CVE-2026-47256 OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource...

CVE-2026-47256 OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource...

PT-2026-82360

Name of the Vulnerable Software and Affected Versions ddfourtwo sentry-selfhosted-mcp version 0.4.0 Description A flaw in the raw sentry api component allows for server-side request forgery SSRF, a condition where an attacker can induce the server to make requests to an unintended location. This ...

EUVD-2023-56164

Malicious code in bioql PyPI...

CVE-2023-36829

Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the access-control-allow-credentials: true HTTP header if the Origin request header ends with the system.base-hostname option of Sentry...

Permissive Cross-domain Policy With Untrusted Domains

sentry is susceptible to Permissive Cross-domain Policy With Untrusted Domains. If the Origin request header ends with the system.base-hostname option in the sentry installation, the sentry API returns the access-control-allow-credentials: true HTTP header. Only installations that have the...