StackRadar

GHSA-2w8w-qhg4-f78j

Medium

Advisory

Published 11 Jul 2023In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
24
of 17,781 indexed, latest versions
Container images
24
deployed by those charts
Fix available
1 of 1
affected package

A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries

Carried by container images the latest versions of 24 of 17,781 indexed charts deploy, on 24 images.

Affected packageAffected versionsFixed inImages
github.com/jaegertracing/jaegergolangv0.0.0-20240108180540-b620f0eaefa5, v0.0.0-20240307052142-d440fe1b4bdb, v1.15.1, v1.17.0+10 more1.47.024
OSV records
GHSA-2w8w-qhg4-f78j

Charts affected

24 by stars
ChartLatestAffected imagesRadar Score
linkerd-jaegerlinkerd2Verified publisher30.12.111 of 4See more

linkerd-jaeger linkerd2 30.12.11

1 of the 4 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
otel/opentelemetry-collector:0.59.0ee9da0b08d83
github.com/jaegertracing/jaeger@v1.37.0
1.47.0

Open the chart page →

4,405
jaeger-all-in-onejaeger-all-in-oneVerified publisher0.1.121 of 1See more

jaeger-all-in-one jaeger-all-in-one 0.1.12

1 of the 1 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
jaegertracing/all-in-one:1.55f6b5d09073f1
github.com/jaegertracing/jaeger@v0.0.0-20240307052142-d440fe1b4bdb
1.47.0

Open the chart page →

1,216
otel-collectorgeek-cookbookVerified publisher1.2.21 of 1See more

otel-collector geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.46.0ba173aa85f3f
github.com/jaegertracing/jaeger@v1.31.0
1.47.0

Open the chart page →

2,556
linkerd-jaegerlinkerd2-edgeVerified publisher30.14.11-edge1 of 4See more

linkerd-jaeger linkerd2-edge 30.14.11-edge

1 of the 4 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.83.071fcef33ae71
github.com/jaegertracing/jaeger@v1.41.0
1.47.0

Open the chart page →

4,389
sp-otel-collectorsp-otel-collectorVerified publisher1.1.61 of 1See more

sp-otel-collector sp-otel-collector 1.1.6

1 of the 1 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
quay.io/geored/spmm-collector-contrib:1.0.063baf86a49ac
github.com/jaegertracing/jaeger@v1.41.0
1.47.0

Open the chart page →

2,022
grafanaappscodeVerified publisher2026.9.111 of 1See more

grafana appscode 2026.9.11

1 of the 1 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
ghcr.io/appscode/grafana:v2025.2.367d18880448c
github.com/jaegertracing/jaeger@v1.22.1-0.20210304164023-2fff3ca58910
1.47.0

Open the chart page →

2,333
jaegerbook-k8sinfra-v23.4.03 of 5See more

jaeger book-k8sinfra-v2 3.4.0

3 of the 5 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
jaegertracing/jaeger-agent:1.53.00214a0ef24b1
github.com/jaegertracing/jaeger@v0.0.0-20240108180540-b620f0eaefa5
1.47.0
jaegertracing/jaeger-collector:1.53.07f1269222903
github.com/jaegertracing/jaeger@v0.0.0-20240108180540-b620f0eaefa5
1.47.0
jaegertracing/jaeger-query:1.53.0049bb0d64ea3
github.com/jaegertracing/jaeger@v0.0.0-20240108180540-b620f0eaefa5
1.47.0

Open the chart page →

19,229
kube-acp-stackcloudentity2.28.01 of 7See more

kube-acp-stack cloudentity 2.28.0

1 of the 7 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
gcr.io/cockroachlabs-helm-charts/cockroach-self-signer-cert:1.3e225fe7eaa55
github.com/jaegertracing/jaeger@v1.17.0
1.47.0

Open the chart page →

20,900
grafana-agentdandydev-chartsVerified publisher0.19.21 of 1See more

grafana-agent dandydev-charts 0.19.2

1 of the 1 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
grafana/agent:v0.20.0825c09373d27
github.com/jaegertracing/jaeger@v1.27.0
1.47.0

Open the chart page →

3,238
adot-exporter-for-eks-on-ec2dasmeta-adot0.15.51 of 1See more

adot-exporter-for-eks-on-ec2 dasmeta-adot 0.15.5

1 of the 1 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
amazon/aws-otel-collector:v0.27.0d8ab0eef5074
github.com/jaegertracing/jaeger@v1.41.0
1.47.0

