CVE-2026-46598

Medium

Advisory

Published 22 May 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.004; 35th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,533; of 17,832 indexed, latest versions
Container images: 2,854; deployed by those charts
Fix available: 1 of 1; affected package

golang.org/x/crypto: Invoking pathological inputs can lead to client panic

Carried by container images the latest versions of 2,533 of 17,832 indexed charts deploy, on 2,854 images.

Affected package	Affected versions	Fixed in	Images
golang.org/x/cryptogolang	v0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+153 more	0.52.0	2,854

OSV records: GHSA-9m57-25v3-79x9
Also known as: GO-2026-5033

Charts affected

2,533 by stars

Chart

Latest

Affected images

Radar Score

wexa-studiowexa-studio

1.2.0

4 of 15 See more

wexa-studio wexa-studio 1.2.0

4 of the 15 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
hashicorp/vault :1.15.4	0b01ed3924e6	golang.org/x/crypto@v0.15.0	0.52.0
temporalio/admin-tools :1.29.1-tctl-1.18.4-cli-1.5.0	a3a52e6ca122	golang.org/x/crypto@v0.38.0	0.52.0
temporalio/server :1.29.1	c1e3326b2ce1	golang.org/x/crypto@v0.38.0	0.52.0
temporalio/ui :2.44.0	0b36e00aad30	golang.org/x/crypto@v0.38.0	0.52.0

Open the chart page →

13,083

ceph-csi-cephfswikimedia

0.2.0

1 of 5 See more

ceph-csi-cephfs wikimedia 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.14.2	dc4bbac6efe1	golang.org/x/crypto@v0.36.0	0.52.0

Open the chart page →

4,136

ceph-csi-rbdwikimedia

0.2.0

1 of 6 See more

ceph-csi-rbd wikimedia 0.2.0

1 of the 6 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.14.2	dc4bbac6efe1	golang.org/x/crypto@v0.36.0	0.52.0

Open the chart page →

4,704

jaegerwikimedia

3.1.2

2 of 4 See more

jaeger wikimedia 3.1.2

2 of the 4 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-collector :1.53.0	7f1269222903	golang.org/x/crypto@v0.17.0	0.52.0
jaegertracing/jaeger-query :1.53.0	049bb0d64ea3	golang.org/x/crypto@v0.17.0	0.52.0

Open the chart page →

9,406

opentelemetry-collectorwikimedia

0.62.7

1 of 1 See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
otel/opentelemetry-collector-contrib :0.81.0	c6671841470b	golang.org/x/crypto@v0.10.0	0.52.0

Open the chart page →

2,035

wireguardwireguard-bananas

1.5.0

1 of 1 See more

wireguard wireguard-bananas 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
place1/wg-access-server :v0.4.6	2b2f3ea80ed6	golang.org/x/crypto@v0.0.0-20200709230013-948cd5f35899	0.52.0

Open the chart page →

2,753

dex-k8s-authenticatorwiremind

1.7.0

1 of 1 See more

dex-k8s-authenticator wiremind 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
mintel/dex-k8s-authenticator :1.4.0	caf71cee7b9a	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.52.0

Open the chart page →

2,793

postgres-operatorwiremind

1.14.0-wiremind0

1 of 1 See more

postgres-operator wiremind 1.14.0-wiremind0

1 of the 1 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
ghcr.io/zalando/postgres-operator :v1.14.0	4f40cfc2283b	golang.org/x/crypto@v0.31.0	0.52.0

Open the chart page →

1,435

prometheus-openstack-exporterwiremind

0.5.0

1 of 1 See more

prometheus-openstack-exporter wiremind 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
ghcr.io/openstack-exporter/openstack-exporter :1.7.0	e5146a7dd515	golang.org/x/crypto@v0.8.0	0.52.0

Open the chart page →

1,481

prometheus-safety-exporterwiremind

0.6.0

1 of 2 See more

prometheus-safety-exporter wiremind 0.6.0

1 of the 2 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
quay.io/prometheuscommunity/json-exporter :v0.7.0	3a777171d39a	golang.org/x/crypto@v0.31.0	0.52.0

