache/thrift@v0.21.0
0.23.0

Open the chart page →

14,983
jaegerwikimedia3.1.23 of 4See more

jaeger wikimedia 3.1.2

3 of the 4 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
jaegertracing/jaeger-agent:1.53.00214a0ef24b1
github.com/apache/thrift@v0.19.0
0.23.0
jaegertracing/jaeger-collector:1.53.07f1269222903
github.com/apache/thrift@v0.19.0
0.23.0
jaegertracing/jaeger-query:1.53.0049bb0d64ea3
github.com/apache/thrift@v0.19.0
0.23.0

Open the chart page →

9,248
opentelemetry-collectorwikimedia0.62.71 of 1See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2026-41602.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
github.com/apache/thrift@v0.18.1
0.23.0

Open the chart page →

2,022

Container images carrying it

170 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z69b55a1c1c5d
github.com/apache/thrift@v0.21.0
0.23.0
1
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
github.com/apache/thrift@v0.22.0
0.23.0
1
ghcr.io/middleware-labs/mw-kube-agent:master056f0953763d
github.com/apache/thrift@v0.18.1
0.23.0
1
ghcr.io/middleware-labs/mw-kube-agent:1.12.09c7bc0f9bb35
github.com/apache/thrift@v0.21.0
0.23.0
1
ghcr.io/openlit/openlit:1.24.02434560e8f0e
github.com/apache/thrift@v0.22.0
0.23.0
1
ghcr.io/parca-dev/parca:v0.24.23776500fde82
github.com/apache/thrift@v0.22.0
0.23.0
1
ghcr.io/turbot/guardrails-agent-kubernetes:0.3.09d01bf9c9224
github.com/apache/thrift@v0.16.0
0.23.0
1
ghcr.io/warpstreamlabs/bento:1.8.121715979aefa
github.com/apache/thrift@v0.21.0
0.23.0
1
public.ecr.aws/aws-observability/aws-otel-collector:v0.43.38aa9ea5f67b8
github.com/apache/thrift@v0.21.0
0.23.0
1
public.ecr.aws/groundcovercom/temporalio/server:1.29.6-mini-20260702-170f191d0a80e
github.com/apache/thrift@v0.21.0
0.23.0
1
public.ecr.aws/perfectscale-io/psc-exporter:v1.0.45-redhat9083e60c38bc
github.com/apache/thrift@v0.16.0
0.23.0
1
public.ecr.aws/v0r6c2e2/minio:latest08c90bd040bf
github.com/apache/thrift@v0.21.0
0.23.0
1
quay.io/geored/spmm-collector-contrib:1.0.063baf86a49ac
github.com/apache/thrift@v0.18.1
0.23.0
1
quay.io/minio/minio:RELEASE.2023-12-20T01-00-02Z5702ea361420
github.com/apache/thrift@v0.19.0
0.23.0
1
quay.io/minio/minio:RELEASE.2024-01-11T07-46-16Z796f75ea413b
github.com/apache/thrift@v0.19.0
0.23.0
1
quay.io/minio/minio:RELEASE.2022-09-17T00-09-45Zc3d20bc2ea08
github.com/apache/thrift@v0.16.0
0.23.0
1
quay.io/minio/minio:RELEASE.2024-06-04T19-20-08Zc6b68f158628
github.com/apache/thrift@v0.20.0
0.23.0
1
quay.io/minio/minio:RELEASE.2022-10-24T18-35-07Zd853057f2800
github.com/apache/thrift@v0.16.0
0.23.0
1
quay.io/opstree/grafana:12.4.3b61c1ed2f015
github.com/apache/thrift@v0.22.0
0.23.0
1
quay.io/opstree/tempo:2.10.4-debian13cb734024b3fd
github.com/apache/thrift@v0.22.0
0.23.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.