CVE-2026-47701

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...

CVE-2026-47701 OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...

CVE-2026-47701 OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...

CVE-2026-47701

CVE-2026-47701 affects the OpenTelemetry Operator for Kubernetes prior to version 0.152.0 . The vulnerability exists in the cmd/otel-allocator TargetAllocator when targetAllocator.prometheusCR.enabled is set to true. A tenant with permission to create or update a ServiceMonitor matched by the ope...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: calico, yunikorn-k8shim, datadog-agent, cluster-api-ipam-provider-in-cluster, cluster-api-provider-vsphere, spqr, flux-notification-controller, flux-kustomize-controller, opentelemetry-operator, kots, zot, kuma, kubernetes-csi-external-health-monitor, tetragon,...

GO-2026-4399 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns-fips, opentelemetry-operator-fips, gitlab-operator-fips, step-issuer, percona-server-mongodb-operator, step-issuer-fips, cert-manager-istio-csr-fips, cert-manager-openshift-routes, cert-manager-istio-csr, cert-manager-google-cas-issuer-fips,...

GO-2026-4399 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, step-issuer, cert-manager-cmctl, mariadb-operator, cert-manager-csi-driver, aws-privateca-issuer, opentelemetry-operator, cert-manager-istio-csr, percona-server-mongodb-operator...

GO-2026-5617 vulnerabilities

Vulnerabilities for packages: datadog-agent, amazon-cloudwatch-agent-operator, kpt, buildah, undock, opentelemetry-operator, aws-otel-collector, kots, zot, skopeo, trivy-operator, docker-credential-gcr, nerdctl, rancher-machine, spire-server, nuclei, ko, trivy, rancher-agent, envoy-gateway,...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: calico, yunikorn-k8shim, datadog-agent, cluster-api-ipam-provider-in-cluster, cluster-api-provider-vsphere, spqr, flux-notification-controller, flux-kustomize-controller, opentelemetry-operator, kots, zot, kuma, kubernetes-csi-external-health-monitor, tetragon,...

GHSA-CXH2-4639-VMC5 OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

Affected Repository: github.com/open-telemetry/opentelemetry-operator Component: cmd/otel-allocator TargetAllocator Companion: Prometheus Operator API types CRDs Summary OpenTelemetry Operator's TargetAllocator watches ServiceMonitor resources via the Prometheus Operator CR watcher and converts...

CVE-2026-40898 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, frp, kargo, q, spegel, dkron, teleport, k3s, kyverno-policy-reporter, jitsucom-bulker, ipfs-cluster, coredns, traefik, opentelemetry-operator, kube-metrics-adapter, kyverno-policy-reporter-ui, k8sgateway, kubo...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: datadog-agent, amazon-cloudwatch-agent-operator, prometheus-pushgateway, minio-object-browser, jaeger, aws-otel-collector, istio, opentelemetry-collector, minio, keda, splunk-otel-collector, k8sgpt, mc, karma, certificate-transparency, minio-operator, cloud-sql-proxy...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns-fips, opentelemetry-operator-fips, gitlab-operator-fips, step-issuer, percona-server-mongodb-operator, step-issuer-fips, cert-manager-istio-csr-fips, cert-manager-openshift-routes, cert-manager-istio-csr, cert-manager-google-cas-issuer-fips,...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, step-issuer, cert-manager-cmctl, mariadb-operator, cert-manager-csi-driver, aws-privateca-issuer, opentelemetry-operator, cert-manager-istio-csr, percona-server-mongodb-operator...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, step-issuer, cert-manager-cmctl, mariadb-operator, cert-manager-csi-driver, aws-privateca-issuer, opentelemetry-operator, cert-manager-istio-csr, percona-server-mongodb-operator...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns-fips, opentelemetry-operator-fips, gitlab-operator-fips, step-issuer, percona-server-mongodb-operator, step-issuer-fips, cert-manager-istio-csr-fips, cert-manager-openshift-routes, cert-manager-istio-csr, cert-manager-google-cas-issuer-fips,...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: gitsign, guac, opencost, octo-sts, filebrowser, kubernetes-dashboard-auth, flux-notification-controller, argo-rollouts, crossplane-provider-azure-managedidentity, azcopy, dgraph, kubeflow-katib, splunk-otel-collector, chezmoi, crossplane, thanos, eksctl,...