Open the chart page →

1,926
jaegergpg-dev3.3.33 of 5See more

jaeger gpg-dev 3.3.3

3 of the 5 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
jaegertracing/jaeger-agent:1.53.00214a0ef24b1
github.com/jaegertracing/jaeger@v0.0.0-20240108180540-b620f0eaefa5
1.47.0
jaegertracing/jaeger-collector:1.53.07f1269222903
github.com/jaegertracing/jaeger@v0.0.0-20240108180540-b620f0eaefa5
1.47.0
jaegertracing/jaeger-query:1.53.0049bb0d64ea3
github.com/jaegertracing/jaeger@v0.0.0-20240108180540-b620f0eaefa5
1.47.0

Open the chart page →

19,229
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
jaegertracing/all-in-one:1.53.060e65bfffe1f
github.com/jaegertracing/jaeger@v0.0.0-20240108180540-b620f0eaefa5
1.47.0

Open the chart page →

49,025
kiaekiae0.1.61 of 9See more

kiae kiae 0.1.6

1 of the 9 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.63.1dfb3a55ea8c9
github.com/jaegertracing/jaeger@v1.38.1
1.47.0

Open the chart page →

19,168
apm-serverkube-opsVerified publisher0.1.21 of 1See more

apm-server kube-ops 0.1.2

1 of the 1 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
elastic/apm-server:7.17.6c7a1c63257d0
github.com/jaegertracing/jaeger@v1.25.0
1.47.0

Open the chart page →

7,157
apica-ascentlogiqai2.0.42 of 19See more

apica-ascent logiqai 2.0.4

2 of the 19 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
logiqai/tracing:v1.35.2-lq1-c3e149f6781b8
github.com/jaegertracing/jaeger@v1.35.2-lq1
1.47.0
logiqai/tracing:v1.35.2-lq1-q4a746ff04d6a
github.com/jaegertracing/jaeger@v1.35.2-lq1
1.47.0

Open the chart page →

23,613
telegraf-dslsst-sqre1.0.231 of 1See more

telegraf-ds lsst-sqre 1.0.23

1 of the 1 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
library/telegraf:1.19-alpineaddb86c0c520
github.com/jaegertracing/jaeger@v1.15.1
1.47.0

Open the chart page →

3,764
magistralamagistrala-devopsVerified publisher0.16.23 of 42See more

magistrala magistrala-devops 0.16.2

3 of the 42 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
jaegertracing/jaeger-agent:1.53.00214a0ef24b1
github.com/jaegertracing/jaeger@v0.0.0-20240108180540-b620f0eaefa5
1.47.0
jaegertracing/jaeger-collector:1.53.07f1269222903
github.com/jaegertracing/jaeger@v0.0.0-20240108180540-b620f0eaefa5
1.47.0
jaegertracing/jaeger-query:1.53.0049bb0d64ea3
github.com/jaegertracing/jaeger@v0.0.0-20240108180540-b620f0eaefa5
1.47.0

Open the chart page →

24,400
mw-kube-agentmiddleware-labsVerified publisher0.1.21 of 1See more

mw-kube-agent middleware-labs 0.1.2

1 of the 1 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/mw-kube-agent:master056f0953763d
github.com/jaegertracing/jaeger@v1.41.0
1.47.0

Open the chart page →

1,594
cockroachdb-operatormmontesVerified publisher0.1.01 of 1See more

cockroachdb-operator mmontes 0.1.0

1 of the 1 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
cockroachdb/cockroach-operator:v2.1.0983312754620
github.com/jaegertracing/jaeger@v1.17.0
1.47.0

Open the chart page →

7,775
one-green-coreone-green-coreVerified publisher0.0.71 of 8See more

one-green-core one-green-core 0.0.7

1 of the 8 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
library/telegraf:1.20.428e98eece020
github.com/jaegertracing/jaeger@v1.26.0
1.47.0

Open the chart page →

9,558
cost-analyzerstatcan1.82.21 of 9See more

cost-analyzer statcan 1.82.2

1 of the 9 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
grafana/grafana:7.5.609bb407e26ab
github.com/jaegertracing/jaeger@v1.22.0
1.47.0

Open the chart page →

16,506
telegraf-ds-k3stelegraf-ds-k3s1.0.01 of 1See more

telegraf-ds-k3s telegraf-ds-k3s 1.0.0

1 of the 1 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
library/telegraf:1.19.0-alpine794079a7f241
github.com/jaegertracing/jaeger@v1.15.1
1.47.0

Open the chart page →

3,764
jaegerwikimedia3.1.23 of 4See more

jaeger wikimedia 3.1.2

3 of the 4 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
jaegertracing/jaeger-agent:1.53.00214a0ef24b1
github.com/jaegertracing/jaeger@v0.0.0-20240108180540-b620f0eaefa5
1.47.0
jaegertracing/jaeger-collector:1.53.07f1269222903
github.com/jaegertracing/jaeger@v0.0.0-20240108180540-b620f0eaefa5
1.47.0
jaegertracing/jaeger-query:1.53.0049bb0d64ea3
github.com/jaegertracing/jaeger@v0.0.0-20240108180540-b620f0eaefa5
1.47.0

Open the chart page →

9,248
opentelemetry-collectorwikimedia0.62.71 of 1See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry GHSA-2w8w-qhg4-f78j.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
github.com/jaegertracing/jaeger@v1.41.0
1.47.0

Open the chart page →

2,022

Container images carrying it

24 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
jaegertracing/jaeger-agent:1.53.00214a0ef24b1
github.com/jaegertracing/jaeger@v0.0.0-20240108180540-b620f0eaefa5
1.47.0
4
jaegertracing/jaeger-collector:1.53.07f1269222903
github.com/jaegertracing/jaeger@v0.0.0-20240108180540-b620f0eaefa5
1.47.0
4
jaegertracing/jaeger-query:1.53.0049bb0d64ea3
github.com/jaegertracing/jaeger@v0.0.0-20240108180540-b620f0eaefa5
1.47.0
4
amazon/aws-otel-collector:v0.27.0d8ab0eef5074
github.com/jaegertracing/jaeger@v1.41.0
1.47.0
1
cockroachdb/cockroach-operator:v2.1.0983312754620
github.com/jaegertracing/jaeger@v1.17.0
1.47.0
1
elastic/apm-server:7.17.6c7a1c63257d0
github.com/jaegertracing/jaeger@v1.25.0
1.47.0
1
grafana/agent:v0.20.0825c09373d27
github.com/jaegertracing/jaeger@v1.27.0
1.47.0
1
grafana/grafana:7.5.609bb407e26ab
github.com/jaegertracing/jaeger@v1.22.0
1.47.0
1
jaegertracing/all-in-one:1.53.060e65bfffe1f
github.com/jaegertracing/jaeger@v0.0.0-20240108180540-b620f0eaefa5
1.47.0
1
jaegertracing/all-in-one:1.55f6b5d09073f1
github.com/jaegertracing/jaeger@v0.0.0-20240307052142-d440fe1b4bdb
1.47.0
1
library/telegraf:1.20.428e98eece020
github.com/jaegertracing/jaeger@v1.26.0
1.47.0
1
library/telegraf:1.19.0-alpine794079a7f241
github.com/jaegertracing/jaeger@v1.15.1
1.47.0
1
library/telegraf:1.19-alpineaddb86c0c520
github.com/jaegertracing/jaeger@v1.15.1
1.47.0
1
logiqai/tracing:v1.35.2-lq1-c3e149f6781b8
github.com/jaegertracing/jaeger@v1.35.2-lq1
1.47.0
1
logiqai/tracing:v1.35.2-lq1-q4a746ff04d6a
github.com/jaegertracing/jaeger@v1.35.2-lq1
1.47.0
1
otel/opentelemetry-collector:0.59.0ee9da0b08d83
github.com/jaegertracing/jaeger@v1.37.0
1.47.0
1
otel/opentelemetry-collector-contrib:0.83.071fcef33ae71
github.com/jaegertracing/jaeger@v1.41.0
1.47.0
1
otel/opentelemetry-collector-contrib:0.46.0ba173aa85f3f
github.com/jaegertracing/jaeger@v1.31.0
1.47.0
1
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
github.com/jaegertracing/jaeger@v1.41.0
1.47.0
1
otel/opentelemetry-collector-contrib:0.63.1dfb3a55ea8c9
github.com/jaegertracing/jaeger@v1.38.1
1.47.0
1
gcr.io/cockroachlabs-helm-charts/cockroach-self-signer-cert:1.3e225fe7eaa55
github.com/jaegertracing/jaeger@v1.17.0
1.47.0
1
ghcr.io/appscode/grafana:v2025.2.367d18880448c
github.com/jaegertracing/jaeger@v1.22.1-0.20210304164023-2fff3ca58910
1.47.0
1
ghcr.io/middleware-labs/mw-kube-agent:master056f0953763d
github.com/jaegertracing/jaeger@v1.41.0
1.47.0
1
quay.io/geored/spmm-collector-contrib:1.0.063baf86a49ac
github.com/jaegertracing/jaeger@v1.41.0
1.47.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.