StackRadar

CVE-2026-46595

Critical

Advisory

Published 22 May 2026In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
10.0
base score, highest
EPSS
0.005
42nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,522
of 17,828 indexed, latest versions
Container images
2,853
deployed by those charts
Fix available
1 of 1
affected package

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

Carried by container images the latest versions of 2,522 of 17,828 indexed charts deploy, on 2,853 images.

Affected packageAffected versionsFixed inImages
golang.org/x/cryptogolangv0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+154 more0.52.02,853
OSV records
GHSA-x527-x647-q7gg
Also known as
GO-2026-5023

Charts affected

2,522 by stars
ChartLatestAffected imagesRadar Score
scribesynapse0.2.162 of 7See more

scribe synapse 0.2.16

2 of the 7 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/omnirpc:latest5217e3d1fc70
golang.org/x/crypto@v0.33.0
0.52.0
ghcr.io/synapsecns/sanguine/scribe:latest81edba952403
golang.org/x/crypto@v0.33.0
0.52.0

Open the chart page →

2,716
sinnersynapse0.1.01 of 6See more

sinner synapse 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/sinner:latest3e98a98f6074
golang.org/x/crypto@v0.16.0
0.52.0

Open the chart page →

1,973
ccm-hcloudsyself1.0.111 of 1See more

ccm-hcloud syself 1.0.11

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
hetznercloud/hcloud-cloud-controller-manager:v1.13.0ed5ee5f83973
golang.org/x/crypto@v0.0.0-20220829220503-c86fa9a7ed90
0.52.0

Open the chart page →

1,714
ccm-hetznersyself2.0.71 of 1See more

ccm-hetzner syself 2.0.7

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ghcr.io/syself/hetzner-cloud-controller-manager:v2.0.77d4a5e29c387
golang.org/x/crypto@v0.47.0
0.52.0

Open the chart page →

717
lokit3n1.0.01 of 1See more

loki t3n 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
grafana/loki:1.5.0922b3f412fdd
golang.org/x/crypto@v0.0.0-20191112222119-e1110fd1c708
0.52.0

Open the chart page →

2,877
promtailt3n1.0.01 of 1See more

promtail t3n 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
grafana/promtail:1.5.046e88d390cd6
golang.org/x/crypto@v0.0.0-20191112222119-e1110fd1c708
0.52.0

Open the chart page →

2,829
taalhuizen-servicetaalhuizen-service1.0.01 of 3See more

taalhuizen-service taalhuizen-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/taalhuizen-service-php:latest04f1b7f0d573
golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904
0.52.0

Open the chart page →

7,490
stateful-data-generatortalhajuikar-helm-charts0.1.21 of 2See more

stateful-data-generator talhajuikar-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
golang.org/x/crypto@v0.25.0
0.52.0

Open the chart page →

4,944
act-runnertektonops0.1.22 of 2See more

act-runner tektonops 0.1.2

2 of the 2 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
gitea/act_runner:nightly7940221bcfc9
golang.org/x/crypto@v0.48.0
0.52.0
library/docker:23.0.6-dindafa5d5134900
golang.org/x/crypto@v0.2.0
0.52.0

Open the chart page →

4,230
pingmetektonops0.1.21 of 1See more

pingme tektonops 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
khaliq/pingme:v0.2.749f96888d2ab
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

1,256
telegraf-ds-k3stelegraf-ds-k3s1.0.01 of 1See more

telegraf-ds-k3s telegraf-ds-k3s 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
library/telegraf:1.19.0-alpine794079a7f241
golang.org/x/crypto@v0.0.0-20210513164829-c07d793c2f9a
0.52.0

Open the chart page →

3,773
clickhousetemp-charts0.7.12 of 3See more

clickhouse temp-charts 0.7.1

2 of the 3 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.16.1db7dde971407
golang.org/x/crypto@v0.0.0-20210513164829-c07d793c2f9a
0.52.0
altinity/metrics-exporter:0.16.185b4fdbae053
golang.org/x/crypto@v0.0.0-20210513164829-c07d793c2f9a
0.52.0

Open the chart page →

8,708
istio-discoverytemp-charts0.3.31 of 1See more

istio-discovery temp-charts 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
istio/pilot:1.10.0294ca55bd1cc
golang.org/x/crypto@v0.0.0-20201221181555-eec23a3978ad
0.52.0

Open the chart page →

72,520
istio-ingresstemp-charts0.3.31 of 1See more

istio-ingress temp-charts 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
istio/proxyv2:1.10.088c6c693e67a
golang.org/x/crypto@v0.0.0-20201221181555-eec23a3978ad
0.52.0

