StackRadarChart IndexLive demo

CVE-2026-45404

Medium

Advisory

Published 20 Aug 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.9; base score, highest
EPSS: 0.001; 3rd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 23; of 17,781 indexed, latest versions
Container images: 11; deployed by those charts
Fix available: 1 of 1; affected package

OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access

Carried by container images the latest versions of 23 of 17,781 indexed charts deploy, on 11 images.

Affected package	Affected versions	Fixed in	Images
go.opentelemetry.io/otel/bridge/opentracinggolang	v1.21.0, v1.26.0, v1.31.0, v1.35.0+1 more	1.45.0	11

OSV records: GHSA-42cj-99w8-cp2p
Also known as: GO-2026-6258

Charts affected

23 by stars

Chart

Latest

Affected images

Radar Score

thanosthanos-community

1 of 1 See more

thanos thanos-community 0.43.0

1 of the 1 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.42.4	b567818fe608	go.opentelemetry.io/otel/bridge/opentracing@v1.36.0	1.45.0

Open the chart page →

196

thanosstevehipwell

1 of 1 See more

thanos stevehipwell 1.24.1

1 of the 1 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.42.4	b567818fe608	go.opentelemetry.io/otel/bridge/opentracing@v1.36.0	1.45.0

Open the chart page →

196

cortexcortex

1 of 4 See more

cortex cortex 3.3.8

1 of the 4 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
quay.io/cortexproject/cortex :v1.21.1	8577eb292a01	go.opentelemetry.io/otel/bridge/opentracing@v1.36.0	1.45.0

Open the chart page →

3,897

kubecostmesosphere-stable

1 of 9 See more

kubecost mesosphere-stable 0.37.5

1 of the 9 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.36.1	e542959e1b36	go.opentelemetry.io/otel/bridge/opentracing@v1.21.0	1.45.0

Open the chart page →

17,693

thanossolidcharts

1 of 1 See more

thanos solidcharts 0.12.2

1 of the 1 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.42.4	b567818fe608	go.opentelemetry.io/otel/bridge/opentracing@v1.36.0	1.45.0

Open the chart page →

196

thanosstevehipwell-helm-charts-thanos

1 of 1 See more

thanos stevehipwell-helm-charts-thanos 1.24.1

1 of the 1 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.42.4	b567818fe608	go.opentelemetry.io/otel/bridge/opentracing@v1.36.0	1.45.0

Open the chart page →

196

tempobook-k8sinfra-v2

1 of 1 See more

tempo book-k8sinfra-v2 1.10.3

1 of the 1 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
grafana/tempo :2.5.0	f0200a9bff6d	go.opentelemetry.io/otel/bridge/opentracing@v1.26.0	1.45.0

Open the chart page →

1,859

catalyst-agentscatalyst-agents

1 of 18 See more

catalyst-agents catalyst-agents 0.1.30

1 of the 18 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
grafana/tempo :2.5.0	f0200a9bff6d	go.opentelemetry.io/otel/bridge/opentracing@v1.26.0	1.45.0

Open the chart page →

15,027

dnation-kubernetes-monitoring-stackdnationcloud

1 of 17 See more

dnation-kubernetes-monitoring-stack dnationcloud 4.0.2

1 of the 17 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
bitnamilegacy/thanos :0.37.1-debian-12-r0	5bf82b98c82c	go.opentelemetry.io/otel/bridge/opentracing@v1.31.0	1.45.0

Open the chart page →

21,641

thanoseosc-lot-1

1 of 1 See more

thanos eosc-lot-1 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.39.2	1d022ef4b8ef	go.opentelemetry.io/otel/bridge/opentracing@v1.36.0	1.45.0

Open the chart page →

834

thanos-bucketeosc-lot-1

1 of 1 See more

thanos-bucket eosc-lot-1 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.39.2	1d022ef4b8ef	go.opentelemetry.io/otel/bridge/opentracing@v1.36.0	1.45.0

Open the chart page →

834

thanosgpg-dev

1 of 1 See more

thanos gpg-dev 0.5.3

1 of the 1 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
thanosio/thanos :v0.41.0	cf3e9b292e43	go.opentelemetry.io/otel/bridge/opentracing@v1.36.0	1.45.0

Open the chart page →

592

pyroscope-monitoringgrafana

1 of 6 See more

pyroscope-monitoring grafana 0.1.1

1 of the 6 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
grafana/otel-lgtm :0.11.10	09d8c3ce4f3a	go.opentelemetry.io/otel/bridge/opentracing@v1.35.0	1.45.0

