RHEL 9 : opentelemetry-collector (RHSA-2026:53415)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53415 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: github.com/prometheus/prometheus: Prometheus:...

RHEL 9 : opentelemetry-collector (RHSA-2026:53412)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53412 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: github.com/prometheus/prometheus: Prometheus:...

RHEL 10 : opentelemetry-collector (RHSA-2026:53413)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:53413 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: github.com/prometheus/prometheus: Prometheus:...

ROOT-APP-NPM-CVE-2026-59892 CVE-2026-59892 in @opentelemetry/propagator-jaeger - Patched by Root

Root has patched CVE-2026-59892 in the @opentelemetry/propagator-jaeger package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-54285 CVE-2026-54285 in @opentelemetry/core - Patched by Root

Root has patched CVE-2026-54285 in the @opentelemetry/core package for Root:npm. Multiple fixed versions available...

VulnCheck KEV: CVE-2026-2652

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled --app-name basic-auth and served via uvicorn ASGI. The FastAPI permission middleware only enforces authentication on /gateway/...

ROOT-APP-MAVEN-CVE-2026-45292 CVE-2026-45292 in io.opentelemetry:opentelemetry-api - Patched by Root

Root has patched CVE-2026-45292 in the io.opentelemetry:opentelemetry-api package for Root:Maven. Multiple fixed versions available...

MiracleLinux 9 : opentelemetry-collector-0.152.1-1.el9_8 (AXSA:2026-1458:04)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1458:04 advisory. github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint CVE-2026-42154...

Important: Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.10.1 release

Red Hat build of OpenTelemetry 3.10.1 has been released This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes. Breaking changes: None Deprecations: None Technology Preview features: None Enhancements: None Bug fixes: None Known issues: None...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to multiple vulnerabilities due to Node.js modules undici, js-yaml, fast-uri, protobufjs and @opentelemetry/core...

SUSE CVE-2026-39882

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...

CLEANSTART-2026-KC95386 Security fixes in opentelemetry-collector-contrib 0.149.0-r0

Package opentelemetry-collector-contrib version 0.149.0-r0 fixes 4 vulnerabilities: ghsa-78h2-9frx-2jm8, ghsa-w8rr-5gcm-pp58, CVE-2026-34986, CVE-2026-39882...

CLEANSTART-2026-SW69995 Security fixes in opentelemetry-collector-contrib 0.150.0-r0

Package opentelemetry-collector-contrib version 0.150.0-r0 fixes 8 vulnerabilities: CVE-2026-46595, CVE-2026-33816, CVE-2026-39821, CVE-2026-41602, CVE-2026-34986...

CLEANSTART-2026-SL88227 Security fixes in opentelemetry-collector-contrib-fips 0.144.0-r3

Package opentelemetry-collector-contrib-fips version 0.144.0-r3 fixes 8 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, CVE-2026-33186, CVE-2020-8912...

EUVD-2026-41151

OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords...

EUVD-2026-41152

OpenTelemetry Javaagent RMI context propagation allows resource exhaustion...

Oracle APEX (CVE-2026-54285) (July 2026 CPU)

The remote host is affected by a vulnerability in Oracle APEX component: Third Party OpenTelemetry as referenced in the July 2026 Oracle Critical Patch Update CPU advisory. - Vulnerability in the Oracle APEX product component: Third Party OpenTelemetry. Easily exploitable vulnerability allows...

RHSA-2026:19721 Red Hat Security Advisory: opentelemetry-collector security update

Bulletin has no description...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: telegraf, descheduler, k3s, cert-manager, kubernetes, spicedb, spicedb-operator, datadog-agent, gatekeeper, k8ssandra-client, kube-metrics-adapter, zot, kubernetes-csi-external-provisioner, keda, metrics-server, node-feature-discovery, rancher, fluent-operator, calic...

GO-2026-5426 Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk

Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk...