StackRadar

CVE-2026-46595

Critical

Advisory

Published 22 May 2026In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
10.0
base score, highest
EPSS
0.005
42nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,482
of 17,805 indexed, latest versions
Container images
2,806
deployed by those charts
Fix available
1 of 1
affected package

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

Carried by container images the latest versions of 2,482 of 17,805 indexed charts deploy, on 2,806 images.

Affected packageAffected versionsFixed inImages
golang.org/x/cryptogolangv0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+154 more0.52.02,806
OSV records
GHSA-x527-x647-q7gg
Also known as
GO-2026-5023

Charts affected

2,482 by stars
ChartLatestAffected imagesRadar Score
fission-corefission-chartsVerified publisher1.14.12 of 3See more

fission-core fission-charts 1.14.1

2 of the 3 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
fission/fission-bundle:1.14.13fcfd8a0fa5d
golang.org/x/crypto@v0.0.0-20210616213533-5ff15b29337e
0.52.0
fission/pre-upgrade-checks:1.14.1fa0f24cdb9cd
golang.org/x/crypto@v0.0.0-20210616213533-5ff15b29337e
0.52.0

Open the chart page →

7,107
openldapfluktuid0.1.11 of 2See more

openldap fluktuid 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
osixia/openldap:1.5.018742e9c449c
golang.org/x/crypto@v0.0.0-20201012173705-84dcc777aaee
0.52.0

Open the chart page →

3,315
flyway-operatorflyway-operatorVerified publisher0.2.131 of 1See more

flyway-operator flyway-operator 0.2.13

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ghcr.io/davidkarlsen/flyway-operator:0.2.1366f60b461c0d
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

641
free5gcfree5gcVerified publisher0.1.311 of 12See more

free5gc free5gc 0.1.3

11 of the 12 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
free5gc/amf:v3.4.31bc96ff5a2a6
golang.org/x/crypto@v0.22.0
0.52.0
free5gc/ausf:v3.4.3687ff4daf5da
golang.org/x/crypto@v0.21.0
0.52.0
free5gc/chf:v3.4.3e2a4dd98a4ed
golang.org/x/crypto@v0.22.0
0.52.0
free5gc/nrf:v3.4.399e46b860efb
golang.org/x/crypto@v0.21.0
0.52.0
free5gc/nssf:v3.4.3dfe8c68c04b4
golang.org/x/crypto@v0.21.0
0.52.0
free5gc/pcf:v3.4.3f712e8ecd927
golang.org/x/crypto@v0.21.0
0.52.0
free5gc/smf:v3.4.360e38baa4b10
golang.org/x/crypto@v0.21.0
0.52.0
free5gc/udm:v3.4.32f68df062a50
golang.org/x/crypto@v0.21.0
0.52.0
free5gc/udr:v3.4.3c0783bcdcbdc
golang.org/x/crypto@v0.21.0
0.52.0
free5gc/upf:v3.4.3b6b362a39fdd
golang.org/x/crypto@v0.21.0
0.52.0
free5gc/webui:v3.4.39adeb18492cb
golang.org/x/crypto@v0.21.0
0.52.0

Open the chart page →

10,715
fsmfsmOfficialVerified publisher0.2.112 of 5See more

fsm fsm 0.2.11

2 of the 5 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
flomesh/fsm-ingress-pipy:0.2.11cc39c96711c4
golang.org/x/crypto@v0.9.0
0.52.0
flomesh/fsm-manager:0.2.1122f849c70b25
golang.org/x/crypto@v0.9.0
0.52.0

Open the chart page →

4,228
adguard-homegabe565Verified publisher0.3.251 of 2See more

adguard-home gabe565 0.3.25

1 of the 2 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
adguard/adguardhome:v0.107.56c64a0b37f7b9
golang.org/x/crypto@v0.31.0
0.52.0

Open the chart page →

964
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latest612d76760b54
golang.org/x/crypto@v0.26.0
0.52.0

Open the chart page →

2,161
memosgabe565Verified publisher0.17.01 of 1See more

memos gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ghcr.io/usememos/memos:0.24.04723d86e6797
golang.org/x/crypto@v0.32.0
0.52.0

Open the chart page →

1,476
dexgabibbo974.0.41 of 1See more

dex gabibbo97 4.0.4

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.28.15e88f2205de1
golang.org/x/crypto@v0.0.0-20201221181555-eec23a3978ad
0.52.0

Open the chart page →

3,399
garmgarmVerified publisher4.2.01 of 3See more

garm garm 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ghcr.io/igrikus/garm-operator:4.2.09e24d8a6a3b2
golang.org/x/crypto@v0.50.0
0.52.0

Open the chart page →

842
gateboardgateboard1.12.51 of 1See more

gateboard gateboard 1.12.5

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
udhos/gateboard:1.12.53acc0e7599bf
golang.org/x/crypto@v0.43.0
0.52.0

Open the chart page →

1,482
gboxgboxVerified publisher1.0.51 of 2See more

gbox gbox 1.0.5

1 of the 2 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
gboxproxy/gbox:v1.0.63a9f4a711d5c
golang.org/x/crypto@v0.0.0-20220210151621-f4118a5b28e2
0.52.0

Open the chart page →

2,539
adguard-homegeek-cookbookVerified publisher5.5.21 of 2See more

adguard-home geek-cookbook 5.5.2

1 of the 2 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
adguard/adguardhome:v0.107.7b9974aed13d0
golang.org/x/crypto@v0.0.0-20220411220226-7b82a4e95df4
0.52.0

Open the chart page →

1,742
alertmanager-botgeek-cookbookVerified publisher6.4.21 of 1See more

alertmanager-bot geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
metalmatze/alertmanager-bot:0.4.3426bc2ca7586
golang.org/x/crypto@v0.0.0-20181029021203-45a5f77698d3
0.52.0

Open the chart page →

3,587
filebrowsergeek-cookbookVerified publisher1.4.21 of 1See more

filebrowser geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.18.04fcd47af573c
golang.org/x/crypto@v0.0.0-20200510223506-06a226fb4e37
0.52.0

Open the chart page →

3,475
focalboardgeek-cookbookVerified publisher4.4.21 of 1See more

focalboard geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
mattermost/focalboard:0.9.031078df7a3c8
golang.org/x/crypto@v0.0.0-20210322153248-0c34fe9e7dc2
0.52.0

Open the chart page →

3,633
otel-collectorgeek-cookbookVerified publisher1.2.21 of 1See more

otel-collector geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.46.0ba173aa85f3f
golang.org/x/crypto@v0.0.0-20220214200702-86341886e292
0.52.0

Open the chart page →

2,569
protonmail-bridgegeek-cookbookVerified publisher5.4.21 of 1See more

protonmail-bridge geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
shenxn/protonmail-bridge:1.8.7-1acf31af7c111
golang.org/x/crypto@v0.0.0-20210322153248-0c34fe9e7dc2
0.52.0

Open the chart page →

8,060
stashgeek-cookbookVerified publisher3.4.21 of 1See more

stash geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
stashapp/stash:latest24dbd7607174
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

15,924
uptime-kumageek-cookbookVerified publisher1.4.21 of 1See more

uptime-kuma geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.17.1a4eab252e5a2
golang.org/x/crypto@v0.0.0-20220427172511-eb4f295cb31f
0.52.0

Open the chart page →

5,132
gentrace-self-hostedgentrace-self-hostedVerified publisher0.1.31 of 9See more

gentrace-self-hosted gentrace-self-hosted 0.1.3

1 of the 9 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
golang.org/x/crypto@v0.40.0
0.52.0

Open the chart page →

15,831
gigapipegigapipeVerified publisher0.3.01 of 1See more

gigapipe gigapipe 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ghcr.io/metrico/gigapipe:v4.1.6caeb2652ce5e
golang.org/x/crypto@v0.50.0
0.52.0

Open the chart page →

658
gitea-sonarqube-botgitea-sonarqube-botOfficialVerified publisher0.4.01 of 1See more

gitea-sonarqube-bot gitea-sonarqube-bot 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
justusbunsi/gitea-sonarqube-bot:v0.4.018dd43b470d9
golang.org/x/crypto@v0.29.0
0.52.0

Open the chart page →

1,146
prometheus-kafka-exportergkarthiks0.1.31 of 1See more

prometheus-kafka-exporter gkarthiks 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
danielqsj/kafka-exporter:latesta51b280b55a7
golang.org/x/crypto@v0.48.0
0.52.0

