Vendor
Opentelemetry vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 52 vulnerabilities in Opentelemetry: 1 in the last 7 days and 15 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126360, was published on 13 November 2026. 4 vulnerabilities in the last four weeks, down 50% on the four before (8). 8 technologies have a page of their own.
- Last 7 days
- 1
- Last 90 days
- 15
- Critical, all time
- 1
- Exploited in the wild
- 0
About Opentelemetry
Open standard for observability that defines APIs and SDKs for distributed tracing, metrics, and logging.
Opentelemetry technologies
Latest Opentelemetry vulnerabilities
- CVE-2026-126360: OpenTelemetry Python ReDoS in traceparent parsingmediumCVSS 5.3
- CVE-2026-118259: OpenTelemetry Java regex backtracking in W3CTraceContextPropagatormediumCVSS 5.3EPSS 0.5%
- CVE-2026-116694: OpenTelemetry JaegerPropagator denial of service via unbounded baggagemediumCVSS 4EPSS 0.4%
- CVE-2026-114603: OpenTelemetry Python ReDoS in W3C tracestate parsingmediumCVSS 5.3EPSS 0.5%
- CVE-2026-112006: OpenTelemetry opentelemetry-exporter-otlp-proto-http TLS certificate validation bypassmediumCVSS 6.5
- CVE-2026-104872: OpenTelemetry JavaScript Contrib database credentials exposure in span attributesmediumCVSS 5.8EPSS 0.2%
- CVE-2026-81872: OpenTelemetry-Go BatchingProcessor CPU exhaustion via log emissionmediumCVSS 4EPSS 0.4%
- CVE-2026-81871: OpenTelemetry-Go OTLP log gRPC exporter TLS certificate validation bypassmediumCVSS 4EPSS 0.3%
- CVE-2026-81869: OpenTelemetry-Go attribute truncation bypass with Unicode replacement charactermediumCVSS 4EPSS 0.2%
- CVE-2026-81870: OpenTelemetry-Go endpoint URL logging in TracerProvider diagnosticsmediumCVSS 4EPSS 0.2%
- CVE-2026-55701: OpenTelemetry Collector githubreceiver auth bypass via missing header checkmediumCVSS 4EPSS 0.7%
- CVE-2026-47256: OpenTelemetry Sentry Exporter path traversal via service.namemediumCVSS 5.3EPSS 0.4%
- CVE-2026-47701: OpenTelemetry Operator arbitrary file disclosure in TargetAllocatorhighCVSS 7.7EPSS 0.5%
- CVE-2026-48496: OpenTelemetry ebpf-profiler denial of service in processPIDEventsmediumCVSS 6.2EPSS 0.2%
- CVE-2026-45404: OpenTelemetry-Go unsynchronized baggage map race conditionmediumCVSS 4EPSS 0.1%
- CVE-2026-59892: OpenTelemetry opentelemetry-js denial of service in JaegerPropagatorhighCVSS 7.5EPSS 0.8%
- CVE-2026-54712: OpenTelemetry Java Instrumentation DoS in RMI context propagationmediumCVSS 5.3EPSS 0.5%
- CVE-2026-54704: OpenTelemetry Java Instrumentation information disclosure in JDBC auto-instrumentationmediumCVSS 6.5EPSS 0.4%
- CVE-2026-54285: OpenTelemetry opentelemetry-js unbounded memory allocation in W3C BaggagemediumCVSS 5.3EPSS 0.4%
- CVE-2026-44967: OpenTelemetry-cpp memory exhaustion in OTLP HTTP exportersmediumCVSS 5.3EPSS 0.0%
- CVE-2026-45287: OpenTelemetry-Go file descriptor leak in schema ParseFilemediumCVSS 4EPSS 0.2%
- CVE-2026-41178: OpenTelemetry-Go Denial of Service via oversized baggage headersmediumCVSS 5.3EPSS 0.3%
- CVE-2026-45686: OpenTelemetry eBPF Instrumentation integer overflow in Memcached parserhighCVSS 7.5EPSS 0.5%
- CVE-2026-45685: OpenTelemetry eBPF Instrumentation denial of service in MongoDB parserhighCVSS 7.5EPSS 0.6%
- CVE-2026-45684: OpenTelemetry eBPF Instrumentation buffer over-read in log enrichermediumCVSS 4.9EPSS 0.2%
Most severe Opentelemetry vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-33701: OpenTelemetry Java Instrumentation RCE via Unsafe Deserialization in RMIcriticalCVSS 9.8EPSS 1.1%
- CVE-2026-41433: OpenTelemetry eBPF Instrumentation arbitrary file overwrite in Java injectorhighCVSS 8.4EPSS 0.2%
- CVE-2026-42602: OpenTelemetry azureauthextension authentication bypass via token replayhighCVSS 8.1EPSS 0.3%
- CVE-2026-47701: OpenTelemetry Operator arbitrary file disclosure in TargetAllocatorhighCVSS 7.7EPSS 0.5%
- CVE-2026-29181: OpenTelemetry OpenTelemetry-Go resource exhaustion in baggage header extractionhighCVSS 7.5EPSS 0.9%
- CVE-2026-59892: OpenTelemetry opentelemetry-js denial of service in JaegerPropagatorhighCVSS 7.5EPSS 0.8%
- CVE-2026-45685: OpenTelemetry eBPF Instrumentation denial of service in MongoDB parserhighCVSS 7.5EPSS 0.6%
- CVE-2026-45686: OpenTelemetry eBPF Instrumentation integer overflow in Memcached parserhighCVSS 7.5EPSS 0.5%
- CVE-2026-45678: OpenTelemetry OBI denial of service in Postgres protocol parserhighCVSS 7.5EPSS 0.5%
- CVE-2026-44902: OpenTelemetry opentelemetry-js denial of service in Prometheus exporterhighCVSS 7.5EPSS 0.5%
Vulnerabilities per week
4 vulnerabilities in the last four weeks, down 50% on the four before (8). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 1 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 1 | 0 | |
| 14 Sep 2026 | 7 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 1 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 1 | 0 | |
| 19 Oct 2026 | 1 | 0 | |
| 26 Oct 2026 | 2 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 1 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Opentelemetry vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/opentelemetry)<a href="https://junglewise.ai/threats/vendors/opentelemetry"><img src="https://junglewise.ai/threats/vendors/opentelemetry/badge.svg" alt="Opentelemetry vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/opentelemetry.json, and this page as text at https://junglewise.ai/threats/vendors/opentelemetry.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Opentelemetry vulnerabilities", https://junglewise.ai/threats/vendors/opentelemetry, 13 November 2026.