Open the chart page →

726

registrywiremind

0.1.1

1 of 1 See more

registry wiremind 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
ghcr.io/distribution/distribution :3.0.0	4ba3adf47f5c	golang.org/x/crypto@v0.36.0	0.52.0

Open the chart page →

1,358

kafka-connect-uiwitcom-gmbh

0.5.0

1 of 2 See more

kafka-connect-ui witcom-gmbh 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v7.3.0	8c21390be87d	golang.org/x/crypto@v0.0.0-20220214200702-86341886e292	0.52.0

Open the chart page →

2,514

mrtg-backendwitcom-gmbh

0.7.0

1 of 2 See more

mrtg-backend witcom-gmbh 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v7.2.1	febeebebe762	golang.org/x/crypto@v0.0.0-20210711020723-a769d52b0f97	0.52.0

Open the chart page →

2,625

commentopluspluswyrihaximusnet

0.4.0

1 of 1 See more

commentoplusplus wyrihaximusnet 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
caroga/commentoplusplus :v1.8.7	f3233882b3bd	golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83	0.52.0

Open the chart page →

1,961

oauth2xd

1.0.0

1 of 1 See more

oauth2 xd 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
lishimeng/hufu :v1.2.1	3d5752dac834	golang.org/x/crypto@v0.11.0	0.52.0

Open the chart page →

2,009

owlxd

0.5.1

2 of 2 See more

owl xd 0.5.1

2 of the 2 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
lishimeng/owl-console :v0.11.2	c79a67657baf	golang.org/x/crypto@v0.14.0	0.52.0
lishimeng/owl-messager :v0.11.2	3d00485e64dc	golang.org/x/crypto@v0.14.0	0.52.0

Open the chart page →

4,112

passportxd

0.2.16

2 of 2 See more

passport xd 0.2.16

2 of the 2 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
lishimeng/passport :v0.2.16	3e7d05ded625	golang.org/x/crypto@v0.7.0	0.52.0
lishimeng/passport-profile :v0.2.16	0970dfe5dc8f	golang.org/x/crypto@v0.7.0	0.52.0

Open the chart page →

3,978

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
lishimeng/tabby :v1.0.4	8145c3dc83c8	golang.org/x/crypto@v0.7.0	0.52.0

Open the chart page →

7,794

treexd

0.1.10

1 of 1 See more

tree xd 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
lishimeng/tree :v0.2.8	9b2f8be6c7d3	golang.org/x/crypto@v0.7.0	0.52.0

Open the chart page →

1,999

zooxd

0.4.0

1 of 1 See more

zoo xd 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
lishimeng/zoo :v0.4.0	e0b8d2d8ca28	golang.org/x/crypto@v0.13.0	0.52.0

Open the chart page →

2,070

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	golang.org/x/crypto@v0.5.0	0.52.0

Open the chart page →

13,629

atlas-operatorxxl-job-admin

0.7.11

1 of 1 See more

atlas-operator xxl-job-admin 0.7.11

1 of the 1 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
arigaio/atlas-operator :0.7.11	1c4caa13c92b	golang.org/x/crypto@v0.39.0	0.52.0

Open the chart page →

1,197

cloudeye-exporterxxl-job-admin

0.1.2

1 of 1 See more

cloudeye-exporter xxl-job-admin 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
dellnoantechnp/cloudeye-exporter :v2.0.31	6873356c882d	golang.org/x/crypto@v0.0.0-20220525230936-793ad666bf5e	0.52.0

Open the chart page →

2,717

kminionxxl-job-admin

0.13.0

1 of 1 See more

kminion xxl-job-admin 0.13.0

1 of the 1 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
redpandadata/kminion :v2.3.2	56da99e8d0d3	golang.org/x/crypto@v0.51.0	0.52.0

Open the chart page →

668

nfs-subdir-external-provisionerxxl-job-admin

4.0.18

1 of 1 See more

nfs-subdir-external-provisioner xxl-job-admin 4.0.18

1 of the 1 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner :v4.0.2	63d5e04551ec	golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975	0.52.0

Open the chart page →

2,746

nightingalexxl-job-admin

0.2.11

2 of 6 See more

nightingale xxl-job-admin 0.2.11

2 of the 6 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
flashcatcloud/nightingale :8.0.0-beta.11	ea1b0aaabe09	golang.org/x/crypto@v0.32.0	0.52.0
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	golang.org/x/crypto@v0.25.0	0.52.0

