StackRadar

CVE-2026-42508

Critical

Advisory

Published 22 May 2026In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
0.073
94th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,522
of 17,828 indexed, latest versions
Container images
2,853
deployed by those charts
Fix available
1 of 1
affected package

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

Carried by container images the latest versions of 2,522 of 17,828 indexed charts deploy, on 2,853 images.

Affected packageAffected versionsFixed inImages
golang.org/x/cryptogolangv0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+154 more0.52.02,853
OSV records
GHSA-5cgq-3rg8-m6cv
Also known as
GO-2026-5021

Charts affected

2,522 by stars
ChartLatestAffected imagesRadar Score
gerrit-operatorepmdedp-devVerified publisher2.11.0-MDTU-DDM-SNAPSHOT.21 of 1See more

gerrit-operator epmdedp-dev 2.11.0-MDTU-DDM-SNAPSHOT.2

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
epamedp/gerrit-operator:2.11.0-MDTU-DDM-SNAPSHOT.2b71fb39e0c9e
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.52.0

Open the chart page →

2,814
jenkins-operatorepmdedp-devVerified publisher2.11.0-MDTU-DDM-SNAPSHOT.11 of 1See more

jenkins-operator epmdedp-dev 2.11.0-MDTU-DDM-SNAPSHOT.1

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
epamedp/jenkins-operator:2.11.0-MDTU-DDM-SNAPSHOT.1ff25e9fe4419
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.52.0

Open the chart page →

2,269
keycloak-operatorepmdedp-devVerified publisher1.11.0-MDTU-DDM-SNAPSHOT.101 of 1See more

keycloak-operator epmdedp-dev 1.11.0-MDTU-DDM-SNAPSHOT.10

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
epamedp/keycloak-operator:1.11.0-MDTU-DDM-SNAPSHOT.105d352199e12e
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.52.0

Open the chart page →

2,236
armiarmaethereum-helm-chartsVerified publisher0.1.21 of 2See more

armiarma ethereum-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ethpandaops/armiarma:master1a9c3264f0a9
golang.org/x/crypto@v0.21.0
0.52.0

Open the chart page →

1,160
authenticatoorethereum-helm-chartsVerified publisher0.1.01 of 1See more

authenticatoor ethereum-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ethpandaops/service-authenticatoor:main27b8e5ea3125
golang.org/x/crypto@v0.37.0
0.52.0

Open the chart page →

303
benchmarkoor-apiethereum-helm-chartsVerified publisher0.1.01 of 1See more

benchmarkoor-api ethereum-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ghcr.io/ethpandaops/benchmarkoor:latest5470b2ec3161
golang.org/x/crypto@v0.48.0
0.52.0

Open the chart page →

1,047
blob-me-babyethereum-helm-chartsVerified publisher0.1.21 of 1See more

blob-me-baby ethereum-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ethpandaops/blob-me-baby:latestad26158420dd
golang.org/x/crypto@v0.14.0
0.52.0

Open the chart page →

1,463
chaos-meshethereum-helm-chartsVerified publisher0.0.34 of 4See more

chaos-mesh ethereum-helm-charts 0.0.3

4 of the 4 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-coredns:v0.2.678dc63bc5b89
golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83
0.52.0
ghcr.io/chaos-mesh/chaos-daemon:v2.8.0fb609bc264d9
golang.org/x/crypto@v0.42.0
0.52.0
ghcr.io/chaos-mesh/chaos-dashboard:v2.8.0e7f9e8f1d565
golang.org/x/crypto@v0.42.0
0.52.0
ghcr.io/chaos-mesh/chaos-mesh:v2.8.0091b906a0b13
golang.org/x/crypto@v0.42.0
0.52.0

Open the chart page →

12,462
checkpointzethereum-helm-chartsVerified publisher0.1.31 of 1See more

checkpointz ethereum-helm-charts 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
samcm/checkpointz:latesta66b24a87766
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

711
contributoorethereum-helm-chartsVerified publisher0.0.21 of 1See more

contributoor ethereum-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ethpandaops/contributoor:latest1edd4074fd79
golang.org/x/crypto@v0.50.0
0.52.0

