GHSA-CXH2-4639-VMC5 OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

Affected Repository: github.com/open-telemetry/opentelemetry-operator Component: cmd/otel-allocator TargetAllocator Companion: Prometheus Operator API types CRDs Summary OpenTelemetry Operator's TargetAllocator watches ServiceMonitor resources via the Prometheus Operator CR watcher and converts...

CVE-2026-40898 vulnerabilities

Vulnerabilities for packages: k8sgateway, kubo, ipfs-cluster, coredns, traefik, kargo, spegel, kube-metrics-adapter, q, kyverno-policy-reporter, kyverno-policy-reporter-ui, prometheus-blackbox-exporter, k3s, frp, kubernetes-dns-node-cache, opentelemetry-operator, teleport, dkron...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: jaeger, minio-object-browser, tempo, telegraf, prometheus, amazon-cloudwatch-agent-operator, karma, mc, loki, minio, datadog-agent, opentelemetry-collector, splunk-otel-collector, cloud-sql-proxy, metrics-server, prometheus-pushgateway, fluent-bit-plugin-loki,...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, percona-server-mongodb-operator, cert-manager-cmctl, mariadb-operator-fips, cert-manager-openshift-routes, step-issuer, cert-manager-google-cas-issuer, aws-privateca-issuer, mariadb-operator, percona-server-mongodb-operator-fips,...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: step-issuer, mariadb-operator, aws-privateca-issuer, cert-manager-istio-csr, cert-manager-cmctl, cert-manager-webhook-pdns, cert-manager-csi-driver, opentelemetry-operator, percona-server-mongodb-operator...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: step-issuer, mariadb-operator, aws-privateca-issuer, cert-manager-istio-csr, cert-manager-cmctl, cert-manager-webhook-pdns, cert-manager-csi-driver, opentelemetry-operator, percona-server-mongodb-operator...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, percona-server-mongodb-operator, cert-manager-cmctl, mariadb-operator-fips, cert-manager-openshift-routes, step-issuer, cert-manager-google-cas-issuer, aws-privateca-issuer, mariadb-operator, percona-server-mongodb-operator-fips,...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: dgraph, telegraf, eksctl, mc, boring-registry, docker, op-geth, pulumi-kubernetes-operator, rclone, opentelemetry-collector, argo-rollouts, opentofu, kyverno-policy-reporter-ui, flux-kustomize-controller, k3s, kubeflow-katib, chezmoi, crossplane-provider-azure,...