Skip to content
OpenAdvisories
Low · 2.0 CVE-2026-81870 EUVD-2026-81098GHSA-8wmf-6v46-5gfgGO-2026-6505

OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs

Published Sep 16, 2026 · Updated Sep 17, 2026 · Assigned by GitHub_M

Vendor: open-telemetry Product: opentelemetry-go Package: aactl Package: act Package: addon-resizer Package: amazon-cloudwatch-agent Package: amazon-cloudwatch-agent-operator Package: apisix-ingress-controller Package: argo-cd-3.2 Package: argo-cd-3.2-compat Package: argo-cd-3.3 Package: argo-cd-3.3-compat Package: argo-cd-3.4 Package: argo-cd-3.4-compat Package: argo-events Package: argo-rollouts Package: argo-workflow-executor-3.7 Package: argo-workflows-3.7 Package: argocd-image-updater Package: aws-efs-csi-driver Package: aws-node-termination-handler Package: aws-otel-collector Package: aws-privateca-issuer Package: azl-otel-collector Package: azure-service-operator Package: azure-workload-identity-webhook Package: azuredisk-csi-1.34 Package: azurelinux-image-tools Package: bank-vaults Package: bank-vaults-template Package: bento Package: boring-registry Package: buildah Package: caddy Package: cadvisor Package: calico-apiserver-3.31 Package: calico-apiserver-3.32 Package: calico-kube-controllers-3.31 Package: calico-kube-controllers-3.32 Package: cert-manager Package: cert-manager-1.20 Package: cert-manager-cmctl Package: cert-manager-controller-1.20 Package: cert-manager-csi-driver Package: cert-manager-istio-csr Package: cert-manager-webhook-1.20 Package: cert-manager-webhook-pdns Package: certificate-transparency-trillian-ctserver Package: chartmuseum Package: cilium-1.19 Package: cilium-1.19-clustermesh-apiserver Package: cilium-1.19-hubble-relay Package: cilium-1.19-operator-aws Package: cilium-1.19-operator-generic Package: clickhouse-operator Package: clickhouse-operator-metrics-exporter Package: cloud-provider-aws-1.35-cloud-controller-manager Package: cloud-provider-aws-1.36-cloud-controller-manager Package: cloud-provider-azure-cloud-controller-manager-1.35 Package: cloud-provider-azure-cloud-controller-manager-1.36 Package: cloud-provider-azure-cloud-node-manager-1.35 Package: cloud-provider-azure-cloud-node-manager-1.36 Package: cloud-provider-gcp-cloud-controller-manager Package: cloud-provider-kubevirt Package: cloud-provider-vsphere Package: cloud-sql-proxy-2.16 Package: cloud-sql-proxy-2.21 Package: cloud-sql-proxy-2.22 Package: cloud-sql-proxy-2.23 Package: cloud-sql-proxy-2.24 Package: cloud-sql-proxy-2.25 Package: cloudflared Package: cloudprober Package: cluster-api-1.12-capd-manager Package: cluster-api-1.12-controller Package: cluster-api-1.12-kubeadm-bootstrap-controller Package: cluster-api-1.12-kubeadm-control-plane-controller Package: cluster-api-1.13-capd-manager Package: cluster-api-1.13-controller Package: cluster-api-1.13-kubeadm-bootstrap-controller Package: cluster-api-1.13-kubeadm-control-plane-controller Package: cluster-api-aws-controller Package: cluster-api-azure-controller Package: cluster-api-gcp-controller Package: cluster-api-helm-controller Package: cluster-api-ipam-provider-in-cluster Package: cluster-api-provider-vsphere Package: cluster-autoscaler-1.35 Package: consul-k8s-1.9 Package: consul-k8s-1.9-cli Package: containerd-1 Package: containerd-2.3 Package: containerd-stress-1 Package: containerd2 Package: coredns-1.14 Package: cortex Package: cosign-3 Package: cri-o Package: cri-tools Package: crossplane-2.2 Package: crossplane-2.2-crank Package: crossplane-provider-keycloak Package: crossplane-provider-sql Package: ctr-1 Package: dagdotdev Package: dagger Package: dapr-daprd-1.17 Package: dapr-injector-1.17 Package: dapr-operator-1.17 Package: dapr-placement-1.17 Package: dapr-scheduler-1.17 Package: dapr-sentry-1.17 Package: datadog-agent-7.77 Package: datadog-agent-7.77-full Package: datadog-agent-7.78 Package: datadog-agent-7.78-full Package: datadog-agent-7.79 Package: datadog-agent-7.79-full Package: datadog-agent-7.80 Package: datadog-agent-7.80-full Package: datadog-agent-7.81 Package: datadog-agent-7.81-full Package: datadog-cluster-agent-7.77 Package: datadog-cluster-agent-7.78 Package: datadog-cluster-agent-7.79 Package: datadog-cluster-agent-7.80 Package: datadog-cluster-agent-7.81 Package: datadog-operator Package: db-operator Package: dbmate Package: descheduler Package: dex Package: dgraph Package: distribution Package: dive Package: docker-buildx Package: docker-compose Package: docker-machine-driver-harvester Package: dockerd-28 Package: dogstatsd-7.77 Package: dogstatsd-7.78 Package: dogstatsd-7.79 Package: dogstatsd-7.80 Package: dogstatsd-7.81 Package: eksctl Package: emissary Package: emissary-apiext Package: envoy-ratelimit Package: etcd Package: etcd-3.6 Package: external-dns-0.21 Package: external-secrets-operator-2.3 Package: external-secrets-operator-2.4 Package: external-secrets-operator-2.5 Package: external-secrets-operator-2.6 Package: falco-no-driver Package: falcoctl Package: falcosidekick Package: ferretdb Package: flannel Package: fluent-bit-plugin-loki Package: fluent-operator Package: flux-2.7 Package: flux-2.8 Package: flux-2.9 Package: flux-helm-controller Package: flux-image-automation-controller Package: flux-image-reflector-controller Package: flux-kustomize-controller Package: flux-notification-controller Package: flux-source-controller Package: flyte Package: fulcio Package: gatekeeper-3.22 