Open the chart page →

893
dugtrioethereum-helm-chartsVerified publisher0.0.71 of 1See more

dugtrio ethereum-helm-charts 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ethpandaops/dugtrio:1.0.0e261d1734e9f
golang.org/x/crypto@v0.10.0
0.52.0

Open the chart page →

1,145
erpcethereum-helm-chartsVerified publisher0.0.41 of 1See more

erpc ethereum-helm-charts 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ghcr.io/erpc/erpc:0.0.49f5654f745d4c
golang.org/x/crypto@v0.35.0
0.52.0

Open the chart page →

916
ethereum-metrics-exporterethereum-helm-chartsVerified publisher0.2.11 of 1See more

ethereum-metrics-exporter ethereum-helm-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
samcm/ethereum-metrics-exporter:latest91a2d9a015c1
golang.org/x/crypto@v0.41.0
0.52.0

Open the chart page →

684
eth-faucetethereum-helm-chartsVerified publisher0.1.11 of 1See more

eth-faucet ethereum-helm-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
chainflag/eth-faucet:latestac642796bcb6
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.52.0

Open the chart page →

1,998
execution-processorethereum-helm-chartsVerified publisher0.0.31 of 1See more

execution-processor ethereum-helm-charts 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ethpandaops/execution-processor:latest5c4832e9588f
golang.org/x/crypto@v0.43.0
0.52.0

Open the chart page →

709
forkmonethereum-helm-chartsVerified publisher0.1.61 of 1See more

forkmon ethereum-helm-charts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
holiman/nodemonitor:latest5cd609761065
golang.org/x/crypto@v0.8.0
0.52.0

Open the chart page →

1,696
forkyethereum-helm-chartsVerified publisher0.2.01 of 1See more

forky ethereum-helm-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ethpandaops/forky:debian-latestc937f4ba737c
golang.org/x/crypto@v0.49.0
0.52.0

Open the chart page →

1,773
rpc-proxyethereum-helm-chartsVerified publisher0.1.21 of 1See more

rpc-proxy ethereum-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ghcr.io/gochain/rpc-proxy/rpc-proxy:latestca01f5ab95f7
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

1,474
rpc-snooperethereum-helm-chartsVerified publisher0.0.21 of 1See more

rpc-snooper ethereum-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ethpandaops/rpc-snooper:latestc0b30fcf64bc
golang.org/x/crypto@v0.41.0
0.52.0

Open the chart page →

1,537
splitoorethereum-helm-chartsVerified publisher0.0.11 of 1See more

splitoor ethereum-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ethpandaops/splitoor:latest989da6bea4bd
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

1,259
tracoor-agentethereum-helm-chartsVerified publisher0.0.11 of 1See more

tracoor-agent ethereum-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ethpandaops/tracoor:latestd8514b9f4c59
golang.org/x/crypto@v0.38.0
0.52.0

Open the chart page →

914
tracoor-serverethereum-helm-chartsVerified publisher0.0.21 of 1See more

tracoor-server ethereum-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ethpandaops/tracoor:latestd8514b9f4c59
golang.org/x/crypto@v0.38.0
0.52.0

Open the chart page →

914
tracoor-singleethereum-helm-chartsVerified publisher0.0.51 of 2See more

tracoor-single ethereum-helm-charts 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ethpandaops/tracoor:latestd8514b9f4c59
golang.org/x/crypto@v0.38.0
0.52.0

Open the chart page →

914
beeethersphereVerified publisher0.17.41 of 1See more

bee ethersphere 0.17.4

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ethersphere/bee:2.2.0a884fd84b72f
golang.org/x/crypto@v0.23.0
0.52.0

Open the chart page →

3,508
ethexporterethersphereVerified publisher0.3.01 of 1See more

ethexporter ethersphere 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
darkobas/ethexporter:latest62e6464491ba
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.52.0

Open the chart page →

2,395
geth-swapethersphereVerified publisher0.6.31 of 2See more

geth-swap ethersphere 0.6.3

1 of the 2 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ethereum/client-go:v1.10.186d6d12a40465
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.52.0

