21 matches found
CVE-2026-47701
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...
CVE-2026-47701
CVE-2026-47701 affects the OpenTelemetry Operator for Kubernetes prior to version 0.152.0 . The vulnerability exists in the cmd/otel-allocator TargetAllocator when targetAllocator.prometheusCR.enabled is set to true. A tenant with permission to create or update a ServiceMonitor matched by the ope...
CVE-2026-47701 OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...
CVE-2026-47701 OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...
EUVD-2026-77578
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...
CVE-2026-47701 OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...
CVE-2026-47701
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...
CVE-2026-47701: Exposure of Sensitive Information to an Unauthorized Actor
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: spqr, cluster-api-gcp-controller, gitlab-kas, cluster-api, rancher, telegraf, tetragon, cluster-api-helm-controller, kubernetes, azure-service-operator, kapp-controller, keda, crossplane, kubeflow-pipelines, cloud-provider-azure, datadog-agent, openbao,...
GO-2026-4399 vulnerabilities
Vulnerabilities for packages: percona-server-mongodb-operator, cert-manager-google-cas-issuer-fips, percona-xtradb-cluster-operator, gitlab-operator-fips, cert-manager-istio-csr, cert-manager-webhook-pdns, cert-manager-csi-driver, percona-xtradb-cluster-operator-fips, cert-manager-istio-csr-fips,...
GO-2026-4399 vulnerabilities
Vulnerabilities for packages: cert-manager-webhook-pdns, mariadb-operator, opentelemetry-operator, aws-privateca-issuer, step-issuer, cert-manager-csi-driver, percona-server-mongodb-operator, cert-manager-istio-csr, cert-manager-cmctl...
GO-2026-5617 vulnerabilities
Vulnerabilities for packages: rancher, nerdctl, undock, trivy, portieris, datadog-agent, zot, nuclei, amazon-cloudwatch-agent, aws-otel-collector, grafana, ko, rancher-machine, buildah, kpt, podman, docker-credential-gcr, rancher-agent, trivy-operator, spire-server, opentelemetry-operator, skopeo...
GHSA-GCJH-H69Q-9W9G vulnerabilities
Vulnerabilities for packages: spqr, cluster-api-gcp-controller, gitlab-kas, cluster-api, rancher, telegraf, tetragon, cluster-api-helm-controller, kubernetes, azure-service-operator, kapp-controller, keda, crossplane, kubeflow-pipelines, cloud-provider-azure, datadog-agent, openbao,...
GHSA-CXH2-4639-VMC5 OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
Affected Repository: github.com/open-telemetry/opentelemetry-operator Component: cmd/otel-allocator TargetAllocator Companion: Prometheus Operator API types CRDs Summary OpenTelemetry Operator's TargetAllocator watches ServiceMonitor resources via the Prometheus Operator CR watcher and converts...
CVE-2026-40898 vulnerabilities
Vulnerabilities for packages: kyverno-policy-reporter, kubo, k3s, kargo, opentelemetry-operator, frp, dkron, k8sgateway, kyverno-policy-reporter-ui, coredns, q, spegel, teleport, traefik, kube-metrics-adapter, jitsucom-bulker, ipfs-cluster, kubernetes-dns-node-cache...
CVE-2026-44903 vulnerabilities
Vulnerabilities for packages: telegraf, k8sgpt, cloud-sql-proxy, loki, istio, keda, mc, datadog-agent, aws-otel-collector, grafana, tempo, splunk-otel-collector, minio-operator, mcp-grafana, minio-object-browser, certificate-transparency, fluent-bit-plugin-loki, karma, minio,...
CVE-2026-25518 vulnerabilities
Vulnerabilities for packages: percona-server-mongodb-operator, cert-manager-google-cas-issuer-fips, percona-xtradb-cluster-operator, gitlab-operator-fips, cert-manager-istio-csr, cert-manager-webhook-pdns, cert-manager-csi-driver, percona-xtradb-cluster-operator-fips, cert-manager-istio-csr-fips,...
CVE-2026-25518 vulnerabilities
Vulnerabilities for packages: cert-manager-webhook-pdns, mariadb-operator, opentelemetry-operator, aws-privateca-issuer, step-issuer, cert-manager-csi-driver, percona-server-mongodb-operator, cert-manager-istio-csr, cert-manager-cmctl...
GHSA-GX3X-VQ4P-MHHV vulnerabilities
Vulnerabilities for packages: cert-manager-webhook-pdns, mariadb-operator, opentelemetry-operator, aws-privateca-issuer, step-issuer, cert-manager-csi-driver, percona-server-mongodb-operator, cert-manager-istio-csr, cert-manager-cmctl...
GHSA-GX3X-VQ4P-MHHV vulnerabilities
Vulnerabilities for packages: percona-server-mongodb-operator, cert-manager-google-cas-issuer-fips, percona-xtradb-cluster-operator, gitlab-operator-fips, cert-manager-istio-csr, cert-manager-webhook-pdns, cert-manager-csi-driver, percona-xtradb-cluster-operator-fips, cert-manager-istio-csr-fips,...