Open the chart page →

72,465
temporaltemporal0.28.97 of 13See more

temporal temporal 0.28.9

7 of the 13 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
grafana/grafana:6.7.11ff3999e0fc0
golang.org/x/crypto@v0.0.0-20191011191535-87dc89f01550
0.52.0
prom/pushgateway:v1.4.2a684e7c830a4
golang.org/x/crypto@v0.0.0-20210616213533-5ff15b29337e
0.52.0
temporalio/admin-tools:1.22.0836af062af30
golang.org/x/crypto@v0.10.0
0.52.0
temporalio/server:1.22.0ddeebf8bad8f
golang.org/x/crypto@v0.12.0
0.52.0
temporalio/ui:2.16.2af9c9349708f
golang.org/x/crypto@v0.1.0
0.52.0
quay.io/prometheus/alertmanager:v0.23.09ab73a421b65
golang.org/x/crypto@v0.0.0-20210616213533-5ff15b29337e
0.52.0
quay.io/prometheus/prometheus:v2.31.1a8779cfe553e
golang.org/x/crypto@v0.0.0-20210616213533-5ff15b29337e
0.52.0

Open the chart page →

21,064
teredixteredix0.0.21 of 1See more

teredix teredix 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ghcr.io/shaharia-lab/teredix:0.0.2ec727be4417a
golang.org/x/crypto@v0.17.0
0.52.0

Open the chart page →

1,078
vehicle-dashboardtest-vehi-dash0.1.01 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
library/mongo:5.0.217c81758cb295
golang.org/x/crypto@v0.12.0
0.52.0

Open the chart page →

20,526
local-path-provisionerth-chartsVerified publisher0.0.291 of 1See more

local-path-provisioner th-charts 0.0.29

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
rancher/local-path-provisioner:v0.0.299bebefa0b908
golang.org/x/crypto@v0.25.0
0.52.0

Open the chart page →

1,301
openmeteo-exporterth-chartsVerified publisher0.1.61 of 1See more

openmeteo-exporter th-charts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
thelande/openmeteo_exporter:v1.0.77e9072ace15f
golang.org/x/crypto@v0.39.0
0.52.0

Open the chart page →

1,382
owncloudth-chartsVerified publisher0.2.11 of 1See more

owncloud th-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
owncloud/server:10.15.051d9b74fc2a8
golang.org/x/crypto@v0.25.0
0.52.0

Open the chart page →

10,154
ping-exporterth-chartsVerified publisher0.1.11 of 1See more

ping-exporter th-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
czerwonk/ping_exporter:v1.1.394f51e1ef1e2
golang.org/x/crypto@v0.21.0
0.52.0

Open the chart page →

1,237
the0the0Verified publisher0.9.81 of 9See more

the0 the0 0.9.8

1 of the 9 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
library/nats:2.10-alpineb83efabe3e7d
golang.org/x/crypto@v0.37.0
0.52.0

Open the chart page →

6,003
trafficlight-apithecampagnards0.1.11 of 1See more

trafficlight-api thecampagnards 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
thecampagnards/trafficlight-api:main7dca9d973837
golang.org/x/crypto@v0.0.0-20210513164829-c07d793c2f9a
0.52.0

Open the chart page →

4,439
mc-routerthl-chartsVerified publisher0.1.01 of 1See more

mc-router thl-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
itzg/mc-router:1.16.1bb552b59fb53
golang.org/x/crypto@v0.0.0-20210915214749-c084706c2272
0.52.0

Open the chart page →

1,856
monitoringthl-chartsVerified publisher0.1.17 of 10See more

monitoring thl-charts 0.1.1

7 of the 10 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
grafana/grafana:8.5.042d3e6bc1865
golang.org/x/crypto@v0.0.0-20211117183948-ae814b36b871
0.52.0
grafana/loki:2.5.0f9ef133793af
golang.org/x/crypto@v0.0.0-20211215153901-e495a2d5b3d3
0.52.0
grafana/promtail:2.4.2626900031c4e
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.52.0
prom/pushgateway:v1.4.2a684e7c830a4
golang.org/x/crypto@v0.0.0-20210616213533-5ff15b29337e
0.52.0
quay.io/prometheus/alertmanager:v0.23.09ab73a421b65
golang.org/x/crypto@v0.0.0-20210616213533-5ff15b29337e
0.52.0
quay.io/prometheus/node-exporter:v1.3.023ff46c728b9
golang.org/x/crypto@v0.0.0-20210616213533-5ff15b29337e
0.52.0
quay.io/prometheus/prometheus:v2.34.0b37103e03399
golang.org/x/crypto@v0.0.0-20211215153901-e495a2d5b3d3
0.52.0