Open the chart page →

4,774
onboarding-faucetethersphereVerified publisher0.2.01 of 1See more

onboarding-faucet ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ethersphere/onboarding-faucet:0.3.0513154aab230
golang.org/x/crypto@v0.0.0-20210322153248-0c34fe9e7dc2
0.52.0

Open the chart page →

3,325
tokenexporterethersphereVerified publisher0.3.01 of 1See more

tokenexporter ethersphere 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
darkobas/tokenexporter:latesta0349a0eedf0
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.52.0

Open the chart page →

2,395
domain_exporterevilgn0me0.1.41 of 1See more

domain_exporter evilgn0me 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
caarlos0/domain_exporter:v1.23.0d11dec138900
golang.org/x/crypto@v0.18.0
0.52.0

Open the chart page →

1,278
ingressmonitorcontrollerevilgn0me0.0.51 of 1See more

ingressmonitorcontroller evilgn0me 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ghcr.io/evilgn0me/ingressmonitorcontroller:v0.0.50bbfa4db14b9
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

591
supportpalevilgn0me0.1.61 of 1See more

supportpal evilgn0me 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
golang.org/x/crypto@v0.0.0-20220210151621-f4118a5b28e2
0.52.0

Open the chart page →

21,040
cloudflaredewatkinsVerified publisher0.1.01 of 1See more

cloudflared ewatkins 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
cloudflare/cloudflared:2024.11.1665dda65335e
golang.org/x/crypto@v0.23.0
0.52.0

Open the chart page →

1,253
exa-csiexa-csi-driver0.2.0-rev21 of 6See more

exa-csi exa-csi-driver 0.2.0-rev2

1 of the 6 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
quay.io/ddn/exascaler-csi-file-driver:v2.2.6fe2e2e5a2751
golang.org/x/crypto@v0.0.0-20190820162420-60c769a6c586
0.52.0

Open the chart page →

7,096
express-ts-app-helm-chartsexpress-ts-app-helm-chartsVerified publisher1.0.03 of 4See more

express-ts-app-helm-charts express-ts-app-helm-charts 1.0.0

3 of the 4 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
grafana/loki:2.9.66ca6e2cd3b6f
golang.org/x/crypto@v0.18.0
0.52.0
grafana/loki-canary:2.9.6549a40203e97
golang.org/x/crypto@v0.18.0
0.52.0
grafana/promtail:3.5.165bfae480b57
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

5,867
siyuanextrim-helm-chartsVerified publisher0.1.11 of 2See more

siyuan extrim-helm-charts 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
b3log/siyuan:v3.1.2595c0d129bc19
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

1,393
faasnetfaasnet0.0.41 of 5See more

faasnet faasnet 0.0.4

1 of the 5 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
simpleidserver/faasprometheus:0.0.425e378d57d78
golang.org/x/crypto@v0.0.0-20210616213533-5ff15b29337e
0.52.0

Open the chart page →

7,447
degafactlyVerified publisher0.11.132 of 3See more

dega factly 0.11.13

2 of the 3 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
factly/dega-api:0.15.166fafc7b0a17
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0
factly/dega-server:0.15.194d21479382e
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

5,751
kavachfactlyVerified publisher0.9.51 of 2See more

kavach factly 0.9.5

1 of the 2 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
factly/kavach-server:0.22.3be85ff1b9bd3
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

3,577
mandefactlyVerified publisher0.5.171 of 3See more

mande factly 0.5.17

1 of the 3 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
factly/mande-server:0.34.1384d384310ef
golang.org/x/crypto@v0.1.0
0.52.0

Open the chart page →

4,789
datadog-apmfairwinds-incubator2.0.11 of 1See more

datadog-apm fairwinds-incubator 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
public.ecr.aws/datadog/agent:7.73.0f4925b15ce94
golang.org/x/crypto@v0.44.0
0.52.0

Open the chart page →

2,921
kubebenchfairwinds-incubator1.0.51 of 2See more

kubebench fairwinds-incubator 1.0.5

1 of the 2 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
aquasec/kube-bench:v0.15.07a8fa32dce21
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