Open the chart page →

9,821

ygdrassil-monitoringygdrassil

0.4.0

7 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

7 of the 10 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	golang.org/x/crypto@v0.32.0	0.52.0
prom/alertmanager :v0.28.0	d5155cfac40a	golang.org/x/crypto@v0.31.0	0.52.0
quay.io/prometheus-operator/prometheus-config-reloader :v0.79.2	193280a33bc1	golang.org/x/crypto@v0.31.0	0.52.0
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	golang.org/x/crypto@v0.21.0	0.52.0
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	golang.org/x/crypto@v0.31.0	0.52.0
quay.io/prometheus/pushgateway :v1.11.0	99392035ae99	golang.org/x/crypto@v0.32.0	0.52.0
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.14.0	37d841299325	golang.org/x/crypto@v0.28.0	0.52.0

Open the chart page →

9,530

prometheusalertygqygq2

1.0.0

1 of 1 See more

prometheusalert ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
feiyu563/prometheus-alert :v4.9.1	224cfa68cbd9	golang.org/x/crypto@v0.22.0	0.52.0

Open the chart page →

1,611

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	golang.org/x/crypto@v0.0.0-20211115234514-b4de73f9ece8	0.52.0

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

2 of 4 See more

rawfile-csi ymatrix 0.2.1

2 of the 4 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5	0.52.0
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5	0.52.0

Open the chart page →

8,003

version-checkerymrs

0.2.3

1 of 1 See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9	0.52.0

Open the chart page →

3,025

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d	0.52.0
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0	0.52.0

Open the chart page →

5,077

zahori-moonzahori

1.0.1

1 of 3 See more

zahori-moon zahori 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-46598.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon-ui :2.0.5	89990b146824	golang.org/x/crypto@v0.10.0	0.52.0

