GO-2026-5932
UnscoredAdvisory
Published 7 Jul 2026In the index since 5 Sept 2026
- Severity
- Unscored
- worst across findings
- CVSS
- —
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 3,315
- of 17,821 indexed, latest versions
- Container images
- 3,713
- deployed by those charts
- Fix available
- None
- affected package
The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
Carried by container images the latest versions of 3,315 of 17,821 indexed charts deploy, on 3,713 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| golang.org/ | v0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+160 more | no fix listed | 3,713 |
- OSV records
- GO-2026-5932
Charts affected
3,315 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| kube-prometheus-stackprometheus-communityOfficialVerified publisher | 91.4.1 | 4 of 6See more | 682 |
| cert-managercert-managerOfficialVerified publisher | 1.21.2 | 4 of 4See more | 30 |
| argo-cdargoOfficialVerified publisher | 10.9.2 | 2 of 3See more | 3,043 |
| prometheusprometheus-communityOfficialVerified publisher | 29.31.1 | 6 of 6See more | 466 |
| traefiktraefikOfficialVerified publisher | 41.6.0 | 1 of 1See more | 171 |
| kubernetes-dashboardk8s-dashboard | 7.14.0 | 3 of 5See more | 3,163 |
| lokigrafana | 7.3.0 | 3 of 6See more | 3,958 |
| metrics-servermetrics-serverVerified publisher | 3.14.0 | 1 of 1See more | 171 |
| vaulthashicorpVerified publisher | 0.34.1 | 2 of 2See more | 552 |
| gitlabgitlabVerified publisher | 10.4.0 | 17 of 21See more | 16,478 |
| harborharborOfficialVerified publisher | 1.19.2 | 4 of 8See more | 1,739 |
| jenkinsjenkinsciOfficialVerified publisher | 5.9.63 | 1 of 2See more | 2,491 |
| external-secretsexternal-secrets-operatorVerified publisher | 2.10.0 | 1 of 1See more | 89 |
| external-dnsexternal-dnsVerified publisher | 1.22.0 | 1 of 1See more | 30 |
| longhornlonghorn | 1.12.1 | 1 of 3See more | 642 |
| gitlab-runnergitlabVerified publisher | 0.93.0 | 1 of 1See more | 280 |
| ciliumciliumOfficialVerified publisher | 1.20.2 | 2 of 3See more | 1,018 |
| airflowapache-airflowOfficialVerified publisher | 1.22.0 | 1 of 4See more | 3,197 |
| mongodbbitnamiVerified publisher | 19.2.1 | 1 of 1See more | 82 |
| velerovmware-tanzu | 12.2.0 | 1 of 1See more | 1,101 |
| argo-workflowsargoOfficialVerified publisher | 2.0.7 | 2 of 3See more | 259 |
| rancherrancher-stable | 2.15.1 | 2 of 2See more | 1,534 |
| oauth2-proxyoauth2-proxyOfficialVerified publisher | 10.7.0 | 1 of 1See more | 154 |
| sealed-secretsbitnami-labsVerified publisher | 2.18.6 | 1 of 1See more | 357 |
| kedakedacore | 2.20.2 | 3 of 3See more | 1,133 |
| nginx-ingressnginxVerified publisher | 2.7.3 | 1 of 1See more | 1,144 |
| nfs-subdir-external-provisionernfs-subdir-external-provisioner | 4.0.18 | 1 of 1See more | 2,746 |
| artifact-hubartifact-hubVerified publisher | 1.23.0 | 5 of 7See more | 10,881 |
| kube-state-metricsprometheus-communityVerified publisher | 8.5.0 | 1 of 1See more | 96 |
| consulhashicorpVerified publisher | 2.0.4 | 2 of 2See more | 8 |
| alloygrafana | 1.12.1 | 2 of 2See more | 1,191 |
| prometheus-blackbox-exporterprometheus-communityOfficialVerified publisher | 11.18.0 | 1 of 1See more | 600 |
| deschedulerdescheduler | 0.36.0 | 1 of 1See more | 583 |
| argo-rolloutsargoOfficialVerified publisher | 2.43.2 | 1 of 1See more | 122 |
| argo-cdargo-cd-oci | 10.9.2 | 2 of 3See more | 3,043 |
| jupyterhubjupyterhubOfficialVerified publisher | 4.4.2 | 1 of 7See more | 8,003 |
| jaegerjaegertracingOfficialVerified publisher | 4.14.0 | 1 of 1See more | 165 |
| mimir-distributedgrafana | 6.2.0 | 3 of 6See more | 4,699 |
| natsnatsVerified publisher | 2.14.6 | 2 of 3See more | 2,310 |
| argocd-image-updaterargoOfficialVerified publisher | 1.3.1 | 1 of 1See more | 733 |
| headlampheadlampOfficialVerified publisher | 0.45.0 | 1 of 1See more | 248 |
| dexdexVerified publisher | 0.24.1 | 1 of 1See more | 1,777 |
| uptime-kumauptime-kumaVerified publisher | 4.2.0 | 1 of 1See more | 30,740 |
| falcofalcosecurity | 9.1.0 | 3 of 3See more | 5,446 |