1,189
skopeo-syncfairwinds-incubator0.3.11 of 1See more

skopeo-sync fairwinds-incubator 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
quay.io/skopeo/stable:v1.134853591bd1d2
golang.org/x/crypto@v0.10.0
0.52.0

Open the chart page →

1,744
stackdriver-metrics-adapterfairwinds-incubator0.3.01 of 1See more

stackdriver-metrics-adapter fairwinds-incubator 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
gcr.io/gke-release/custom-metrics-stackdriver-adapter:v0.13.1-gke.06937c0a9b203
golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83
0.52.0

Open the chart page →

1,766
fairwinds-insightsfairwinds-stableVerified publisher10.2.01 of 13See more

fairwinds-insights fairwinds-stable 10.2.0

1 of the 13 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
temporalio/ui:2.52.0fc47cd8202c9
golang.org/x/crypto@v0.51.0
0.52.0

Open the chart page →

3,832
event-generatorfalcosecurity0.4.01 of 1See more

event-generator falcosecurity 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
falcosecurity/event-generator:latest932956d86c99
golang.org/x/crypto@v0.51.0
0.52.0

Open the chart page →

3,863
farm-observabilityfarm-observabilityOfficialVerified publisher0.27.210 of 18See more

farm-observability farm-observability 0.27.2

10 of the 18 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
grafana/alloy:v1.12.2f94b1c82957a
golang.org/x/crypto@v0.43.0
0.52.0
grafana/grafana:13.0.1-security-012d1f9ae67c17
golang.org/x/crypto@v0.49.0
0.52.0
grafana/loki:3.6.73c8fd3570dd9
golang.org/x/crypto@v0.45.0
0.52.0
grafana/loki-canary:3.6.70dac7d5cb383
golang.org/x/crypto@v0.45.0
0.52.0
grafana/tempo:2.9.065a578975943
golang.org/x/crypto@v0.41.0
0.52.0
prom/memcached-exporter:v0.15.4b6763ecb3c47
golang.org/x/crypto@v0.42.0
0.52.0
quay.io/prometheus-operator/prometheus-config-reloader:v0.91.07d9e4eea5f11
golang.org/x/crypto@v0.50.0
0.52.0
quay.io/prometheus-operator/prometheus-config-reloader:v0.81.0959d47672fbf
golang.org/x/crypto@v0.36.0
0.52.0
quay.io/prometheus/node-exporter:v1.11.1-distroless6112664fd761
golang.org/x/crypto@v0.49.0
0.52.0
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.06b2f0b6f2f86
golang.org/x/crypto@v0.49.0
0.52.0

Open the chart page →

13,656
jenkinsfatihtepe-jenkins1.0.01 of 1See more

jenkins fatihtepe-jenkins 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

2,545
activityrelayfedihost0.1.41 of 2See more

activityrelay fedihost 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.4.115b6701d8fb31
golang.org/x/crypto@v0.0.0-20211117183948-ae814b36b871
0.52.0

Open the chart page →

13,572
rospoferama0.4.31 of 1See more

rospo ferama 0.4.3

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ghcr.io/ferama/rospo:v0.12.0ab40c1745534
golang.org/x/crypto@v0.18.0
0.52.0

Open the chart page →

6,242
vipienferama0.2.81 of 1See more

vipien ferama 0.2.8

1 of the 1 container images this version deploys carry CVE-2026-42508.

Container imageDigestPackageFixed in
ghcr.io/ferama/vipien:v0.5.3923a3f704b21
golang.org/x/crypto@v0.0.0-20220208050332-20e1d8d225ab
0.52.0

Open the chart page →

7,565

Container images carrying it

2,853 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/csi-resizer:v2.0.04a95d94e57ad
golang.org/x/crypto@v0.37.0
0.52.0
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
golang.org/x/crypto@v0.36.0
0.52.0
1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.03ce0fdba4d8e
golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975
0.52.0
1

syft 1.42.1 · advisories as of 22 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.