O
Vendor security profile
open-telemetry
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs14
Critical1
CISA KEV0
Public exploit7
Patch rate%21
Avg. CVSS6.2
12-month vulnerability rate
0
0
0
0
1
2
1
0
0
1
8
1
CVE KEV
CVE severity distribution
14toplam CVE
Critical1 (7%)
High3 (21%)
Medium9 (64%)
Low1 (7%)
Patch and exploitation view
%21
Verified patch
%0
CISA KEV
%50
Public exploit
3Patch available
0Partial
0Workaround
0Vendor: no patch
11Unknown
Latest vulnerabilities
5.8
CVE-2026-104872
Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
O
Patch status unknownEPSS %0
6.3
CVE-2026-81871
OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning
O
Patch status unknownEPSS %0
6.3
CVE-2026-81872
OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full
O
Patch status unknownEPSS %0
5.1
CVE-2026-81869
OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation
O
Patch status unknownEPSS %0
2.0
CVE-2026-81870
OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs
O
Patch status unknownEPSS %0
6.9
CVE-2026-55701
OpenTelemetry githubreceiver silently ignores configured required_headers authentication
O
Patch status unknownEPSS %1
5.3
CVE-2026-47256
OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token
O
Patch status unknownEPSS %0
7.7
CVE-2026-47701
OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
O
Patch status unknownEPSS %0
6.2
CVE-2026-48496
opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent
O
Patch status unknownEPSS %0
5.9
CVE-2026-45404
OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
O
Patch verifiedEPSS %0