Important: Red Hat Security Advisory: opentelemetry-collector security update

An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

RHSA-2026:19353 Red Hat Security Advisory: opentelemetry-collector security update

Bulletin has no description...

RHSA-2026:19135 Red Hat Security Advisory: opentelemetry-collector security update

Bulletin has no description...

Important: Red Hat Security Advisory: opentelemetry-collector security update

An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RHEL 9 : opentelemetry-collector (RHSA-2026:19353)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:19353 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: net/url: Incorrect parsing of IPv6 host litera...

ALSA-2026:19135 Important: opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: node-problem-detector, splunk-otel-collector, certificate-transparency, metrics-server, datadog-agent, minio, opentelemetry-operator, prometheus-pushgateway, keda, fluent-bit-plugin-loki, karma, cloud-sql-proxy, loki, grafana, istio, aws-otel-collector, mc, k8sgpt,...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, cloud-sql-proxy, datadog-agent, grafana, loki, opentelemetry-collector-contrib-fips, certificate-transparency, metrics-server-fips, splunk-otel-collector, aws-otel-collector, mcp-grafana-fips, keda, amazon-cloudwatch-agent-operator-fips, prometheu...

OpenTelemetry Collector Contrib 安全漏洞

OpenTelemetry Collector Contrib is an extensible telemetry data collection component library developed under OpenTelemetry - CNCF. There are security vulnerabilities in versions 0.124.0 to 0.150.0 of OpenTelemetry Collector Contrib. These vulnerabilities stem from the Authenticate method not...

opentelemetry-collector-contrib's azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay

Summary A server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any OpenTelemetry receiver that uses auth: azureauth. The extension's Authenticate metho...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: kind, kyverno, apko, k3s, libnvidia-container, cloud-provider-aws, wal-g, eksctl, spire-server, sriov-network-device-plugin, filebrowser, gitlab-pages, dive, falcoctl, dex, snyk-cli, falco-no-driver, buildah, policy-controller, gh, ko, newrelic-fluent-bit-output, zot...

CVE-2026-32282 vulnerabilities

Vulnerabilities for packages: kyverno, kots, k3s, redka, libnvidia-container, cloud-provider-aws, go, kube-fluentd-operator, aws-flb-firehose, gitlab-kas, external-dns, external-secrets-operator, gitaly, spire-server, aws-flb-cloudwatch, fuse-overlayfs-snapshotter, gitlab-pages, fscrypt, snyk-cli...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-auth, go-discover, apko, k3s, kyverno, litestream, libnvidia-container, cloud-provider-aws, vault-secrets-webhook, wal-g, swagger, eksctl, dbmate, spire-server, sriov-network-device-plugin, grafana-mimir, filebrowser, certificate-transparency,...

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, chainloop-control-plane, datadog-agent, grafana, loki, opentelemetry-collector-contrib-fips, maru, terraform-mcp-server, mcp-grafana-fips, terragrunt-fips, kubevela-fips, redpanda, chainloop-control-plane-fips, grafana-beyla, prometheus, deck-fips...

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: vcluster, k3s, nfpm, malcontent, eksctl, witness, datadog-agent, terragrunt, minio, maru, dgraph, loki, grafana, teleport, cri-tools, goreleaser, gitlab-runner, redpanda, rclone, k8sgpt, opentelemetry-collector-contrib, kubevela, mcp-grafana, terraform-mcp-server,...

CVE-2026-32287 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-iam, crossplane-provider-aws-kms, crossplane-provider-aws-sns, crossplane-provider-aws-lambda, crossplane-provider-aws-eks, crossplane-provider-aws-rds, crossplane-provider-aws-elasticache, crossplane-provider-aws-ec2, datadog-agent,...

ROS-20260327-73-0014

Vulnerability in opentelemetry-collector-contrib related to incorrect resource initialization. Exploitation of the vulnerability may allow an attacker to cause a denial of service...

ROS-20260327-73-0013

Vulnerability in opentelemetry-collector-contrib related to unrestricted resource allocation. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

MiracleLinux 9 : opentelemetry-collector-0.144.0-1.el9_7 (AXSA:2026-330:02)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-330:02 advisory. golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61726 crypto/tls: Unexpected session resumption in crypto/tls...

GHSA-F7CQ-GVH6-QR25 Monitoring is vulnerable to Archive Slip due to missing checks in sanitization

The sanitizeArchivePath function in pkg/extract/extract.go lines 248–254 is vulnerable to a path traversal bypass due to a missing trailing path separator in the strings.HasPrefix check. A crafted tar archive can write files outside the intended destination directory when using the extractor CLI...