GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
6 advisories
OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
High
CVE-2026-47701
was published
for
github.com/open-telemetry/opentelemetry-operator
(Go)
Jun 10, 2026
Prometheus exporter process crash via malformed HTTP request
High
CVE-2026-44902
was published
for
@opentelemetry/auto-instrumentations-node
(npm)
May 11, 2026
OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR
High
CVE-2026-41433
was published
for
go.opentelemetry.io/obi
(Go)
Apr 17, 2026
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
High
CVE-2026-24051
was published
for
go.opentelemetry.io/otel/sdk
(Go)
Feb 2, 2026
Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC
High
CVE-2024-36129
was published
for
go.opentelemetry.io/collector/config/configgrpc
(Go)
Jun 5, 2024
OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics
High
CVE-2023-45142
was published
for
go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful
(Go)
Oct 16, 2023
ProTip!
Advisories are also available from the
GraphQL API