StackRadar

GHSA-gcjh-h69q-9w9g

Medium

Advisory

Published 24 Jul 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
508
of 17,787 indexed, latest versions
Container images
465
deployed by those charts
Fix available
1 of 1
affected package

cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag

Carried by container images the latest versions of 508 of 17,787 indexed charts deploy, on 465 images.

Affected packageAffected versionsFixed inImages
github.com/google/cel-gogolangv0.22.0, v0.22.1, v0.23.0, v0.23.2+9 more0.29.0, 0.30.0465
OSV records
GHSA-gcjh-h69q-9w9gGO-2026-6094

Charts affected

508 by stars
ChartLatestAffected imagesRadar Score
kube-state-metricswenerme8.5.01 of 1See more

kube-state-metrics wenerme 8.5.0

1 of the 1 container images this version deploys carry GHSA-gcjh-h69q-9w9g.

Container imageDigestPackageFixed in
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.042cfe3723a5f
github.com/google/cel-go@v0.26.0
0.30.0

Open the chart page →

82
prometheuswenerme29.30.01 of 6See more

prometheus wenerme 29.30.0

1 of the 6 container images this version deploys carry GHSA-gcjh-h69q-9w9g.

Container imageDigestPackageFixed in
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.042cfe3723a5f
github.com/google/cel-go@v0.26.0
0.30.0

Open the chart page →

458
rancherwenerme2.15.11 of 2See more

rancher wenerme 2.15.1

1 of the 2 container images this version deploys carry GHSA-gcjh-h69q-9w9g.

Container imageDigestPackageFixed in
rancher/rancher:v2.15.15f6c4dc52a05
github.com/google/cel-go@v0.26.1
0.30.0

Open the chart page →

1,456
victoria-metrics-k8s-stackwenerme0.92.12 of 7See more

victoria-metrics-k8s-stack wenerme 0.92.1

2 of the 7 container images this version deploys carry GHSA-gcjh-h69q-9w9g.

Container imageDigestPackageFixed in
grafana/grafana:13.1.17cb8c64c4d57
github.com/google/cel-go@v0.28.1
0.30.0
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.185108987d044
github.com/google/cel-go@v0.26.0
0.30.0

Open the chart page →

1,890
orcwiremindVerified publisher0.3.01 of 1See more

orc wiremind 0.3.0

1 of the 1 container images this version deploys carry GHSA-gcjh-h69q-9w9g.

Container imageDigestPackageFixed in
quay.io/orc/openstack-resource-controller:v2.5.079f22af49612
github.com/google/cel-go@v0.26.0
0.30.0

Open the chart page →

262
xboardxboard0.2.01 of 1See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry GHSA-gcjh-h69q-9w9g.

Container imageDigestPackageFixed in
ghcr.io/cedar2025/xboard:latest896e4926e0d7
github.com/google/cel-go@v0.28.1
0.30.0

Open the chart page →

1,042
xonodepoolsxonodepoolsOfficialVerified publisher1.0.71 of 1See more

xonodepools xonodepools 1.0.7

1 of the 1 container images this version deploys carry GHSA-gcjh-h69q-9w9g.

Container imageDigestPackageFixed in
xosphere/xonodepools:1.0.71458097b6f85
github.com/google/cel-go@v0.26.0
0.30.0

Open the chart page →

388
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry GHSA-gcjh-h69q-9w9g.

Container imageDigestPackageFixed in
grafana/grafana:11.5.15781759b3d27
github.com/google/cel-go@v0.22.0
0.30.0

Open the chart page →

9,381

Container images carrying it

465 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/zncdatadev/zookeeper-operator:0.4.0b4f33d89ac45
github.com/google/cel-go@v0.26.0
github.com/google/cel-go@v0.26.0
0.29.0
0.30.0
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao:v2.5.5-gitlab25b7636dfba3f
github.com/google/cel-go@v0.26.1
github.com/google/cel-go@v0.26.1
0.29.0
0.30.0
1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator:3.3.242dd426130a9
github.com/google/cel-go@v0.29.0
0.30.0
1
registry.gitlab.com/lenitech/k8s-operator/keycloak-client:v0.6.19065cdd80035
github.com/google/cel-go@v0.23.2
github.com/google/cel-go@v0.23.2
0.29.0
0.30.0
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
github.com/google/cel-go@v0.23.2
github.com/google/cel-go@v0.23.2
0.29.0
0.30.0
1
registry.gitlab.com/xrow-public/developer-operator/developer-operator-controller:2.1.2301847adfe16
github.com/google/cel-go@v0.25.0
github.com/google/cel-go@v0.25.0
0.29.0
0.30.0
1
registry.k8s.io/autoscaling/cluster-autoscaler:v1.33.06ef10d108e0e
github.com/google/cel-go@v0.23.2
github.com/google/cel-go@v0.23.2
0.29.0
0.30.0
1
registry.k8s.io/autoscaling/cluster-autoscaler:v1.34.07b172f42533c
github.com/google/cel-go@v0.26.0
github.com/google/cel-go@v0.26.0
0.29.0
0.30.0
1
registry.k8s.io/capi-operator/cluster-api-operator:v0.29.0465e72f8b06a
github.com/google/cel-go@v0.29.0
0.30.0
1
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.32.0f9f4dfd733ab
github.com/google/cel-go@v0.22.0
github.com/google/cel-go@v0.22.0
0.29.0
0.30.0
1
registry.k8s.io/descheduler/descheduler:v0.36.07ca92c0a7b4f
github.com/google/cel-go@v0.26.0
github.com/google/cel-go@v0.26.0
0.29.0
0.30.0
1
registry.k8s.io/kwok/kwok:v0.8.06d25aa8fbdfe
github.com/google/cel-go@v0.26.0
github.com/google/cel-go@v0.26.0
0.29.0
0.30.0
1
registry.k8s.io/provider-os/openstack-cloud-controller-manager:v1.36.0e354e40db2d0
github.com/google/cel-go@v0.26.1
github.com/google/cel-go@v0.26.1
0.29.0
0.30.0
1
registry.k8s.io/sig-storage/csi-attacher:v4.10.0be59d0556508
github.com/google/cel-go@v0.26.0
github.com/google/cel-go@v0.26.0
0.29.0
0.30.0
1
registry.k8s.io/sig-storage/csi-resizer:v2.0.04a95d94e57ad
github.com/google/cel-go@v0.26.0
github.com/google/cel-go@v0.26.0
0.29.0
0.30.0
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.