Open the chart page →

18,955
tile38tile380.6.11 of 2See more

tile38 tile38 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
tile38/tile38:1.38.05b61c6f3b32e
golang.org/x/crypto@v0.46.0
0.52.0

Open the chart page →

420
pock-helm-charttinote-chart0.1.01 of 3See more

pock-helm-chart tinote-chart 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
nginx/nginx-ingress:1.11.1eb5b4fd73325
golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0
0.52.0

Open the chart page →

6,895
grafanatnh5.3.01 of 1See more

grafana tnh 5.3.0

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
grafana/grafana:7.0.3d72946c8e5d5
golang.org/x/crypto@v0.0.0-20200406173513-056763e48d71
0.52.0

Open the chart page →

3,200
jenkinstnh2.7.11 of 2See more

jenkins tnh 2.7.1

1 of the 2 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

4,493
prometheustnh11.6.03 of 6See more

prometheus tnh 11.6.0

3 of the 6 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
prom/alertmanager:v0.20.07e4e9f7a0954
golang.org/x/crypto@v0.0.0-20190617133340-57b3e21c3d56
0.52.0
prom/prometheus:v2.19.0bfad037f95e5
golang.org/x/crypto@v0.0.0-20200422194213-44a606286825
0.52.0
quay.io/prometheus/node-exporter:v1.0.1cf66a6bbd573
golang.org/x/crypto@v0.0.0-20200510223506-06a226fb4e37
0.52.0

Open the chart page →

8,495
todolist-charttodolist-chart0.1.72 of 10See more

todolist-chart todolist-chart 0.1.7

2 of the 10 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
erenozcan17/go_backend:v4.250b4f23422b6
golang.org/x/crypto@v0.9.0
0.52.0
quay.io/prometheus/blackbox-exporter:lateste753ff9f3fc4
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

7,085
netbirdtotmicro1.8.23 of 4See more

netbird totmicro 1.8.2

3 of the 4 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
netbirdio/management:0.60.252682e5f48f9
golang.org/x/crypto@v0.41.0
0.52.0
netbirdio/relay:0.60.2a10762533793
golang.org/x/crypto@v0.41.0
0.52.0
netbirdio/signal:0.60.267176bcbf6ab
golang.org/x/crypto@v0.41.0
0.52.0

Open the chart page →

6,097
traefik-jwt-decodetraefik-jwt-decode0.1.01 of 1See more

traefik-jwt-decode traefik-jwt-decode 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
simonschneider/traefik-jwt-decode:latestd674ac370f80
golang.org/x/crypto@v0.0.0-20201217014255-9d1352758620
0.52.0

Open the chart page →

1,311
treenitytreenityVerified publisher0.1.31 of 4See more

treenity treenity 0.1.3

1 of the 4 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
library/nats:2.9.6-alpine3.16f576cdc17cc3
golang.org/x/crypto@v0.0.0-20220926161630-eccd6366d1be
0.52.0

Open the chart page →

2,782
trident-protecttrident-protect100.2606.01 of 2See more

trident-protect trident-protect 100.2606.0

1 of the 2 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
netapp/trident-protect-utils:v2.0.0cd0c18d8f9ec
golang.org/x/crypto@v0.39.0
0.52.0

Open the chart page →

1,379
trident-protect-bxp-previewtrident-protect100.2511.0-bxp-preview1 of 3See more

trident-protect-bxp-preview trident-protect 100.2511.0-bxp-preview

1 of the 3 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
netapp/controller:25.11.0-bxp-preview06f6c9a0653f
golang.org/x/crypto@v0.37.0
0.52.0

Open the chart page →

2,201
trident-protect-consoletrident-protect100.2609.0-console1 of 3See more

trident-protect-console trident-protect 100.2609.0-console

1 of the 3 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
netapp/trident-protect-utils:v3.0.0cad26cd945d1
golang.org/x/crypto@v0.39.0
0.52.0

Open the chart page →

5,913
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
golang.org/x/crypto@v0.22.0
0.52.0

Open the chart page →

2,490
posteetrivy-operator2.14.02 of 3See more

postee trivy-operator 2.14.0

2 of the 3 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
aquasec/postee:2.12.0-amd640795cba777e7
golang.org/x/crypto@v0.0.0-20220525230936-793ad666bf5e
0.52.0
aquasec/postee-ui:2.12.0-amd64c0467c3941dc
golang.org/x/crypto@v0.0.0-20220525230936-793ad666bf5e
0.52.0

