CVE-2026-47701

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...

EUVD-2026-77578

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...

CVE-2026-47701 OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...

CVE-2026-47701 OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...

CVE-2026-47701

CVE-2026-47701 affects the OpenTelemetry Operator for Kubernetes prior to version 0.152.0 . The vulnerability exists in the cmd/otel-allocator TargetAllocator when targetAllocator.prometheusCR.enabled is set to true. A tenant with permission to create or update a ServiceMonitor matched by the ope...

CVE-2026-47701 OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...

CVE-2026-47701: Exposure of Sensitive Information to an Unauthorized Actor

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr, zot, kubernetes-csi-external-health-monitor, metrics-server, tetragon, cloud-provider-gcp-cloud-controller-manager, tkn, descheduler, kyverno-notation-aws, kwok, helm-operator, metallb, kuma, flux-helm-controller, cert-manager-webhook-pdns,...

GO-2026-4399 vulnerabilities

Vulnerabilities for packages: gitlab-operator, cert-manager-openshift-routes, step-issuer, aws-privateca-issuer-fips, mariadb-operator-fips, gitlab-operator-fips, cert-manager-openshift-routes-fips, cert-manager-cmctl, percona-server-mongodb-operator, opentelemetry-operator,...

GO-2026-4399 vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr, opentelemetry-operator, cert-manager-csi-driver, percona-server-mongodb-operator, mariadb-operator, cert-manager-webhook-pdns, step-issuer, cert-manager-cmctl, aws-privateca-issuer...

GO-2026-5617 vulnerabilities

Vulnerabilities for packages: zot, skopeo, nuclei, ko, amazon-cloudwatch-agent-operator, envoy-gateway, kots, portieris, opentelemetry-operator, grafana-alloy, nerdctl, trivy, amazon-cloudwatch-agent, docker-credential-gcr, aws-otel-collector, grafana, rancher-machine, kpt, trivy-operator,...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr, zot, kubernetes-csi-external-health-monitor, metrics-server, tetragon, cloud-provider-gcp-cloud-controller-manager, tkn, descheduler, kyverno-notation-aws, kwok, helm-operator, metallb, kuma, flux-helm-controller, cert-manager-webhook-pdns,...

GHSA-CXH2-4639-VMC5 OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

Affected Repository: github.com/open-telemetry/opentelemetry-operator Component: cmd/otel-allocator TargetAllocator Companion: Prometheus Operator API types CRDs Summary OpenTelemetry Operator's TargetAllocator watches ServiceMonitor resources via the Prometheus Operator CR watcher and converts...

CVE-2026-40898 vulnerabilities

Vulnerabilities for packages: q, kubernetes-dns-node-cache, opentelemetry-operator, dkron, kube-metrics-adapter, frp, coredns, kubo, kyverno-policy-reporter, teleport, traefik, kargo, k3s, kyverno-policy-reporter-ui, spegel, jitsucom-bulker, k8sgateway, ipfs-cluster...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: minio, mcp-grafana, metrics-server, trillian, mc, karma, minio-object-browser, istio, amazon-cloudwatch-agent-operator, certificate-transparency, opentelemetry-operator, fluent-bit-plugin-loki, keda, cloud-sql-proxy, k8sgpt, aws-otel-collector, telegraf, grafana,...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: gitlab-operator, cert-manager-openshift-routes, step-issuer, aws-privateca-issuer-fips, mariadb-operator-fips, gitlab-operator-fips, cert-manager-openshift-routes-fips, cert-manager-cmctl, percona-server-mongodb-operator, opentelemetry-operator,...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr, opentelemetry-operator, cert-manager-csi-driver, percona-server-mongodb-operator, mariadb-operator, cert-manager-webhook-pdns, step-issuer, cert-manager-cmctl, aws-privateca-issuer...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr, opentelemetry-operator, cert-manager-csi-driver, percona-server-mongodb-operator, mariadb-operator, cert-manager-webhook-pdns, step-issuer, cert-manager-cmctl, aws-privateca-issuer...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: gitlab-operator, cert-manager-openshift-routes, step-issuer, aws-privateca-issuer-fips, mariadb-operator-fips, gitlab-operator-fips, cert-manager-openshift-routes-fips, cert-manager-cmctl, percona-server-mongodb-operator, opentelemetry-operator,...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: grafana-mimir, cortex, gitness, kaniko, guac, harbor-registry, sftpgo-plugin-pubsub, crossplane-provider-azure, hydra, traefik, step-ca, chezmoi, amazon-cloudwatch-agent, pulumi, dgraph, atlantis, gitsign, ksops, gitea, argo-workflows, azcopy, zarf, buildkitd,...