StackRadar

CVE-2026-44902

High

Advisory

Published 11 May 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
39th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
14
of 17,781 indexed, latest versions
Container images
18
deployed by those charts
Fix available
3 of 3
affected packages

Prometheus exporter process crash via malformed HTTP request

Carried by container images the latest versions of 14 of 17,781 indexed charts deploy, on 18 images.

Affected packageAffected versionsFixed inImages
@opentelemetry/sdk-nodenpm0.34.0, 0.51.1, 0.52.1, 0.53.0+6 more0.217.014
@opentelemetry/exporter-prometheusnpm0.31.0, 0.53.0, 0.57.2, 0.202.0+5 more0.217.010
@opentelemetry/auto-instrumentations-nodenpm0.35.0, 0.46.1, 0.48.0, 0.50.0+3 more0.75.08
OSV records
GHSA-q7rr-3cgh-j5r3

Charts affected

14 by stars
ChartLatestAffected imagesRadar Score
supabasetokens-studioVerified publisher1.0.01 of 14See more

supabase tokens-studio 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-44902.

Container imageDigestPackageFixed in
supabase/storage-api:v1.12.0f983fb50bd95
@opentelemetry/auto-instrumentations-node@0.50.0
@opentelemetry/sdk-node@0.53.0
0.75.0
0.217.0

Open the chart page →

23,123
wgerwgerOfficialVerified publisher1.0.01 of 8See more

wger wger 1.0.0

1 of the 8 container images this version deploys carry CVE-2026-44902.

Container imageDigestPackageFixed in
journeyapps/powersync-service:latestbf46f66e5dcc
@opentelemetry/exporter-prometheus@0.203.0
0.217.0

Open the chart page →

8,491
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-44902.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
@opentelemetry/exporter-prometheus@0.207.0
@opentelemetry/sdk-node@0.207.0
0.217.0
0.217.0

Open the chart page →

15,712
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-44902.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
@opentelemetry/exporter-prometheus@0.212.0
0.217.0

Open the chart page →

7,035
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-44902.

Container imageDigestPackageFixed in
supabase/storage-api:v1.60.4c8eb9858eafe
@opentelemetry/auto-instrumentations-node@0.74.0
@opentelemetry/exporter-prometheus@0.203.0
@opentelemetry/sdk-node@0.203.0
0.75.0
0.217.0
0.217.0

Open the chart page →

18,075
adeptia-automate-mcpadeptia-automate-mcp1.0.02 of 2See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-44902.

Container imageDigestPackageFixed in
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
@opentelemetry/exporter-prometheus@0.57.2
@opentelemetry/sdk-node@0.57.2
0.217.0
0.217.0
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
@opentelemetry/exporter-prometheus@0.213.0
@opentelemetry/sdk-node@0.213.0
0.217.0
0.217.0

Open the chart page →

3,600
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad3 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

3 of the 6 container images this version deploys carry CVE-2026-44902.

Container imageDigestPackageFixed in
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
@opentelemetry/auto-instrumentations-node@0.52.1
@opentelemetry/sdk-node@0.54.2
0.75.0
0.217.0
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
@opentelemetry/sdk-node@0.53.0
0.217.0
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
@opentelemetry/sdk-node@0.53.0
0.217.0

Open the chart page →

18,293
authfcryptexlabsVerified publisher0.12.131 of 4See more

authf cryptexlabs 0.12.13

1 of the 4 container images this version deploys carry CVE-2026-44902.

Container imageDigestPackageFixed in
cryptexlabs/authf:0.12.11189c07411d7c
@opentelemetry/exporter-prometheus@0.53.0
@opentelemetry/sdk-node@0.53.0
0.217.0
0.217.0

Open the chart page →

3,769
opentelemetry-demogpg-dev0.33.82 of 27See more

opentelemetry-demo gpg-dev 0.33.8

2 of the 27 container images this version deploys carry CVE-2026-44902.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
@opentelemetry/auto-instrumentations-node@0.48.0
@opentelemetry/sdk-node@0.52.1
0.75.0
0.217.0
ghcr.io/open-telemetry/demo:1.12.0-paymentserviceb0f13eef3abf
@opentelemetry/auto-instrumentations-node@0.46.1
@opentelemetry/sdk-node@0.51.1
0.75.0
0.217.0

Open the chart page →

49,025
middleware-odigosmiddleware-labsVerified publisher0.2.411 of 6See more

middleware-odigos middleware-labs 0.2.41

1 of the 6 container images this version deploys carry CVE-2026-44902.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/odigos-odiglet:middleware-test-0.0.103c8c835ecee
@opentelemetry/auto-instrumentations-node@0.35.0
@opentelemetry/sdk-node@0.34.0
0.75.0
0.217.0

