21 matches found
CVE-2026-47701
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...
CVE-2026-47701 OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...
CVE-2026-47701
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...
CVE-2026-47701 OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...
CVE-2026-47701 OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...
EUVD-2026-77578
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...
CVE-2026-47701
CVE-2026-47701 affects the OpenTelemetry Operator for Kubernetes prior to version 0.152.0 . The vulnerability exists in the cmd/otel-allocator TargetAllocator when targetAllocator.prometheusCR.enabled is set to true. A tenant with permission to create or update a ServiceMonitor matched by the ope...
CVE-2026-47701: Exposure of Sensitive Information to an Unauthorized Actor
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: kyverno-notation-aws, spqr, cloud-provider-azure, kuma, rancher, spicedb, kube-state-metrics, emissary, kapp-controller, kyverno, calico, flux-helm-controller, gitlab-kas, kubescape, kots, gatekeeper, cluster-api-aws-controller, grafana, descheduler, hubble-ui,...
GO-2026-4399 vulnerabilities
Vulnerabilities for packages: percona-xtradb-cluster-operator, cert-manager-cmctl, percona-xtradb-cluster-operator-fips, opentelemetry-operator-fips, opentelemetry-operator, mariadb-operator, aws-privateca-issuer-fips, cert-manager-csi-driver, mariadb-operator-fips, aws-privateca-issuer,...
GO-2026-4399 vulnerabilities
Vulnerabilities for packages: opentelemetry-operator, cert-manager-webhook-pdns, cert-manager-istio-csr, aws-privateca-issuer, mariadb-operator, cert-manager-cmctl, percona-server-mongodb-operator, cert-manager-csi-driver, step-issuer...
GO-2026-5617 vulnerabilities
Vulnerabilities for packages: rancher, spire-server, trivy, ko, kots, envoy-gateway, grafana, podman, cri-tools, portieris, kpt, datadog-agent, amazon-cloudwatch-agent, aws-otel-collector, skopeo, opentelemetry-operator, rancher-machine, zot, grafana-alloy, docker-credential-gcr, rancher-agent,...
GHSA-GCJH-H69Q-9W9G vulnerabilities
Vulnerabilities for packages: kyverno-notation-aws, spqr, cloud-provider-azure, kuma, rancher, spicedb, kube-state-metrics, emissary, kapp-controller, kyverno, calico, flux-helm-controller, gitlab-kas, kubescape, kots, gatekeeper, cluster-api-aws-controller, grafana, descheduler, hubble-ui,...
GHSA-CXH2-4639-VMC5 OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
Affected Repository: github.com/open-telemetry/opentelemetry-operator Component: cmd/otel-allocator TargetAllocator Companion: Prometheus Operator API types CRDs Summary OpenTelemetry Operator's TargetAllocator watches ServiceMonitor resources via the Prometheus Operator CR watcher and converts...
CVE-2026-40898 vulnerabilities
Vulnerabilities for packages: coredns, teleport, opentelemetry-operator, kyverno-policy-reporter-ui, kubo, ipfs-cluster, dkron, k8sgateway, jitsucom-bulker, q, k3s, kube-metrics-adapter, frp, spegel, kyverno-policy-reporter, kubernetes-dns-node-cache, traefik, kargo...
CVE-2026-44903 vulnerabilities
Vulnerabilities for packages: mcp-grafana, istio, loki, grafana, prometheus-pushgateway, splunk-otel-collector, karma, k8sgpt, aws-otel-collector, minio, opentelemetry-collector, mc, opentelemetry-operator, minio-operator, certificate-transparency, minio-object-browser, metrics-server,...
CVE-2026-25518 vulnerabilities
Vulnerabilities for packages: percona-xtradb-cluster-operator, cert-manager-cmctl, percona-xtradb-cluster-operator-fips, opentelemetry-operator-fips, opentelemetry-operator, mariadb-operator, aws-privateca-issuer-fips, cert-manager-csi-driver, mariadb-operator-fips, aws-privateca-issuer,...
CVE-2026-25518 vulnerabilities
Vulnerabilities for packages: opentelemetry-operator, cert-manager-webhook-pdns, cert-manager-istio-csr, aws-privateca-issuer, mariadb-operator, cert-manager-cmctl, percona-server-mongodb-operator, cert-manager-csi-driver, step-issuer...
GHSA-GX3X-VQ4P-MHHV vulnerabilities
Vulnerabilities for packages: opentelemetry-operator, cert-manager-webhook-pdns, cert-manager-istio-csr, aws-privateca-issuer, mariadb-operator, cert-manager-cmctl, percona-server-mongodb-operator, cert-manager-csi-driver, step-issuer...
GHSA-GX3X-VQ4P-MHHV vulnerabilities
Vulnerabilities for packages: percona-xtradb-cluster-operator, cert-manager-cmctl, percona-xtradb-cluster-operator-fips, opentelemetry-operator-fips, opentelemetry-operator, mariadb-operator, aws-privateca-issuer-fips, cert-manager-csi-driver, mariadb-operator-fips, aws-privateca-issuer,...