| nfs-server-provisionerkvaps | 1.8.0 | 1 of 1See more | 2,316 |
| alertmanagerprometheus-communityOfficialVerified publisher | 2.0.0 | 2 of 2See more | 56 |
| chartmuseumchartmuseumVerified publisher | 3.10.4 | 1 of 1See more | 1,515 |
| prometheus-node-exporterprometheus-communityOfficialVerified publisher | 4.57.0 | 1 of 1See more | 78 |
| rook-cephrookOfficialVerified publisher | 1.20.7 | 1 of 2See more | 1,474 |
| grafanagrafana-communityVerified publisher | 13.2.5 | 1 of 1See more | 449 |
Container images carrying it
3,713 by charts deploying them
A fixed version is listed for 0 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| quay.io/ | be3a5846922d | golang.org/ | no fix listed | 1 |
| quay.io/ | c43b3a9d98ae | golang.org/ | no fix listed | 1 |
| quay.io/ | 604a7d98ab58 | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | fcf464708a21 | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | 80ef8ceffc92 | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | e0ab1fc86761 | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | c7afac3446d6 | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | 0e3cd8c7776d | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | cf72810d33f5 | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | 1c38ad710b0c | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | 7757679afa1b | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | 704cd68566af | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | 696d798a5c85 | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | dc1a8972c640 | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | 6645e014f75d | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | 8ae8be4645ce | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | 5b7636dfba3f | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | aca1bb3d5b7e | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | 2256b49461fa | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | 36b19b72120e | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | 7d6d835ec2c6 | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | 5448611a3c54 | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | f91b602ca572 | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | 9d1fcb78f529 | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | f2194e526915 | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | 86d87291ffd4 | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | 9b9d1ed86b6a | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | 301847adfe16 | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | 06a950310ecd | golang.org/ | no fix listed | 1 |
| registry.gitlab.com/ | 03015f863a3e | golang.org/ | no fix listed | 1 |
| registry.k8s.io/ | 6ef10d108e0e | golang.org/ | no fix listed | 1 |
| registry.k8s.io/ | 7b172f42533c | golang.org/ | no fix listed | 1 |
| registry.k8s.io/ | 026f63d9ed42 | golang.org/ | no fix listed | 1 |
| registry.k8s.io/ | f9f4dfd733ab | golang.org/ | no fix listed | 1 |
| registry.k8s.io/ | 94caebb89dcf | golang.org/ | no fix listed | 1 |
| registry.k8s.io/ | b48d7d13dd06 | golang.org/ | no fix listed | 1 |
| registry.k8s.io/ | 7ca92c0a7b4f | golang.org/ | no fix listed | 1 |
| registry.k8s.io/ | 8b9a78d101a1 | golang.org/ | no fix listed | 1 |
| registry.k8s.io/ | af7e3857d877 | golang.org/ | no fix listed | 1 |
| registry.k8s.io/ | e36c08168342 | golang.org/ | no fix listed | 1 |
| registry.k8s.io/ | f6902791fb9a | golang.org/ | no fix listed | 1 |
| registry.k8s.io/ | 771a9a173e03 | golang.org/ | no fix listed | 1 |
| registry.k8s.io/ | 66ce7d460e53 | golang.org/ | no fix listed | 1 |
| registry.k8s.io/ | 0684e23172d9 | golang.org/ | no fix listed | 1 |
| registry.k8s.io/ | 3ae5620a33bb | golang.org/ | no fix listed | 1 |
| registry.k8s.io/ | 46cf7475c8da | golang.org/ | no fix listed | 1 |
| registry.k8s.io/ | 9330c53feca7 | golang.org/ | no fix listed | 1 |
| registry.k8s.io/ | 5658d0011a41 | golang.org/ | no fix listed | 1 |
| registry.k8s.io/ | ec5732e28f15 | golang.org/ | no fix listed | 1 |
| registry.k8s.io/ | 6d25aa8fbdfe | golang.org/ | no fix listed | 1 |