Open the chart page →

431
temporalglasskubeVerified publisher0.45.2-gk.110 of 14See more

temporal glasskube 0.45.2-gk.1

10 of the 14 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
grafana/grafana:11.0.00dc5a246ab16
golang.org/x/crypto@v0.21.0
0.52.0
temporalio/admin-tools:1.25.0-tctl-1.18.1-cli-1.0.0cda4901bab53
golang.org/x/crypto@v0.25.0
0.52.0
temporalio/server:1.25.08a5798191dea
golang.org/x/crypto@v0.25.0
0.52.0
temporalio/ui:2.30.25c2a3645d09c
golang.org/x/crypto@v0.14.0
0.52.0
quay.io/prometheus-operator/prometheus-config-reloader:v0.74.0d55631c7a740
golang.org/x/crypto@v0.23.0
0.52.0
quay.io/prometheus/alertmanager:v0.27.0e13b6ed5cb92
golang.org/x/crypto@v0.18.0
0.52.0
quay.io/prometheus/node-exporter:v1.8.1fa7fa12a57ef
golang.org/x/crypto@v0.21.0
0.52.0
quay.io/prometheus/prometheus:v2.53.0075b1ba2c4eb
golang.org/x/crypto@v0.24.0
0.52.0
quay.io/prometheus/pushgateway:v1.8.0c159e946abf4
golang.org/x/crypto@v0.21.0
0.52.0
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.12.0b401fae262a5
golang.org/x/crypto@v0.21.0
0.52.0

Open the chart page →

16,414
go-hello-world-chartgo-hello-worldVerified publisher1.8.31 of 1See more

go-hello-world-chart go-hello-world 1.8.3

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ghcr.io/wasilak/go-hello-world:1.8.366d353e7693f
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

767
gomenhashaigomenhashaiOfficialVerified publisher1.3.41 of 1See more

gomenhashai gomenhashai 1.3.4

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ghcr.io/gomenhashai/gomenhashai:v1.3.36f031172a5ec
golang.org/x/crypto@v0.47.0
0.52.0

Open the chart page →

642
gorse-enterprisegorse-io0.4.23 of 5See more

gorse-enterprise gorse-io 0.4.2

3 of the 5 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
zhenghaoz/gorse-master:0.4.12033046b432ec
golang.org/x/crypto@v0.0.0-20221010152910-d6f0a8c073c2
0.52.0
zhenghaoz/gorse-server:0.4.1239c565685b01
golang.org/x/crypto@v0.0.0-20221010152910-d6f0a8c073c2
0.52.0
zhenghaoz/gorse-worker:0.4.12f7739f64c9b0
golang.org/x/crypto@v0.0.0-20221010152910-d6f0a8c073c2
0.52.0

Open the chart page →

4,437
meta-monitoringgrafana1.3.01 of 2See more

meta-monitoring grafana 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
grafana/alloy:v1.4.306bdcbb51fc2
golang.org/x/crypto@v0.27.0
0.52.0

Open the chart page →

3,603
phlaregrafana0.5.41 of 1See more

phlare grafana 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
grafana/phlare:0.5.1330f990cdad9
golang.org/x/crypto@v0.4.0
0.52.0

Open the chart page →

2,091
armada-operatorgresearch0.7.01 of 2See more

armada-operator gresearch 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
kubebuilder/kube-rbac-proxy:v0.16.03c4f708c6204
golang.org/x/crypto@v0.19.0
0.52.0

Open the chart page →

1,583
carettagroundcover0.0.161 of 3See more

caretta groundcover 0.0.16

1 of the 3 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
quay.io/groundcover/grafana:9.3.18c65b333a3d3
golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d
0.52.0

Open the chart page →

6,818
oscargrycapOfficialVerified publisher4.1.31 of 2See more

oscar grycap 4.1.3

1 of the 2 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ghcr.io/grycap/oscar:latest0c58ff972451
golang.org/x/crypto@v0.48.0
0.52.0

Open the chart page →

432
terraform-cloud-operatorhashicorpVerified publisher2.5.01 of 2See more

terraform-cloud-operator hashicorp 2.5.0

1 of the 2 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
quay.io/brancz/kube-rbac-proxy:v0.18.0754ab2a723c8
golang.org/x/crypto@v0.24.0
0.52.0

Open the chart page →

1,478
hawkhawk1.1.52 of 4See more

hawk hawk 1.1.5

2 of the 4 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
grafana/grafana:8.5.042d3e6bc1865
golang.org/x/crypto@v0.0.0-20211117183948-ae814b36b871
0.52.0
ghcr.io/privacyengineering/hawk-service:latestbfedf47bb5e0
golang.org/x/crypto@v0.16.0
0.52.0

Open the chart page →

13,743
clickstackhdx-oss-v21.1.11 of 5See more

clickstack hdx-oss-v2 1.1.1

1 of the 5 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
library/mongo:5.0.32-focal3b6c281e1c08
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

