CVE-2026-47701

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...

EUVD-2026-77578

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...

CVE-2026-47701 OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...

CVE-2026-47701 OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...

CVE-2026-47701

CVE-2026-47701 affects the OpenTelemetry Operator for Kubernetes prior to version 0.152.0 . The vulnerability exists in the cmd/otel-allocator TargetAllocator when targetAllocator.prometheusCR.enabled is set to true. A tenant with permission to create or update a ServiceMonitor matched by the ope...

CVE-2026-47701 OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...

CVE-2026-47701: Exposure of Sensitive Information to an Unauthorized Actor

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-health-monitor, kubeflow-pipelines, cert-manager-istio-csr, emissary, datadog-agent, kube-vip-cloud-provider, cluster-api, kubernetes-csi-external-attacher, kubescape, rke2-cloud-provider, fluent-operator, azure-service-operator, gatekeeper,...

GO-2026-4399 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, cert-manager-cmctl, step-issuer, percona-xtradb-cluster-operator-fips, aws-privateca-issuer-fips, cert-manager-csi-driver-fips, cert-manager-google-cas-issuer-fips, cert-manager-openshift-routes-fips, opentelemetry-operator-fips,...

GO-2026-4399 vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer, cert-manager-istio-csr, cert-manager-csi-driver, mariadb-operator, cert-manager-cmctl, percona-server-mongodb-operator, cert-manager-webhook-pdns, step-issuer, opentelemetry-operator...

GO-2026-5617 vulnerabilities

Vulnerabilities for packages: datadog-agent, amazon-cloudwatch-agent, podman, trivy, ko, docker-credential-gcr, opentelemetry-operator, grafana, portieris, nuclei, rancher-machine, grafana-alloy, aws-otel-collector, nerdctl, kpt, undock, rancher, amazon-cloudwatch-agent-operator, cri-tools,...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-health-monitor, kubeflow-pipelines, cert-manager-istio-csr, emissary, datadog-agent, kube-vip-cloud-provider, cluster-api, kubernetes-csi-external-attacher, kubescape, rke2-cloud-provider, fluent-operator, azure-service-operator, gatekeeper,...

GHSA-CXH2-4639-VMC5 OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

Affected Repository: github.com/open-telemetry/opentelemetry-operator Component: cmd/otel-allocator TargetAllocator Companion: Prometheus Operator API types CRDs Summary OpenTelemetry Operator's TargetAllocator watches ServiceMonitor resources via the Prometheus Operator CR watcher and converts...

CVE-2026-40898 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, frp, kubo, coredns, teleport, spegel, kube-metrics-adapter, kyverno-policy-reporter, q, traefik, jitsucom-bulker, k8sgateway, opentelemetry-operator, dkron, kargo, kyverno-policy-reporter-ui, k3s, ipfs-cluster...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: minio, k8sgpt, certificate-transparency, datadog-agent, node-problem-detector, opentelemetry-collector-contrib, metrics-server, opentelemetry-operator, grafana, cloud-sql-proxy, mcp-grafana, karma, aws-otel-collector, istio, minio-object-browser,...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, cert-manager-cmctl, step-issuer, percona-xtradb-cluster-operator-fips, aws-privateca-issuer-fips, cert-manager-csi-driver-fips, cert-manager-google-cas-issuer-fips, cert-manager-openshift-routes-fips, opentelemetry-operator-fips,...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer, cert-manager-istio-csr, cert-manager-csi-driver, mariadb-operator, cert-manager-cmctl, percona-server-mongodb-operator, cert-manager-webhook-pdns, step-issuer, opentelemetry-operator...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer, cert-manager-istio-csr, cert-manager-csi-driver, mariadb-operator, cert-manager-cmctl, percona-server-mongodb-operator, cert-manager-webhook-pdns, step-issuer, opentelemetry-operator...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, cert-manager-cmctl, step-issuer, percona-xtradb-cluster-operator-fips, aws-privateca-issuer-fips, cert-manager-csi-driver-fips, cert-manager-google-cas-issuer-fips, cert-manager-openshift-routes-fips, opentelemetry-operator-fips,...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: k8sgpt, kubescape, chezmoi, aws-eks-pod-identity-agent, xeol, opentelemetry-collector-contrib, opentelemetry-operator, fulcio, pulumi, git-sync, weaviate, kyverno-notation-aws, secrets-store-csi-driver-provider-azure, boring-registry, terraform, grafana-mimir, flyte,...