GHSA-CXH2-4639-VMC5 OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

Affected Repository: github.com/open-telemetry/opentelemetry-operator Component: cmd/otel-allocator TargetAllocator Companion: Prometheus Operator API types CRDs Summary OpenTelemetry Operator's TargetAllocator watches ServiceMonitor resources via the Prometheus Operator CR watcher and converts...

CVE-2026-40898 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-ui, prometheus-blackbox-exporter, spegel, k8sgateway, dkron, frp, kargo, kubernetes-dns-node-cache, q, k3s, coredns, traefik, ipfs-cluster, opentelemetry-operator, kyverno-policy-reporter, teleport, kubo, kube-metrics-adapter...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: trillian, amazon-cloudwatch-agent-operator, opentelemetry-collector, tempo, istio, minio, loki, telegraf, cloud-sql-proxy, mc, splunk-otel-collector, karma, minio-object-browser, opentelemetry-collector-contrib, fluent-bit-plugin-loki, opentelemetry-operator,...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: step-issuer, percona-server-mongodb-operator-fips, opentelemetry-operator-fips, cert-manager-webhook-pdns-fips, cert-manager-istio-csr, gitlab-operator, aws-privateca-issuer-fips, cert-manager-csi-driver, aws-privateca-issuer, cert-manager-openshift-routes,...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, cert-manager-webhook-pdns, cert-manager-cmctl, cert-manager-istio-csr, percona-server-mongodb-operator, step-issuer, opentelemetry-operator, mariadb-operator, aws-privateca-issuer...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, cert-manager-webhook-pdns, cert-manager-cmctl, cert-manager-istio-csr, percona-server-mongodb-operator, step-issuer, opentelemetry-operator, mariadb-operator, aws-privateca-issuer...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: step-issuer, percona-server-mongodb-operator-fips, opentelemetry-operator-fips, cert-manager-webhook-pdns-fips, cert-manager-istio-csr, gitlab-operator, aws-privateca-issuer-fips, cert-manager-csi-driver, aws-privateca-issuer, cert-manager-openshift-routes,...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: spire-server, terragrunt, secrets-store-csi-driver-provider-azure, step-kms-plugin, cert-manager, buildkitd, cosign, falcosidekick, policy-controller, aws-eks-pod-identity-agent, thanos, sops, rancher, gomplate, loki, timestamp-authority, zot, harbor-registry, mc,...