Package: gatekeeper-3.22-gator Package: gatus Package: gcp-compute-persistent-disk-csi-driver-1.25 Package: gcsfuse Package: gh Package: gitlab-docker-machine-19.3 Package: gitlab-kas-19.2 Package: gitlab-pages-19.2 Package: gitlab-pages-19.3 Package: gitlab-runner-19.2 Package: gitlab-runner-helper-19.2 Package: gitness Package: gitsign Package: gitsign-credential-cache Package: go-discover Package: go.opentelemetry.io/otel/exporters/otlp/otlptrace Package: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc Package: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp Package: go.opentelemetry.io/otel/exporters/zipkin Package: go.opentelemetry.io/otel/sdk Package: gogatekeeper Package: golang-opentelemetry-otel Package: golang-opentelemetry-otel Package: gomplate-5 Package: goreleaser Package: gptscript Package: grafana-12.3 Package: grafana-12.4 Package: grafana-13.0 Package: grafana-agent-operator Package: grafana-alloy Package: grafana-image-renderer Package: grafana-mimir-3.0 Package: grafana-mimir-3.0-metaconvert-3.0 Package: grafana-mimir-3.0-mimirtool-3.0 Package: grafana-mimir-3.0-query-tee-3.0 Package: grafana-mimir-3.1 Package: grafana-mimir-3.1-metaconvert-3.1 Package: grafana-mimir-3.1-mimirtool-3.1 Package: grafana-mimir-3.1-query-tee-3.1 Package: grafana-operator Package: grafana-pyroscope-1.19 Package: grafana-pyroscope-2.0 Package: grpcurl Package: grype Package: guac Package: guacgql Package: guacingest Package: guacone Package: haproxy-ingress-0.16 Package: harbor-2.14 Package: harbor-2.14-exporter Package: harbor-2.14-jobservice Package: harbor-2.14-registryctl Package: harbor-cli Package: harbor-registry Package: headlamp Package: helm-operator Package: hubble Package: hydra Package: ipfs-cluster Package: jaeger-operator Package: jitsucom-bulker-bulker Package: jitsucom-bulker-sidecar Package: juicefs-1.3 Package: k3s-1.32 Package: k3s-1.34 Package: k3s-1.35 Package: k3s-static-1.32 Package: k3s-static-1.34 Package: k3s-static-1.35 Package: k6 Package: k8s_gateway Package: k8sgpt Package: k9s Package: kafka-proxy Package: kaniko Package: kapp Package: kapp-controller Package: kata-containers Package: kata-containers-cc Package: kata-containers-preview Package: keda Package: keda-2.19 Package: keda-2.19-metrics-apiserver Package: keda-2.20 Package: keda-2.20-admission-webhooks Package: keda-2.20-metrics-apiserver Package: kiali Package: kine Package: knative-client Package: knative-eventing-1.21-channel-controller Package: knative-eventing-1.21-channel-dispatcher Package: knative-eventing-1.21-controller Package: knative-eventing-1.21-filter Package: knative-eventing-1.21-ingress Package: knative-eventing-1.21-jobsink Package: knative-eventing-1.21-mtchannel-broker Package: knative-eventing-1.21-webhook Package: knative-eventing-1.22-channel-controller Package: knative-eventing-1.22-channel-dispatcher Package: knative-eventing-1.22-controller Package: knative-eventing-1.22-filter Package: knative-eventing-1.22-ingress Package: knative-eventing-1.22-jobsink Package: knative-eventing-1.22-mtchannel-broker Package: knative-eventing-1.22-webhook Package: knative-operator-1.21 Package: knative-operator-1.21-webhook Package: knative-operator-1.22 Package: knative-operator-1.22-webhook Package: knative-serving-1.21-activator Package: knative-serving-1.21-autoscaler Package: knative-serving-1.21-autoscaler-hpa Package: knative-serving-1.21-controller Package: knative-serving-1.21-queue Package: knative-serving-1.21-webhook Package: knative-serving-1.22-activator Package: knative-serving-1.22-autoscaler Package: knative-serving-1.22-autoscaler-hpa Package: knative-serving-1.22-controller Package: knative-serving-1.22-queue Package: knative-serving-1.22-webhook Package: ko Package: kots Package: kpt Package: kserve-agent Package: kserve-localmodel Package: kserve-manager Package: kserve-modelmesh-serving Package: kserve-qpext Package: kserve-router Package: ksops Package: kube-apiserver-1.34 Package: kube-apiserver-1.35 Package: kube-apiserver-1.36 Package: kube-apiserver-1.37 Package: kube-arangodb-1.4 Package: kube-controller-manager-1.34 Package: kube-controller-manager-1.35 Package: kube-controller-manager-1.36 Package: kube-controller-manager-1.37 Package: kube-metrics-adapter Package: kube-proxy-1.34 Package: kube-proxy-1.35 Package: kube-proxy-1.36 Package: kube-proxy-1.37 Package: kube-rbac-proxy Package: kube-scheduler-1.34 Package: kube-scheduler-1.35 Package: kube-scheduler-1.36 Package: kube-scheduler-1.37 Package: kube-state-metrics Package: kube-vip-cloud-provider Package: kube-vip-cloud-provider Package: kubeadm-1.34 Package: kubeadm-1.35 Package: kubectl-argo-rollouts Package: kubeflow-pipelines-apiserver Package: kubeflow-pipelines-cache_server Package: kubeflow-pipelines-persistence_agent Package: kubeflow-pipelines-scheduledworkflow Package: kubeflow-profile-controller Package: kubelet-1.34 Package: kubelet-1.35 Package: kubelet-1.36 Package: kubelet-1.37 Package: kuberay-operator Package: kubernetes Package: kubernetes-1.34 Package: kubernetes-1.35 Package: kubernetes-1.36 Package: kubernetes-1.37 Package: kubernetes-csi-driver-hostpath Package: kubernetes-csi-driver-nfs Package: kubernetes-csi-external-provisioner Package: kubernetes-csi-external-resizer Package: kubernetes-csi-external-snapshot-controller-8.5 Package: kubernetes-csi-external-snapshot-controller-8.6 Package: kubernetes-csi-external-snapshotter-8.5 Package: kubernetes-csi-external-snapshotter-8.6 Package: kubernetes-csi-node-driver-registrar-2.16 Package: kubernetes-csi-node-driver-registrar-2.17 Package: kubernetes-dns-node-cache Package: kubernetes-event-exporter Package: kubescape Package: kubescape-operator Package: kubevela-vela-cli Package: kubevela-vela-core Package: kuma-cp-2.12 Package: kuma-cp-2.13 Package: kuma-dp-2.12 Package: kuma-dp-2.13 Package: kwok Package: kyverno-1.17 Package: kyverno-1.18 Package: kyverno-background-controller-1.17 Package: kyverno-background-controller-1.18 Package: kyverno-cleanup-controller-1.17 Package: kyverno-cleanup-controller-1.18 Package: kyverno-cli-1.17 Package: kyverno-cli-1.18 Package: kyverno-init-container-1.17 Package: kyverno-init-container-1.18 Package: kyverno-notation-aws Package: kyverno-reports-controller-1.17 Package: kyverno-reports-controller-1.18 Package: lazydocker Package: linkerd2-controller Package: litestream Package: local-static-provisioner Package: local-volume-node-cleanup Package: loki-3.6 Package: loki-3.6-logcli Package: loki-3.6-loki-canary Package: loki-3.6-promtail Package: loki-3.7 Package: loki-3.7-logcli Package: loki-3.7-loki-canary Package: manifest-tool Package: mcp-grafana Package: mesosphere-vsphere-csi-driver Package: metallb Package: metallb-controller Package: metallb-frr Package: metallb-frr-compat Package: metallb-speaker Package: metrics-server Package: migrate Package: minio Package: moby-containerd-cc Package: moby-engine Package: net-kourier-1.21 Package: net-kourier-1.22 Package: neuvector-scanner Package: neuvector-scanner-task Package: neuvector-sigstore-interface Package: newrelic-infrastructure-agent Package: node-feature-discovery-0.18 Package: node-problem-detector-1.35 Package: node-problem-detector-1.36 Package: nuclei Package: octo-sts Package: octo-sts-webhook Package: op-geth Package: opa Package: openbao Package: opencost Package: opensearch-k8s-operator Package: opentofu-1.11 Package: opentofu-1.12 Package: opentofu-1.9 Package: otel-cli Package: percona-server-mongodb-operator Package: pg_timetable Package: podman-6.0 Package: policy-controller Package: policy-controller-tester Package: prometheus-3.10 Package: prometheus-3.11 Package: prometheus-3.12 Package: prometheus-adapter Package: prometheus-adapter Package: prometheus-alertmanager Package: prometheus-operator Package: promxy Package: pulumi-kubernetes-operator Package: rancher-2.13 Package: rancher-2.14 Package: rancher-agent-2.13 Package: rancher-agent-2.14 Package: rancher-fleet-agent Package: rancher-fleet-cli Package: rancher-fleet-controller Package: rancher-machine Package: rancher-system-agent Package: rancher-webhook-0.10 Package: ratify Package: ratify-licensechecker Package: ratify-sbom Package: ratify-schemavalidator Package: ratify-vulnerabilityreport Package: redis-operator Package: rekor-server Package: restic Package: rke2-cloud-provider Package: scorecard Package: secrets-store-csi-driver Package: secrets-store-csi-driver-provider-azure Package: sftpgo Package: sftpgo-plugin-kms Package: sftpgo-plugin-pubsub Package: sigstore-scaffolding-tsa-createcertchain Package: skaffold Package: skopeo Package: slsa-verifier Package: sops Package: spark-operator Package: spegel Package: spicedb Package: spicedb-operator Package: spire-server Package: sql_exporter Package: src Package: steampipe Package: step Package: step-ca Package: step-issuer Package: step-kms-plugin Package: syft Package: tailscale-k8s-operator Package: tekton-chains Package: tekton-pipelines-controller-1.11 Package: tekton-pipelines-controller-1.12 Package: tekton-pipelines-controller-1.13 Package: tekton-pipelines-entrypoint-1.11 Package: tekton-pipelines-entrypoint-1.12 Package: tekton-pipelines-entrypoint-1.13 Package: tekton-pipelines-events-1.11 Package: tekton-pipelines-events-1.12 Package: tekton-pipelines-events-1.13 Package: tekton-pipelines-resolvers-1.11 Package: tekton-pipelines-resolvers-1.12 Package: tekton-pipelines-resolvers-1.13 Package: tekton-pipelines-sidecarlogresults-1.11 Package: tekton-pipelines-sidecarlogresults-1.12 Package: tekton-pipelines-sidecarlogresults-1.13 Package: tekton-pipelines-webhook-1.11 Package: tekton-pipelines-webhook-1.12 Package: tekton-pipelines-webhook-1.13 Package: telegraf-1.38 Package: tempo-2.10 Package: tempo-2.10-cli Package: tempo-2.10-vulture Package: tempo-3.0 Package: tempo-3.0-cli Package: tempo-3.0-vulture Package: temporal Package: terraform Package: terraform-provider-google Package: terraform-provider-grafana Package: tetra Package: tetragon Package: tflint Package: tfsec Package: thanos Package: timestamp-authority-cli Package: timestamp-authority-server Package: tkn Package: traefik-3.6 Package: traefik-3.7 Package: trillian-logserver Package: trillian-logsigner Package: trivy Package: trivy-operator Package: trufflehog Package: undock Package: vault-benchmark Package: vault-env Package: vault-secrets-webhook Package: vcluster Package: vcluster-cli Package: vcluster-syncer Package: velero Package: verticadb-operator Package: vexctl Package: victoriametrics-operator Package: vitess-23 Package: vitess-23-binaries Package: vitess-24 Package: vitess-24-binaries Package: wal-g-pg Package: weaviate Package: witness Package: xeol Package: yunikorn-k8shim Package: zot Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0.

Affected products

VendorProductAffectedFixed
open-telemetry opentelemetry-go >= 1.5.0, < 1.45.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-opentelemetry-otel No fix yet —
Debian 13 golang-opentelemetry-otel No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-opentelemetry-otel No fix yet —
Ubuntu 26.04 LTS golang-opentelemetry-otel No fix yet —
Ubuntu 24.04 LTS golang-opentelemetry-otel No fix yet —
Ubuntu 22.04 LTS golang-opentelemetry-otel No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 helm 4.3.0-160000.2.1 SUSE-SU-2026:24247-1
SLES 16.0 helm 4.3.0-160000.2.1 SUSE-SU-2026:24247-1
SLE Micro 6.2 helm 4.3.0-160000.2.1 SUSE-SU-2026:24120-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.1 helm 4.3.0-slfo.1.1_1.1 SUSE-SU-2026:24282-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed helm 4.3.0-4.1 openSUSE-SU-2026:11963-1
openSUSE Tumbleweed velero 1.18.4-1.1 openSUSE-SU-2026:11931-1
openSUSE Leap 16.0 helm 4.3.0-160000.2.1 openSUSE-SU-2026:22057-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 containerd +1 2.3.7-1.amzn2023.0.1 ALAS2023-2026-3273
Amazon Linux 2023 docker 25.0.18-1.amzn2023.0.1 ALAS2023-2026-3266

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 azurelinux-image-tools 1.7.0-2 —
Azure Linux 3 cert-manager 1.12.15-15 —
Azure Linux 3 containerd2 2.3.7-1 —
Azure Linux 3 docker-buildx 0.14.0-19 —
Azure Linux 3 docker-compose 2.27.0-16 —
Azure Linux 3 etcd 3.5.35-1 —
Azure Linux 3 flannel 0.24.2-34 —
Azure Linux 3 kata-containers 4.1.0.kata1-2 —
Azure Linux 3 kata-containers-cc 3.15.0.aks0-23 —
Azure Linux 3 kube-vip-cloud-provider 0.0.10-11 —
Azure Linux 3 moby-containerd-cc 1.7.7-19 —
Azure Linux 3 opa +9 No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aactl 0.4.12-r77 —
Wolfi rolling act 0.2.89-r11 —
Wolfi rolling addon-resizer 1.8.24-r6 —
Wolfi rolling amazon-cloudwatch-agent 1.300073.1-r1 —
Wolfi rolling amazon-cloudwatch-agent-operator 3.7.0-r7 —
Wolfi rolling apisix-ingress-controller 2.2.0-r6 —
Wolfi rolling argo-cd-3.2 +1 3.2.12-r19 —
Wolfi rolling argo-cd-3.3 +1 3.3.14-r10 —
Wolfi rolling argo-cd-3.4 +1 3.4.9-r1 —
Wolfi rolling argo-events 1.9.11-r12 —
Wolfi rolling argo-rollouts +1 1.10.0-r3 —
Wolfi rolling argo-workflows-3.7 +1 3.7.18-r8 —
Wolfi rolling argocd-image-updater 1.3.0-r10 —
Wolfi rolling aws-efs-csi-driver 3.5.1-r1 —
Wolfi rolling aws-node-termination-handler 1.25.6-r20 —
Wolfi rolling aws-otel-collector 0.50.0-r4 —
Wolfi rolling aws-privateca-issuer 1.9.2-r1 —
Wolfi rolling azure-service-operator 2.21.1-r1 —
Wolfi rolling azure-workload-identity-webhook 1.6.3-r2 —
Wolfi rolling azuredisk-csi-1.34 1.34.6-r1 —
Wolfi rolling bank-vaults +1 1.33.2-r4 —
Wolfi rolling bento 1.21.2-r1 —
Wolfi rolling boring-registry 0.19.0-r8 —
Wolfi rolling buildah 1.45.1-r1 —
Wolfi rolling caddy 2.11.4-r14 —
Wolfi rolling cadvisor 0.60.6-r1 —
Wolfi rolling calico-apiserver-3.31 +1 3.31.7-r4 —
Wolfi rolling calico-apiserver-3.32 +1 3.32.2-r4 —
Wolfi rolling cert-manager-1.20 +2 1.20.4-r1 —
Wolfi rolling cert-manager-cmctl 2.6.1-r2 —
Wolfi rolling cert-manager-csi-driver 0.16.0-r8 —
Wolfi rolling cert-manager-istio-csr 0.17.0-r6 —
Wolfi rolling cert-manager-webhook-pdns 2.5.5-r26 —
Wolfi rolling certificate-transparency-trillian-ctserver 1.3.3-r23 —
Wolfi rolling chartmuseum 0.16.6-r7 —
Wolfi rolling cilium-1.19 +4 1.19.8-r1 —
Wolfi rolling clickhouse-operator +1 0.27.3-r5 —
Wolfi rolling cloud-provider-aws-1.35-cloud-controller-manager 1.35.2-r17 —
Wolfi rolling cloud-provider-aws-1.36-cloud-controller-manager 1.36.1-r9 —
Wolfi rolling cloud-provider-azure-cloud-node-manager-1.35 +1 1.35.9-r1 —
Wolfi rolling cloud-provider-azure-cloud-node-manager-1.36 +1 1.36.6-r1 —
Wolfi rolling cloud-provider-gcp-cloud-controller-manager 35.0.5-r23 —
Wolfi rolling cloud-provider-vsphere 1.37.0-r4 —
Wolfi rolling cloud-sql-proxy-2.16 2.16.0-r34 —
Wolfi rolling cloud-sql-proxy-2.21 2.21.3-r17 —
Wolfi rolling cloud-sql-proxy-2.22 2.22.1-r10 —
Wolfi rolling cloud-sql-proxy-2.23 2.23.0-r10 —
Wolfi rolling cloud-sql-proxy-2.24 2.24.1-r7 —
Wolfi rolling cloud-sql-proxy-2.25 2.25.4-r3 —
Wolfi rolling cloudflared 2026.9.1-r1 —
Wolfi rolling cloudprober 0.14.5-r4 —
Wolfi rolling cluster-api-1.12-controller +3 1.12.11-r6 —
Wolfi rolling cluster-api-1.13-controller +3 1.13.6-r2 —
Wolfi rolling cluster-api-aws-controller 2.13.0-r7 —
Wolfi rolling cluster-api-gcp-controller 1.13.1-r7 —
Wolfi rolling cluster-api-helm-controller 0.6.4-r21 —
Wolfi rolling cluster-api-ipam-provider-in-cluster 1.1.1-r1 —
Wolfi rolling cluster-api-provider-vsphere 1.17.0-r3 —
Wolfi rolling cluster-autoscaler-1.35 1.35.2-r10 —
Wolfi rolling consul-k8s-1.9 +1 1.9.12-r1 —
Wolfi rolling containerd-2.3 2.3.5-r3 —
Wolfi rolling coredns-1.14 1.14.7-r6 —
Wolfi rolling cortex 1.21.1-r15 —
Wolfi rolling cosign-3 3.1.3-r7 —
Wolfi rolling crossplane-2.2 +1 2.2.6-r1 —
Wolfi rolling crossplane-provider-keycloak 3.1.0-r1 —
Wolfi rolling crossplane-provider-sql 0.16.1-r7 —
Wolfi rolling ctr-1 +2 1.7.36-r1 —
Wolfi rolling dagdotdev 0.0.20-r31 —
Wolfi rolling dagger 0.21.9-r2 —
Wolfi rolling dapr-daprd-1.17 +5 1.17.14-r1 —
Wolfi rolling datadog-operator 1.30.0-r2 —
Wolfi rolling db-operator 2.43.0-r1 —
Wolfi rolling dbmate 2.36.0-r1 —
Wolfi rolling descheduler 0.36.0-r15 —
Wolfi rolling dex 2.45.1-r27 —
Wolfi rolling dgraph 25.4.1-r5 —
Wolfi rolling distribution +1 3.1.1-r16 —
Wolfi rolling dive 0.13.1-r26 —
Wolfi rolling docker-machine-driver-harvester 1.0.9-r1 —
Wolfi rolling dockerd-28 28.5.2-r39 —
Wolfi rolling dogstatsd-7.78 +3 7.78.4-r21 —
Wolfi rolling dogstatsd-7.80 +3 7.80.4-r18 —
Wolfi rolling dogstatsd-7.81 +3 7.81.3-r7 —
Wolfi rolling eksctl 0.230.0-r9 —
Wolfi rolling emissary +1 4.1.0-r17 —
Wolfi rolling envoy-ratelimit 0.0.0_git20260825-r3 —
Wolfi rolling etcd-3.6 3.6.14-r9 —
Wolfi rolling external-dns-0.21 0.21.0-r26 —
Wolfi rolling external-secrets-operator-2.3 2.3.0-r24 —
Wolfi rolling external-secrets-operator-2.4 2.4.1-r21 —
Wolfi rolling external-secrets-operator-2.5 2.5.0-r18 —
Wolfi rolling external-secrets-operator-2.6 2.6.0-r14 —
Wolfi rolling falco-no-driver 0.44.1-r11 —
Wolfi rolling falcoctl 0.14.2-r1 —
Wolfi rolling falcosidekick 2.35.0-r5 —
Wolfi rolling ferretdb 2.7.0-r32 —
Wolfi rolling fluent-operator 3.10.0-r5 —
Wolfi rolling flux-2.7 2.7.5-r40 —
Wolfi rolling flux-2.8 2.8.8-r23 —
Wolfi rolling flux-2.9 2.9.5-r5 —
Wolfi rolling flux-helm-controller 1.6.4-r5 —
Wolfi rolling flux-image-automation-controller 1.2.5-r5 —
Wolfi rolling flux-image-reflector-controller 1.2.5-r6 —
Wolfi rolling flux-kustomize-controller 1.9.5-r3 —
Wolfi rolling flux-notification-controller 1.9.4-r5 —
Wolfi rolling flux-source-controller 1.9.5-r6 —
Wolfi rolling flyte 1.16.8-r9 —
Wolfi rolling fulcio 1.8.8-r7 —
Wolfi rolling gatekeeper-3.22 +1 3.22.2-r20 —
Wolfi rolling gatus 5.37.0-r1 —
Wolfi rolling gcp-compute-persistent-disk-csi-driver-1.25 1.25.2-r19 —
Wolfi rolling gcsfuse 2.12.2-r37 —
Wolfi rolling gh 2.101.0-r1 —
Wolfi rolling gitlab-docker-machine-19.3 19.3.3-r2 —
Wolfi rolling gitlab-kas-19.2 19.2.6-r2 —
Wolfi rolling gitlab-pages-19.2 19.2.7-r1 —
Wolfi rolling gitlab-pages-19.3 19.3.3-r1 —
Wolfi rolling gitlab-runner-19.2 +1 19.2.6-r1 —
Wolfi rolling gitness 3.3.0-r39 —
Wolfi rolling gitsign +1 0.17.1-r9 —
Wolfi rolling go-discover 0_git20260915-r1 —
Wolfi rolling gogatekeeper 5.0.0-r1 —
Wolfi rolling gomplate-5 5.2.0-r11 —
Wolfi rolling goreleaser 2.18.2-r1 —
Wolfi rolling gptscript 0.9.9-r448 —
Wolfi rolling grafana-12.3 12.3.11-r8 —
Wolfi rolling grafana-12.4 12.4.11-r2 —
Wolfi rolling grafana-13.0 13.0.9-r2 —
Wolfi rolling grafana-agent-operator 0.44.8-r20 —
Wolfi rolling grafana-alloy 1.19.2-r6 —
Wolfi rolling grafana-image-renderer 5.12.3-r2 —
Wolfi rolling grafana-mimir-3.0 +3 3.0.9-r5 —
Wolfi rolling grafana-mimir-3.1 +3 3.1.6-r1 —
Wolfi rolling grafana-operator 5.25.0-r2 —
Wolfi rolling grafana-pyroscope-1.19 1.19.3-r17 —
Wolfi rolling grafana-pyroscope-2.0 2.0.6-r8 —
Wolfi rolling grpcurl 1.9.4-r2 —
Wolfi rolling grype 0.118.0-r5 —
Wolfi rolling guac +3 1.1.0-r35 —
Wolfi rolling harbor-2.14 +3 2.14.4-r14 —
Wolfi rolling harbor-cli 0.0.26-r4 —
Wolfi rolling headlamp 0.45.0-r7 —
Wolfi rolling helm-operator 1.42.3-r17 —
Wolfi rolling hubble 1.19.4-r19 —
Wolfi rolling hydra 26.2.0-r27 —
Wolfi rolling ipfs-cluster 1.1.6-r19 —
Wolfi rolling jaeger-operator 1.65.0-r30 —
Wolfi rolling jitsucom-bulker-bulker +1 2.15.0-r5 —
Wolfi rolling juicefs-1.3 1.3.3-r9 —
Wolfi rolling k3s-1.32 +9 No fix yet —
Wolfi rolling k3s-1.34 +1 1.34.11.1-r5 —
Wolfi rolling k3s-1.35 +1 1.35.8.1-r7 —
Wolfi rolling k6 2.2.0-r7 —
Wolfi rolling k8s_gateway 1.8.2-r12 —
Wolfi rolling k8sgpt 0.4.39-r2 —
Wolfi rolling k9s 0.51.0-r21 —
Wolfi rolling kafka-proxy 0.4.3-r32 —
Wolfi rolling kaniko 1.25.19-r6 —
Wolfi rolling kapp 0.65.4-r2 —
Wolfi rolling kapp-controller 0.60.8-r1 —
Wolfi rolling keda-2.19 +1 2.19.0-r32 —
Wolfi rolling keda-2.20 +2 2.20.2-r9 —
Wolfi rolling kiali 2.32.0-r1 —
Wolfi rolling kine 0.17.1-r1 —
Wolfi rolling knative-client 1.23.0-r6 —
Wolfi rolling knative-eventing-1.21-filter +7 1.21.4-r11 —
Wolfi rolling knative-eventing-1.22-filter +7 1.22.2-r9 —
Wolfi rolling knative-operator-1.21 +1 1.21.4-r9 —
Wolfi rolling knative-operator-1.22 +1 1.22.3-r9 —
Wolfi rolling knative-serving-1.21-queue +5 1.21.3-r8 —
Wolfi rolling knative-serving-1.22-queue +5 1.22.1-r14 —
Wolfi rolling ko +1 0.19.1-r9 —
Wolfi rolling kots 1.132.0-r0 —
Wolfi rolling kpt 1.0.1-r1 —
Wolfi rolling kserve-agent +4 0.20.0-r10 —
Wolfi rolling kserve-modelmesh-serving 0.12.0-r44 —
Wolfi rolling ksops 4.5.1-r18 —
Wolfi rolling kube-metrics-adapter 0.2.9-r22 —
Wolfi rolling kube-rbac-proxy 0.22.1-r13 —
Wolfi rolling kube-state-metrics 2.20.0-r5 —
Wolfi rolling kube-vip-cloud-provider 0.0.12-r33 —
Wolfi rolling kubeadm-1.34 +6 1.34.11-r9 —
Wolfi rolling kubeadm-1.35 +6 1.35.8-r8 —
Wolfi rolling kubeflow-pipelines-apiserver +3 2.17.2-r5 —
Wolfi rolling kubeflow-profile-controller 1.10.0-r38 —
Wolfi rolling kubelet-1.36 +5 1.36.4-r10 —
Wolfi rolling kubelet-1.37 +5 1.37.0-r1 —
Wolfi rolling kuberay-operator 1.7.1-r1 —
Wolfi rolling kubernetes-csi-driver-hostpath 1.18.0-r8 —
Wolfi rolling kubernetes-csi-driver-nfs 4.13.4-r9 —
Wolfi rolling kubernetes-csi-external-provisioner 6.3.0-r12 —
Wolfi rolling kubernetes-csi-external-resizer 2.2.1-r13 —
Wolfi rolling kubernetes-csi-external-snapshotter-8.5 +1 8.5.0-r30 —
Wolfi rolling kubernetes-csi-external-snapshotter-8.6 +1 8.6.0-r15 —
Wolfi rolling kubernetes-csi-node-driver-registrar-2.16 2.16.0-r30 —
Wolfi rolling kubernetes-csi-node-driver-registrar-2.17 2.17.0-r12 —
Wolfi rolling kubernetes-dns-node-cache 1.26.8-r21 —
Wolfi rolling kubernetes-event-exporter 1.7-r75 —
Wolfi rolling kubescape 4.0.14-r2 —
Wolfi rolling kubescape-operator 0.2.172-r3 —
Wolfi rolling kubevela-vela-cli +1 1.11.0-r16 —
Wolfi rolling kuma-cp-2.12 +1 2.12.3-r27 —
Wolfi rolling kuma-cp-2.13 +1 2.13.11-r1 —
Wolfi rolling kwok 0.8.0-r11 —
Wolfi rolling kyverno-1.17 +5 1.17.2-r36 —
Wolfi rolling kyverno-1.18 +5 1.18.2-r16 —
Wolfi rolling kyverno-notation-aws 1.1-r81 —
Wolfi rolling lazydocker 0.25.2-r12 —
Wolfi rolling linkerd2-controller 26.9.3-r1 —
Wolfi rolling litestream 0.5.17-r4 —
Wolfi rolling local-static-provisioner +1 2.9.0-r5 —
Wolfi rolling loki-3.6 +3 3.6.17-r1 —
Wolfi rolling loki-3.7 +3 3.7.8-r1 —
Wolfi rolling manifest-tool 2.2.2-r18 —
Wolfi rolling mcp-grafana 1.6.2-r0 —
Wolfi rolling mesosphere-vsphere-csi-driver 3.5.0-r32 —
Wolfi rolling metallb +4 0.16.1-r13 —
Wolfi rolling metrics-server 0.9.0-r12 —
Wolfi rolling migrate 4.20.1-r2 —
Wolfi rolling minio 0.20260717.120751-r16 —
Wolfi rolling net-kourier-1.21 1.21.1-r17 —
Wolfi rolling net-kourier-1.22 1.22.1-r15 —
Wolfi rolling neuvector-scanner +1 4.292-r1 —
Wolfi rolling neuvector-sigstore-interface 4.290-r1 —
Wolfi rolling newrelic-infrastructure-agent 1.80.5-r1 —
Wolfi rolling node-feature-discovery-0.18 0.18.3-r30 —
Wolfi rolling node-problem-detector-1.35 1.35.3-r10 —
Wolfi rolling node-problem-detector-1.36 1.36.0-r11 —
Wolfi rolling nuclei 3.11.1-r9 —
Wolfi rolling octo-sts +1 0.10.0-r1 —
Wolfi rolling op-geth 1.101702.3-r4 —
Wolfi rolling openbao 2.6.2-r6 —
Wolfi rolling opencost 1.121.3-r1 —
Wolfi rolling opensearch-k8s-operator 3.0.0-r1 —
Wolfi rolling opentofu-1.11 1.11.14-r7 —
Wolfi rolling opentofu-1.12 1.12.6-r8 —
Wolfi rolling opentofu-1.9 1.9.4-r32 —
Wolfi rolling otel-cli 0.4.5-r36 —
Wolfi rolling percona-server-mongodb-operator 1.23.0-r9 —
Wolfi rolling pg_timetable 7.1.0-r4 —
Wolfi rolling podman-6.0 6.0.2-r9 —
Wolfi rolling policy-controller +1 0.15.1-r28 —
Wolfi rolling prometheus-3.10 3.10.0-r24 —
Wolfi rolling prometheus-3.11 3.11.3-r18 —
Wolfi rolling prometheus-3.12 3.12.0-r14 —
Wolfi rolling prometheus-adapter 0.12.0-r38 —
Wolfi rolling prometheus-alertmanager 0.34.1-r1 —
Wolfi rolling prometheus-operator 0.94.0-r1 —
Wolfi rolling promxy 0.0.97-r2 —
Wolfi rolling pulumi-kubernetes-operator 2.9.1-r3 —
Wolfi rolling rancher-2.13 2.13.9-r8 —
Wolfi rolling rancher-2.14 +1 2.14.5-r7 —
Wolfi rolling rancher-agent-2.13 2.13.9-r5 —
Wolfi rolling rancher-fleet-cli +3 0.16.2-r1 —
Wolfi rolling rancher-machine 0.15.0.145-r10 —
Wolfi rolling rancher-system-agent 0.15.1-r4 —
Wolfi rolling rancher-webhook-0.10 0.10.12-r1 —
Wolfi rolling ratify +5 1.4.5-r5 —
Wolfi rolling redis-operator 0.26.0-r10 —
Wolfi rolling rekor-server 1.5.4-r6 —
Wolfi rolling rke2-cloud-provider 1.36.4-r2 —
Wolfi rolling scorecard 5.5.0-r23 —
Wolfi rolling secrets-store-csi-driver 1.6.1-r1 —
Wolfi rolling secrets-store-csi-driver-provider-azure 1.8.2-r10 —
Wolfi rolling sftpgo 2.7.5-r13 —
Wolfi rolling sftpgo-plugin-kms 1.0.19-r11 —
Wolfi rolling sftpgo-plugin-pubsub 1.0.18-r10 —
Wolfi rolling sigstore-scaffolding-tsa-createcertchain 0.7.37-r8 —
Wolfi rolling skaffold 2.25.0-r1 —
Wolfi rolling skopeo 1.24.1-r1 —
Wolfi rolling slsa-verifier 2.7.1-r34 —
Wolfi rolling sops 3.13.3-r7 —
Wolfi rolling spark-operator 2.5.2-r5 —
Wolfi rolling spegel 0.7.4-r13 —
Wolfi rolling spicedb 1.56.2-r2 —
Wolfi rolling spicedb-operator +1 1.27.0-r2 —
Wolfi rolling spire-server 1.15.3-r7 —
Wolfi rolling sql_exporter 0.24.8-r2 —
Wolfi rolling src 8.0.0-r1 —
Wolfi rolling steampipe 2.4.7-r1 —
Wolfi rolling step 0.31.0-r1 —
Wolfi rolling step-ca 0.30.2-r25 —
Wolfi rolling step-issuer 0.12.0-r13 —
Wolfi rolling step-kms-plugin 0.17.0-r19 —
Wolfi rolling syft 1.52.0-r1 —
Wolfi rolling tailscale-k8s-operator 1.102.4-r1 —
Wolfi rolling tekton-chains 0.29.5-r1 —
Wolfi rolling tekton-pipelines-events-1.11 +5 1.11.1-r21 —
Wolfi rolling tekton-pipelines-events-1.12 +5 1.12.2-r13 —
Wolfi rolling tekton-pipelines-events-1.13 +5 1.13.1-r10 —
Wolfi rolling telegraf-1.38 1.38.4-r29 —
Wolfi rolling tempo-2.10 +2 2.10.8-r6 —
Wolfi rolling tempo-3.0 +2 3.0.3-r7 —
Wolfi rolling temporal 1.9.1-r1 —
Wolfi rolling terraform 1.5.7-r63 —
Wolfi rolling terraform-provider-google 8.3.0-r1 —
Wolfi rolling terraform-provider-grafana 4.46.0-r1 —
Wolfi rolling tetra +1 1.7.1-r4 —
Wolfi rolling tflint 0.64.0-r8 —
Wolfi rolling tfsec 1.28.14-r51 —
Wolfi rolling thanos 0.42.4-r8 —
Wolfi rolling timestamp-authority-cli +1 2.1.3-r11 —
Wolfi rolling tkn 0.46.0-r8 —
Wolfi rolling traefik-3.6 3.6.25-r15 —
Wolfi rolling traefik-3.7 3.7.13-r1 —
Wolfi rolling trillian-logserver +1 1.7.3-r20 —
Wolfi rolling trivy 0.74.0-r8 —
Wolfi rolling trivy-operator 0.34.0-r6 —
Wolfi rolling trufflehog 3.97.5-r1 —
Wolfi rolling undock 0.14.0-r12 —
Wolfi rolling vault-benchmark 0.4.0-r29 —
Wolfi rolling vault-env 1.23.0-r13 —
Wolfi rolling vault-secrets-webhook 1.23.1-r12 —
Wolfi rolling vcluster +2 0.37.1-r1 —
Wolfi rolling velero 1.18.2-r11 —
Wolfi rolling verticadb-operator 25.4.0.0-r30 —
Wolfi rolling vexctl 0.4.4-r10 —
Wolfi rolling victoriametrics-operator 0.74.1-r7 —
Wolfi rolling vitess-23 +1 23.0.6-r6 —
Wolfi rolling vitess-24 +1 24.0.3-r8 —
Wolfi rolling wal-g-pg 3.0.9-r6 —
Wolfi rolling weaviate 1.39.5-r1 —
Wolfi rolling witness 0.12.0-r12 —
Wolfi rolling xeol 0.10.8-r63 —
Wolfi rolling yunikorn-k8shim 1.9.0-r8 —
Wolfi rolling zot 2.1.21-r3 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go go.opentelemetry.io/otel/exporters/otlp/otlptrace >= 1.5.0, < 1.45.0 1.45.0 GHSA-8wmf-6v46-5gfg
Go go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc >= 1.5.0, < 1.45.0 1.45.0 GHSA-8wmf-6v46-5gfg
Go go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp >= 1.5.0, < 1.45.0 1.45.0 GHSA-8wmf-6v46-5gfg
Go go.opentelemetry.io/otel/exporters/zipkin >= 1.5.0, < 1.45.0 1.45.0 GHSA-8wmf-6v46-5gfg
Go go.opentelemetry.io/otel/sdk >= 1.5.0, < 1.45.0 1.45.0 GHSA-8wmf-6v46-5gfg

Advisories 8

References