Open the chart page →

4,817
traceetrivy-operator0.24.11 of 1See more

tracee trivy-operator 0.24.1

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
aquasec/tracee:0.24.1cfbbfee972e6
golang.org/x/crypto@v0.40.0
0.52.0

Open the chart page →

1,228
trouw-servicetrouw-service1.0.01 of 3See more

trouw-service trouw-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/trouw-service-php:latestf745e2870692
golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904
0.52.0

Open the chart page →

7,518
monitorortrozz0.0.11 of 1See more

monitoror trozz 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
monitoror/monitoror:44b88edcf51ff
golang.org/x/crypto@v0.0.0-20190701094942-4def268fd1a4
0.52.0

Open the chart page →

3,111
tfy-agenttruefoundryVerified publisher0.2.1041 of 5See more

tfy-agent truefoundry 0.2.104

1 of the 5 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/external-secrets:v2.4.19440a40b3947
golang.org/x/crypto@v0.49.0
0.52.0

Open the chart page →

688
tfy-cloudflaredtruefoundryVerified publisher0.6.01 of 2See more

tfy-cloudflared truefoundry 0.6.0

1 of the 2 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
public.ecr.aws/docker/library/caddy:2.6.387cbd356af2e
golang.org/x/crypto@v0.5.0
0.52.0

Open the chart page →

2,035
tfy-distributortruefoundryVerified publisher0.0.12 of 4See more

tfy-distributor truefoundry 0.0.1

2 of the 4 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
library/nats:2.10.7-alpine1bcddab51b80
golang.org/x/crypto@v0.16.0
0.52.0
natsio/prometheus-nats-exporter:0.13.02adf791d9f9f
golang.org/x/crypto@v0.13.0
0.52.0

Open the chart page →

17,408
tfy-inferentia-operatortruefoundryVerified publisher0.2.81 of 3See more

tfy-inferentia-operator truefoundry 0.2.8

1 of the 3 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
public.ecr.aws/eks-distro/kubernetes/kube-scheduler:v1.29.14-eks-1-29-lateste7e1db003e6a
golang.org/x/crypto@v0.22.0
0.52.0

Open the chart page →

2,925
tfy-lokitruefoundryVerified publisher0.1.62 of 2See more

tfy-loki truefoundry 0.1.6

2 of the 2 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
grafana/loki:2.9.1035b02acc6765
golang.org/x/crypto@v0.24.0
0.52.0
grafana/promtail:2.9.1063a2e57a5b14
golang.org/x/crypto@v0.24.0
0.52.0

Open the chart page →

2,829
truefoundry-monitoringtruefoundryVerified publisher0.1.62 of 8See more

truefoundry-monitoring truefoundry 0.1.6

2 of the 8 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
grafana/grafana:12.3.070d9599b186c
golang.org/x/crypto@v0.43.0
0.52.0
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.01545919b72e3
golang.org/x/crypto@v0.46.0
0.52.0

Open the chart page →

4,600
twitter-apptwitter-helm0.1.123 of 8See more

twitter-app twitter-helm 0.1.12

3 of the 8 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
stakkato95/twitter-service-analytics:0.1.05d48906d66b3
golang.org/x/crypto@v0.0.0-20220411220226-7b82a4e95df4
0.52.0
stakkato95/twitter-service-tweets:0.1.18412d8a8cac3
golang.org/x/crypto@v0.0.0-20220411220226-7b82a4e95df4
0.52.0
stakkato95/twitter-service-users:0.1.1456049efee9a
golang.org/x/crypto@v0.0.0-20220518034528-6f7dac969898
0.52.0

Open the chart page →

6,150
kafkatwomartensVerified publisher0.2.11 of 2See more

kafka twomartens 0.2.1

1 of the 2 container images this version deploys carry CVE-2026-46595.

Container imageDigestPackageFixed in
danielqsj/kafka-exporter:v1.7.0e90b7ba06d97
golang.org/x/crypto@v0.0.0-20220722155217-630584e8d5aa
0.52.0

Open the chart page →

1,252

Container images carrying it

2,853 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/csi-resizer:v2.0.04a95d94e57ad
golang.org/x/crypto@v0.37.0
0.52.0
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
golang.org/x/crypto@v0.36.0
0.52.0
1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.03ce0fdba4d8e
golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975
0.52.0
1

syft 1.42.1 · advisories as of 22 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.