Skip to content
OpenAdvisories

Vendor

open-telemetry

62 known vulnerabilities.

Products

opentelemetry-ebpf-instrumentation 11 opentelemetry-go 9 opentelemetry-dotnet 8 opentelemetry-dotnet-contrib 6 opentelemetry-collector-contrib 5 opentelemetry-java-instrumentation 4 opentelemetry-js 3 opentelemetry-go-contrib 3 opentelemetry-python 2 opentelemetry-java 2 OpenTelemetry.Api 1 OpenTelemetry.Extensions.Propagators 1 opentelemetry-python-contrib 1 opentelemetry-operator 1 github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter 1 OpenTelemetry.Exporter.OpenTelemetryProtocol 1 go.opentelemetry.io/otel/schema/v1.1 1 go.opentelemetry.io/otel/schema/v1.0 1 opentelemetry-rust 1 opentelemetry-collector 1 go.opentelemetry.io/otel/baggage 1 go.opentelemetry.io/otel/propagation 1 opentelemetry-js-contrib 1 OpenTelemetry.Exporter.Jaeger 1 github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver 1 opentelemetry-cpp 1 opentelemetry-ebpf-profiler 1
All Critical High Medium Low Exploited only Public exploit

18 results · Clear filters · Feed

  • High 7.7
    CVE-2026-47701

    OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

    The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerToken…

    open-telemetry opentelemetry-operator kube-logging-operator github.com/open-telemetry/opentelemetry-operator Wolfi Go
  • High 7.0
    CVE-2026-81192

    OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS

    `OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the `host.id` resource attribute detector launches the `sh`…

    open-telemetry opentelemetry-dotnet-contrib OpenTelemetry.Resources.Host NuGet
  • High 7.5
    CVE-2026-59892

    OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

    OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthentic…

    open-telemetry opentelemetry-js @opentelemetry/propagator-jaeger npm
  • High 7.5
    CVE-2026-45686

    OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI

    OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, a remotely reachable integer overflow in OBI's memcached text protocol parser can crash the OBI process and cause…

    open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go
  • High 7.5
    CVE-2026-45685

    OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages

    OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.1.0 to before version 0.9.0, malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing a remote unauthen…

    open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go
  • High 7.5
    CVE-2026-45678

    OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads

    OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Postgres protocol parser assumes BIND message payloads contain a valid NUL-terminated portal name. A crafted empty or unterminate…

    open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go
  • High 7.5
    CVE-2026-44902

    opentelemetry-js: Prometheus exporter process crash via malformed HTTP request

    opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around U…

    open-telemetry @opentelemetry opentelemetry-js auto-instrumentations-node Wolfi npm
  • High 8.1
    CVE-2026-42602

    azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay

    azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint…

    open-telemetry opentelemetry-collector-contrib github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension Go
  • High 8.4
    CVE-2026-41433

    OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR

    OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From 0.4.0 to before 0.8.0, a flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbitrary host files whe…

    open-telemetry opentelemetry-ebpf-instrumentation go.opentelemetry.io/obi Go
  • High 7.3
    CVE-2026-39883 Public exploit

    OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on …

    open-telemetry opentelemetry-go zot kubescape Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-29181

    OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations…

    open-telemetry opentelemetry-go k3d aactl Ubuntu Azure Linux Wolfi Go
  • High 7.0
    CVE-2026-24051

    OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes th…

    open-telemetry opentelemetry-go zot kubescape Azure Linux Wolfi Go
  • High 7.5
    CVE-2025-27513

    OpenTelemetry .NET has a Denial of Service (DoS) Vulnerability in API Package

    OpenTelemetry dotnet is a dotnet telemetry framework. A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 could cause a Denial of Service (DoS) when a tracestate and traceparent header is received. Even if an application does not explicitly use trac…

    open-telemetry opentelemetry-dotnet promitor OpenTelemetry.Api Wolfi NuGet
  • High 8.2
    CVE-2024-36129

    OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

    The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Coll…

    open-telemetry opentelemetry-collector opentelemetry-collector opentelemetry-collector-contrib Wolfi Go
  • High 7.5
    CVE-2023-47108 Public exploit

    DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics

    OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have…

    open-telemetry opentelemetry-go-contrib kubescape k3s Ubuntu Azure Linux Wolfi Go
  • High 7.5
    CVE-2023-45142

    OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics

    OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when ma…

    open-telemetry opentelemetry-go-contrib k3s buildkitd Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2023-43810

    opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics

    OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, logs. Autoinstrumentation out of the box adds the label `http…

    open-telemetry opentelemetry-python-contrib opentelemetry-instrumentation PyPI
  • High 7.5
    CVE-2023-25151

    DoS vulnerability for high cardinality metrics in opentelemetry-go-contrib

    opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` uses the `httpconv.ServerRequest` function to annotate metric measurements for the `http.server…

    open-telemetry opentelemetry-go-contrib golang-opentelemetry-contrib go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp Ubuntu Go