Security: open-telemetry/opentelemetry-collector-contrib
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
[Dependency CVE-2026-2303] Heap Out-of-Bounds Read in go.mongodb.org/mongo-driver/v2 via GSSAPI Bindings in otelcol-contribGHSA-j39g-cqwj-9xvf published
Jun 24, 2026 by jmacdModerate -
Collector Prometheus receiver currently depends on Prometheus v0.311.2, which is vulnerable to CVE-2026-42151 and CVE-2026-42154GHSA-8hxm-mxr2-qf9h published
Jun 8, 2026 by jack-bergHigh -
azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replayGHSA-pjv4-3c63-699f published
Apr 29, 2026 by jmacdHigh -
Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer tokenGHSA-4jvg-4jfx-fmhc published
Jun 17, 2026 by jmacdModerate -
githubreceiver silently ignores configured required_headers authenticationGHSA-w5cv-pw74-4rxc published
Jun 15, 2026 by jmacdModerate -
AWS Firehose Receiver Authentication Bypass VulnerabilityGHSA-prf6-xjxh-p698 published
Aug 28, 2024 by arminruModerate -
Observable Timing Discrepancy in github.com/open-telemetry/opentelemetry-collector-contrib/extension/bearertokenauthextensionGHSA-rfxf-mf63-cpqv published
Aug 13, 2024 by arminruModerate