Open the chart page →

8,370
middleware-visionmiddleware-labsVerified publisher0.2.651 of 6See more

middleware-vision middleware-labs 0.2.65

1 of the 6 container images this version deploys carry CVE-2026-44902.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/vision-odiglet:middleware-test-0.0.3bce34c98668e
@opentelemetry/auto-instrumentations-node@0.35.0
@opentelemetry/sdk-node@0.34.0
0.75.0
0.217.0

Open the chart page →

8,361
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-44902.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
@opentelemetry/exporter-prometheus@0.208.0
0.217.0

Open the chart page →

4,684
retail-store-sample-checkout-chartstacksimplifyVerified publisher1.0.01 of 1See more

retail-store-sample-checkout-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-44902.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
@opentelemetry/auto-instrumentations-node@0.60.1
@opentelemetry/exporter-prometheus@0.202.0
@opentelemetry/sdk-node@0.202.0
0.75.0
0.217.0
0.217.0

Open the chart page →

1,313
kibanawiremindVerified publisher8.5.231 of 2See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-44902.

Container imageDigestPackageFixed in
library/kibana:8.18.004c0fc150f3a
@opentelemetry/exporter-prometheus@0.31.0
0.217.0

Open the chart page →

6,285

Container images carrying it

18 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
@opentelemetry/exporter-prometheus@0.57.2
@opentelemetry/sdk-node@0.57.2
0.217.0
0.217.0
1
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
@opentelemetry/exporter-prometheus@0.213.0
@opentelemetry/sdk-node@0.213.0
0.217.0
0.217.0
1
chocobozzz/peertube:v8.1.5052712130691
@opentelemetry/exporter-prometheus@0.212.0
0.217.0
1
cryptexlabs/authf:0.12.11189c07411d7c
@opentelemetry/exporter-prometheus@0.53.0
@opentelemetry/sdk-node@0.53.0
0.217.0
0.217.0
1
diygod/rsshub:2025-11-097a6312cac0d5
@opentelemetry/exporter-prometheus@0.208.0
0.217.0
1
journeyapps/powersync-service:latestbf46f66e5dcc
@opentelemetry/exporter-prometheus@0.203.0
0.217.0
1
library/kibana:8.18.004c0fc150f3a
@opentelemetry/exporter-prometheus@0.31.0
0.217.0
1
supabase/storage-api:v1.60.4c8eb9858eafe
@opentelemetry/auto-instrumentations-node@0.74.0
@opentelemetry/exporter-prometheus@0.203.0
@opentelemetry/sdk-node@0.203.0
0.75.0
0.217.0
0.217.0
1
supabase/storage-api:v1.12.0f983fb50bd95
@opentelemetry/auto-instrumentations-node@0.50.0
@opentelemetry/sdk-node@0.53.0
0.75.0
0.217.0
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
@opentelemetry/auto-instrumentations-node@0.52.1
@opentelemetry/sdk-node@0.54.2
0.75.0
0.217.0
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
@opentelemetry/sdk-node@0.53.0
0.217.0
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
@opentelemetry/sdk-node@0.53.0
0.217.0
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
@opentelemetry/exporter-prometheus@0.207.0
@opentelemetry/sdk-node@0.207.0
0.217.0
0.217.0
1
ghcr.io/middleware-labs/odigos-odiglet:middleware-test-0.0.103c8c835ecee
@opentelemetry/auto-instrumentations-node@0.35.0
@opentelemetry/sdk-node@0.34.0
0.75.0
0.217.0
1
ghcr.io/middleware-labs/vision-odiglet:middleware-test-0.0.3bce34c98668e
@opentelemetry/auto-instrumentations-node@0.35.0
@opentelemetry/sdk-node@0.34.0
0.75.0
0.217.0
1
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
@opentelemetry/auto-instrumentations-node@0.48.0
@opentelemetry/sdk-node@0.52.1
0.75.0
0.217.0
1
ghcr.io/open-telemetry/demo:1.12.0-paymentserviceb0f13eef3abf
@opentelemetry/auto-instrumentations-node@0.46.1
@opentelemetry/sdk-node@0.51.1
0.75.0
0.217.0
1
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
@opentelemetry/auto-instrumentations-node@0.60.1
@opentelemetry/exporter-prometheus@0.202.0
@opentelemetry/sdk-node@0.202.0
0.75.0
0.217.0
0.217.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.