4,775
headscale-uiheadscale-uiVerified publisher0.2.91 of 1See more

headscale-ui headscale-ui 0.2.9

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ghcr.io/gurucomputing/headscale-ui:2026.03.17015f5ba04bcb
golang.org/x/crypto@v0.40.0
0.52.0

Open the chart page →

1,502
uptime-kumahelmforgeVerified publisher1.5.131 of 1See more

uptime-kuma helmforge 1.5.13

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
golang.org/x/crypto@v0.51.0
0.52.0

Open the chart page →

30,618
uptimekumahelm-l3st86Verified publisher0.1.101 of 1See more

uptimekuma helm-l3st86 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.1396510915e6be
golang.org/x/crypto@v0.16.0
0.52.0

Open the chart page →

4,247
helm-operatorhelm-operatorVerified publisher0.0.21 of 1See more

helm-operator helm-operator 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
bsgrigorov/helm-operator:latest45ab095f09c8
golang.org/x/crypto@v0.0.0-20201012173705-84dcc777aaee
0.52.0

Open the chart page →

6,987
helmuphelmupVerified publisher0.1.01 of 3See more

helmup helmup 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
golang.org/x/crypto@v0.21.0
0.52.0

Open the chart page →

16,765
cratedb-adapter-v2hmdmph0.2.11 of 1See more

cratedb-adapter-v2 hmdmph 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
crate/crate_adapter:latestb8d89fa5d19b
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

2,921
hpe-greenlake-file-csi-driverhpe-storageVerified publisher2.6.42 of 7See more

hpe-greenlake-file-csi-driver hpe-storage 2.6.4

2 of the 7 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-provisioner:v6.1.0e5900dc98b0d
golang.org/x/crypto@v0.41.0
0.52.0
registry.k8s.io/sig-storage/csi-snapshotter:v8.4.0c7e0a3718832
golang.org/x/crypto@v0.37.0
0.52.0

Open the chart page →

6,261
htnn-controllerhtnnVerified publisher0.5.01 of 1See more

htnn-controller htnn 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ghcr.io/mosn/htnn-controller:v0.3.1c379e66246be
golang.org/x/crypto@v0.22.0
0.52.0

Open the chart page →

4,372
ilum-coreilumOfficialVerified publisher6.7.31 of 5See more

ilum-core ilum 6.7.3

1 of the 5 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ilum/mongodb:6.0.542b6d774c37d
golang.org/x/crypto@v0.14.0
0.52.0

Open the chart page →

3,559
ilum-jupyterilumVerified publisher6.7.31 of 2See more

ilum-jupyter ilum 6.7.3

1 of the 2 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
bitnamisecure/gitdigest-pinned72ae5bd9715f
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

645
webhook-broker-chartimytech0.2.41 of 1See more

webhook-broker-chart imytech 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
public.ecr.aws/optimizely/webhook-broker:v0.2.3cfc92cc2de65
golang.org/x/crypto@v0.31.0
0.52.0

Open the chart page →

1,253
supersetinseefrlab1.4.01 of 4See more

superset inseefrlab 1.4.0

1 of the 4 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
jwilder/dockerize:latestf94fb59fb4f6
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

7,136
interlinkinterlink0.6.11 of 2See more

interlink interlink 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ghcr.io/interlink-hq/interlink/virtual-kubelet-inttw:latest0e05a7b49c33
golang.org/x/crypto@v0.38.0
0.52.0

Open the chart page →

2,494
irsa-managerirsa-managerVerified publisher0.3.21 of 1See more

irsa-manager irsa-manager 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ghcr.io/kkb0318/irsa-manager:0.3.296d600ae97b4
golang.org/x/crypto@v0.25.0
0.52.0

Open the chart page →

821

Container images carrying it

2,806 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/prometheus-adapter/prometheus-adapter:v0.11.1e6a43c83ab16
golang.org/x/crypto@v0.1.0
0.52.0
1
registry.k8s.io/provider-os/openstack-cloud-controller-manager:v1.36.0e354e40db2d0
golang.org/x/crypto@v0.50.0
0.52.0
1
registry.k8s.io/sig-storage/csi-attacher:v4.10.0be59d0556508
golang.org/x/crypto@v0.38.0
0.52.0
1
registry.k8s.io/sig-storage/csi-resizer:v2.0.04a95d94e57ad
golang.org/x/crypto@v0.37.0
0.52.0
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
golang.org/x/crypto@v0.36.0
0.52.0
1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.03ce0fdba4d8e
golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975
0.52.0
1

syft 1.42.1 · advisories as of 19 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.