Open the chart page →

8,188

thanosk8sonlab

1 of 1 See more

thanos k8sonlab 1.1.7

1 of the 1 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
thanosio/thanos :v0.41.0	cf3e9b292e43	go.opentelemetry.io/otel/bridge/opentracing@v1.36.0	1.45.0

Open the chart page →

592

tempo-distributedloafoe

1 of 2 See more

tempo-distributed loafoe 1.20.1

1 of the 2 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
grafana/tempo :2.6.0	f55a8a1937ff	go.opentelemetry.io/otel/bridge/opentracing@v1.26.0	1.45.0

Open the chart page →

2,020

thanosrayselfs-charts

1 of 1 See more

thanos rayselfs-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.40.1	aae7b2b030ed	go.opentelemetry.io/otel/bridge/opentracing@v1.36.0	1.45.0

Open the chart page →

750

thanos-compactorsb-helm-charts

1 of 1 See more

thanos-compactor sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.37.2	4ec6df40fdb9	go.opentelemetry.io/otel/bridge/opentracing@v1.31.0	1.45.0

Open the chart page →

961

thanos-querysb-helm-charts

1 of 1 See more

thanos-query sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.37.2	4ec6df40fdb9	go.opentelemetry.io/otel/bridge/opentracing@v1.31.0	1.45.0

Open the chart page →

961

thanos-query-frontendsb-helm-charts

1 of 1 See more

thanos-query-frontend sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.37.2	4ec6df40fdb9	go.opentelemetry.io/otel/bridge/opentracing@v1.31.0	1.45.0

Open the chart page →

961

thanos-receivesb-helm-charts

1 of 1 See more

thanos-receive sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.37.2	4ec6df40fdb9	go.opentelemetry.io/otel/bridge/opentracing@v1.31.0	1.45.0

Open the chart page →

961

thanos-rulersb-helm-charts

1 of 1 See more

thanos-ruler sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.37.2	4ec6df40fdb9	go.opentelemetry.io/otel/bridge/opentracing@v1.31.0	1.45.0

Open the chart page →

961

thanos-sidecarsb-helm-charts

1 of 1 See more

thanos-sidecar sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.37.2	4ec6df40fdb9	go.opentelemetry.io/otel/bridge/opentracing@v1.31.0	1.45.0

Open the chart page →

961

thanos-storesb-helm-charts

1 of 1 See more

thanos-store sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-45404.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.37.2	4ec6df40fdb9	go.opentelemetry.io/otel/bridge/opentracing@v1.31.0	1.45.0

Open the chart page →

961

Container images carrying it

11 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
quay.io/thanos/thanos :v0.37.2	4ec6df40fdb9	go.opentelemetry.io/otel/bridge/opentracing@v1.31.0	1.45.0	7
quay.io/thanos/thanos :v0.42.4	b567818fe608	go.opentelemetry.io/otel/bridge/opentracing@v1.36.0	1.45.0	4
grafana/tempo :2.5.0	f0200a9bff6d	go.opentelemetry.io/otel/bridge/opentracing@v1.26.0	1.45.0	2
thanosio/thanos :v0.41.0	cf3e9b292e43	go.opentelemetry.io/otel/bridge/opentracing@v1.36.0	1.45.0	2
quay.io/thanos/thanos :v0.39.2	1d022ef4b8ef	go.opentelemetry.io/otel/bridge/opentracing@v1.36.0	1.45.0	2
bitnamilegacy/thanos :0.37.1-debian-12-r0	5bf82b98c82c	go.opentelemetry.io/otel/bridge/opentracing@v1.31.0	1.45.0	1
grafana/otel-lgtm :0.11.10	09d8c3ce4f3a	go.opentelemetry.io/otel/bridge/opentracing@v1.35.0	1.45.0	1
grafana/tempo :2.6.0	f55a8a1937ff	go.opentelemetry.io/otel/bridge/opentracing@v1.26.0	1.45.0	1
quay.io/cortexproject/cortex :v1.21.1	8577eb292a01	go.opentelemetry.io/otel/bridge/opentracing@v1.36.0	1.45.0	1
quay.io/thanos/thanos :v0.40.1	aae7b2b030ed	go.opentelemetry.io/otel/bridge/opentracing@v1.36.0	1.45.0	1
quay.io/thanos/thanos :v0.36.1	e542959e1b36	go.opentelemetry.io/otel/bridge/opentracing@v1.21.0	1.45.0	1