CVE-2026-47256

A flaw was found in the OpenTelemetry Sentry exporter. A remote attacker can exploit a path traversal vulnerability by manipulating the service.name attribute. This allows the attacker to craft malicious Sentry API URLs, potentially gaining unauthorized access to sensitive administrative or...

CVE-2026-47256

The OpenTelemetry Collector Contrib Sentry exporter (prior to v0.154.0 ) interpolates the remote OTLP sender-controlled service.name resource attribute into Sentry API URLs without runtime validation. The projectSlugRegexp is applied only at config time, never to runtime-derived slugs. This allow...

CVE-2026-47256 OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource...

CVE-2026-47256 OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource...