Critical Security Update for OpenTelemetry Collector: Multiple Vulnerabilities Addressed
Summary
ALSA-2026:19135: Important: opentelemetry-collector security update. Affects opentelemetry-collector versions < 0.144.0-2.el10_2. Fixed in 0.144.0-2.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenTelemetry Collector is a key component in the OpenTelemetry framework, designed to facilitate the collection, processing, and exporting of telemetry data such as metrics and logs. It supports various data sources and sinks, making it a versatile tool for observability in cloud-native applications. However, recent vulnerabilities have been identified that could compromise its security and functionality, particularly in the AlmaLinux ecosystem.
Vulnerability Detail
The vulnerabilities in OpenTelemetry Collector stem from multiple sources, including improper parsing of IPv6 host literals, authorization bypass in gRPC-Go, and denial of service attacks via crafted JSON Web Encryption objects. These issues can lead to severe consequences such as unauthorized access, service disruptions, and potential data breaches. Notably, the vulnerabilities are linked to various components, including net/url, crypto/x509, and crypto/tls, each presenting unique risks that could be exploited by malicious actors.
How To Fix
Minimum fixed version
0.144.0-2.el10_2
This is the first release that contains the fix.
sudo dnf update opentelemetry-collectorTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users may consider restricting access to the OpenTelemetry Collector service or implementing additional network security measures to mitigate the risk of exploitation until the package can be updated.
Conclusion
The recent vulnerabilities identified in OpenTelemetry Collector pose significant risks to users, particularly in the AlmaLinux ecosystem. It is crucial to update to the latest patched version to mitigate these risks and ensure the security and reliability of your applications.
See every vulnerability recorded for opentelemetry-collector →
FAQ
OpenTelemetry Collector is a tool that collects, processes, and exports telemetry data from various sources, aiding in observability for applications.
The vulnerabilities include improper parsing of IPv6 addresses, authorization bypass in gRPC, and denial of service attacks related to JSON Web Encryption and certificate validation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If immediate updates are not possible, consider implementing network security measures and restricting access to the service as a temporary workaround.
For detailed information about the vulnerabilities, including CVSS scores and acknowledgments, refer to the CVE pages listed in the related section.
Related vulnerabilities
Recent vulnerabilities recorded for opentelemetry-collector.
