248 matches found
RHEL 9 : opentelemetry-collector (RHSA-2026:19353)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:19353 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: net/url: Incorrect parsing of IPv6 host litera...
CVE-2026-44903 vulnerabilities
Vulnerabilities for packages: telegraf, opentelemetry-operator, fluent-bit-plugin-loki, prometheus-pushgateway, amazon-cloudwatch-agent-operator, cloud-sql-proxy, mcp-grafana, trillian, tempo, aws-otel-collector, metrics-server, minio, node-problem-detector, opentelemetry-collector,...
CVE-2026-44903 vulnerabilities
Vulnerabilities for packages: datadog-agent, cloud-sql-proxy, trillian, cloudzero-agent, aws-otel-collector, trillian-fips, loki-fips, agentbeat, minio, certificate-transparency-fips, beats-fips, jaeger-fips, metrics-server-fips, nrdot-collector-k8s, prometheus-pushgateway-fips,...
OpenTelemetry Collector Contrib 安全漏洞
OpenTelemetry Collector Contrib is an extensible telemetry data collection component library developed under OpenTelemetry - CNCF. There are security vulnerabilities in versions 0.124.0 to 0.150.0 of OpenTelemetry Collector Contrib. These vulnerabilities stem from the Authenticate method not...
opentelemetry-collector-contrib's azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay
Summary A server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any OpenTelemetry receiver that uses auth: azureauth. The extension's Authenticate metho...
CVE-2026-32282 vulnerabilities
Vulnerabilities for packages: kube-arangodb, aws-flb-cloudwatch, mattermost, telegraf, kubescape, libnvidia-container, cilium-cli, fscrypt, gitaly, gitlab-pages, cloud-provider-aws, kaf, kubernetes, falco-no-driver, karpenter, snyk-cli, runc, prometheus-operator, kubernetes-dashboard, cilium-envo...
GHSA-X4JJ-H2V8-HQQV vulnerabilities
Vulnerabilities for packages: kube-arangodb, pulumi, syft, opa-envoy, gitaly, kubernetes-csi-driver-nfs, podman, kaf, gitleaks, gh, act, cert-manager-cmctl, ipfs-cluster, snyk-cli, policy-controller, kbld, task, prometheus-operator, mesosphere-vsphere-csi, k3s, kine, trivy, cosign,...
GHSA-7MR4-XJXG-34G6 vulnerabilities
Vulnerabilities for packages: kube-arangodb, syft, lvm-driver, terraform-provider-azapi, opa-envoy, cloud-sql-proxy, grafana-rollout-operator, kwok, cadvisor, spqr, gitaly, kubernetes-csi-driver-nfs, temporal, kubernetes-csi-driver-hostpath, db-operator, terraform, kaf, envoy-ratelimit, gh,...
CVE-2026-32285 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, datadog-agent, dagger, chainloop-cli, kubevela, nuclei, vcluster, chainloop-control-plane-fips, deck, loki-fips, eksctl, minio, redpanda, terragrunt, weaviate, ollama, teleport, terragrunt-fips, mcp-grafana, tempo, terraform-mcp-server,...
CVE-2026-32285 vulnerabilities
Vulnerabilities for packages: dgraph, goreleaser, kubevela, terragrunt, teleport, mcp-grafana, nuclei, tempo, grafana-alloy, grafana, minio, witness, opentelemetry-collector, vcluster, weaviate, k3s, cri-tools, loki, terraform-mcp-server, k8sgpt, datadog-agent, malcontent, gitlab-runner, ollama,...
CVE-2026-32287 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-cloudfront, telegraf, crossplane-provider-family-azure, crossplane-provider-aws-firehose, nuclei, crossplane-provider-aws-kinesis, tempo, grafana-alloy, amazon-cloudwatch-agent, crossplane-provider-aws-kms,...
ROS-20260327-73-0014
Vulnerability in opentelemetry-collector-contrib related to incorrect resource initialization. Exploitation of the vulnerability may allow an attacker to cause a denial of service...
ROS-20260327-73-0013
Vulnerability in opentelemetry-collector-contrib related to unrestricted resource allocation. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...
MiracleLinux 9 : opentelemetry-collector-0.144.0-1.el9_7 (AXSA:2026-330:02)
The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-330:02 advisory. golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61726 crypto/tls: Unexpected session resumption in crypto/tls...
GHSA-F7CQ-GVH6-QR25 Monitoring is vulnerable to Archive Slip due to missing checks in sanitization
The sanitizeArchivePath function in pkg/extract/extract.go lines 248–254 is vulnerable to a path traversal bypass due to a missing trailing path separator in the strings.HasPrefix check. A crafted tar archive can write files outside the intended destination directory when using the extractor CLI...
AlmaLinux 9 : opentelemetry-collector (ALSA-2026:4177)
The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:4177 advisory. golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61726 crypto/tls: Unexpected session resumption in crypto/tls...
opentelemetry-collector security update
An update is available for opentelemetry-collector. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Collector with the supported components for a Rocky Enterpris...
RLSA-2026:4177 Important: opentelemetry-collector security update
Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry Security Fixes: golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61726 crypto/tls: Unexpected session resumption in crypto/tls CVE-2025-68121 For more details...