Open the chart page →

2,908

Container images carrying it

2,854 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
grafana/grafana :11.3.1	fa801ab6e1ae	golang.org/x/crypto@v0.27.0	0.52.0	1
grafana/logcli :main-c90366d-amd64	3d85bb66e39b	golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83	0.52.0	1
grafana/loki :2.9.10	35b02acc6765	golang.org/x/crypto@v0.24.0	0.52.0	1
grafana/loki :2.9.2	6074e01dbe03	golang.org/x/crypto@v0.14.0	0.52.0	1
grafana/loki :2.9.6	6ca6e2cd3b6f	golang.org/x/crypto@v0.18.0	0.52.0	1
grafana/loki :3.0.0	757b5fadf816	golang.org/x/crypto@v0.21.0	0.52.0	1
grafana/loki :2.0.0	77e138f81a8e	golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0	0.52.0	1
grafana/loki :3.2.0	882e30c20683	golang.org/x/crypto@v0.26.0	0.52.0	1
grafana/loki :3.3.2	8af2de1abbdd	golang.org/x/crypto@v0.31.0	0.52.0	1
grafana/loki :3.6.1	92bd5700577b	golang.org/x/crypto@v0.42.0	0.52.0	1
grafana/loki :2.8.2	b1da1d23037e	golang.org/x/crypto@v0.5.0	0.52.0	1
grafana/loki :2.4.2	b3af8ead67d7	golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519	0.52.0	1
grafana/loki :3.6.3	cd6e176883a9	golang.org/x/crypto@v0.45.0	0.52.0	1
grafana/loki-canary :3.0.0	28d7c00588aa	golang.org/x/crypto@v0.21.0	0.52.0	1
grafana/loki-canary :3.1.0	39baf6d67f85	golang.org/x/crypto@v0.21.0	0.52.0	1
grafana/loki-canary :2.9.2	4249db29b992	golang.org/x/crypto@v0.14.0	0.52.0	1
grafana/loki-canary :3.2.0	49e03f80d361	golang.org/x/crypto@v0.26.0	0.52.0	1
grafana/loki-canary :2.9.6	549a40203e97	golang.org/x/crypto@v0.18.0	0.52.0	1
grafana/loki-canary :2.6.1	ab2a2569307b	golang.org/x/crypto@v0.0.0-20211215153901-e495a2d5b3d3	0.52.0	1
grafana/loki-canary :3.6.5	fbb984bab741	golang.org/x/crypto@v0.45.0	0.52.0	1
grafana/mimir :r292-5f01872	7476e456c738	golang.org/x/crypto@v0.22.0	0.52.0	1
grafana/mimir :2.0.0	80c1a8eb24dd	golang.org/x/crypto@v0.0.0-20211202192323-5770296d904e	0.52.0	1
grafana/mimir :2.15.0	85f55510e0d3	golang.org/x/crypto@v0.31.0	0.52.0	1
grafana/otel-lgtm :0.11.10	09d8c3ce4f3a	golang.org/x/crypto@v0.41.0	0.52.0	1
grafana/phlare :0.5.1	330f990cdad9	golang.org/x/crypto@v0.4.0	0.52.0	1
grafana/promtail :2.6.1	072527b12cdf	golang.org/x/crypto@v0.0.0-20211215153901-e495a2d5b3d3	0.52.0	1
grafana/promtail :2.0.0	5fd12edcc694	golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0	0.52.0	1
grafana/promtail :2.9.10	63a2e57a5b14	golang.org/x/crypto@v0.24.0	0.52.0	1
grafana/promtail :3.5.1	65bfae480b57	golang.org/x/crypto@v0.36.0	0.52.0	1
grafana/promtail :3.6.1	8dcfdf466da0	golang.org/x/crypto@v0.42.0	0.52.0	1
grafana/promtail :2.7.0	c16c710f7333	golang.org/x/crypto@v0.0.0-20220722155217-630584e8d5aa	0.52.0	1
grafana/pyroscope :1.10.0	319bf32ae06b	golang.org/x/crypto@v0.24.0	0.52.0	1
grafana/tempo :2.6.0	f55a8a1937ff	golang.org/x/crypto@v0.25.0	0.52.0	1
gresearch/fasttrackml :latest	16d1228220fc	golang.org/x/crypto@v0.22.0	0.52.0	1
groundnuty/k8s-wait-for :no-root-v2.0	a26d3d3f6e1c	golang.org/x/crypto@v0.0.0-20220315160706-3147a52a75dd	0.52.0	1
grpl/grapple-cli :0.2.127	c00aafee6629	golang.org/x/crypto@v0.27.0	0.52.0	1
hashicorp/boundary :0.15.3	339b78b61750	golang.org/x/crypto@v0.21.0	0.52.0	1
hashicorp/boundary :0.21.0	37bf86488b74	golang.org/x/crypto@v0.45.0	0.52.0	1
hashicorp/boundary :latest	76a201954ca0	golang.org/x/crypto@v0.46.0	0.52.0	1
hashicorp/boundary :0.8.1	fb70bd9210ff	golang.org/x/crypto@v0.0.0-20220331220935-ae2d96664a29	0.52.0	1
hashicorp/consul :1.17.0	712fe02d2f84	golang.org/x/crypto@v0.14.0	0.52.0	1
hashicorp/consul :1.15.3	ddff34041c5c	golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d	0.52.0	1
hashicorp/consul-k8s-control-plane :1.3.0	0e4452f0f265	golang.org/x/crypto@v0.0.0-20220411220226-7b82a4e95df4	0.52.0	1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0	0.52.0	1
hashicorp/terraform :1.4	4dcb45513699	golang.org/x/crypto@v0.1.0	0.52.0	1
hashicorp/terraform :1.9.7	b77efab1a448	golang.org/x/crypto@v0.21.0	0.52.0	1
hashicorp/terraform-k8s :1.1.2	b19857bab620	golang.org/x/crypto@v0.0.0-20210322153248-0c34fe9e7dc2	0.52.0	1
hashicorp/vault :1.15.4	0b01ed3924e6	golang.org/x/crypto@v0.15.0	0.52.0	1
hashicorp/vault :2.0.1	755355002715	golang.org/x/crypto@v0.51.0	0.52.0	1
hashicorp/vault :1.14.0	b2177a8bfe85	golang.org/x/crypto@v0.9.0	0.52.0	1