# Opentelemetry vulnerabilities Source: https://junglewise.ai/threats/vendors/opentelemetry Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/opentelemetry.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 52 vulnerabilities in Opentelemetry: 1 in the last 7 days and 15 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126360, was published on 13 November 2026. 4 vulnerabilities in the last four weeks, down 50% on the four before (8). 8 technologies have a page of their own. ## Counts - Last 7 days: 1 - Last 30 days: 5 - Last 90 days: 15 - All time: 52 (1 critical, 0 exploited in the wild) ## About Opentelemetry Open standard for observability that defines APIs and SDKs for distributed tracing, metrics, and logging. ## Latest Opentelemetry vulnerabilities - [CVE-2026-126360: OpenTelemetry Python ReDoS in traceparent parsing](https://junglewise.ai/threats/cve-2026-126360-opentelemetry-python-provides-the-python-api-and-sdk-for) (medium, CVSS 5.3, published 13 Nov 2026) - [CVE-2026-118259: OpenTelemetry Java regex backtracking in W3CTraceContextPropagator](https://junglewise.ai/threats/cve-2026-118259-opentelemetry-java-is-the-java-implementation-of-the) (medium, CVSS 5.3, published 28 Oct 2026) - [CVE-2026-116694: OpenTelemetry JaegerPropagator denial of service via unbounded baggage](https://junglewise.ai/threats/cve-2026-116694-opentelemetry-python-provides-the-python-api-and-sdk-for) (medium, CVSS 4, published 27 Oct 2026) - [CVE-2026-114603: OpenTelemetry Python ReDoS in W3C tracestate parsing](https://junglewise.ai/threats/cve-2026-114603-opentelemetry-python-provides-the-python-api-and-sdk-for) (medium, CVSS 5.3, published 22 Oct 2026) - [CVE-2026-112006: OpenTelemetry opentelemetry-exporter-otlp-proto-http TLS certificate validation bypass](https://junglewise.ai/threats/cve-2026-112006-opentelemetry-opentelemetry-exporter-otlp-proto-http-1-5-0) (medium, CVSS 6.5, published 18 Oct 2026) - [CVE-2026-104872: OpenTelemetry JavaScript Contrib database credentials exposure in span attributes](https://junglewise.ai/threats/cve-2026-104872-opentelemetry-javascript-contrib-provides-instrumentation) (medium, CVSS 5.8, published 2 Oct 2026) - [CVE-2026-81872: OpenTelemetry-Go BatchingProcessor CPU exhaustion via log emission](https://junglewise.ai/threats/cve-2026-81872-opentelemetry-go-batchingprocessor-cpu-exhaustion-via-log) (medium, CVSS 4, published 16 Sep 2026) - [CVE-2026-81871: OpenTelemetry-Go OTLP log gRPC exporter TLS certificate validation bypass](https://junglewise.ai/threats/cve-2026-81871-opentelemetry-go-otlp-log-grpc-exporter-tls-certificate) (medium, CVSS 4, published 16 Sep 2026) - [CVE-2026-81869: OpenTelemetry-Go attribute truncation bypass with Unicode replacement character](https://junglewise.ai/threats/cve-2026-81869-opentelemetry-go-attribute-truncation-bypass-with-unicode) (medium, CVSS 4, published 16 Sep 2026) - [CVE-2026-81870: OpenTelemetry-Go endpoint URL logging in TracerProvider diagnostics](https://junglewise.ai/threats/cve-2026-81870-opentelemetry-go-endpoint-url-logging-in-tracerprovider) (medium, CVSS 4, published 16 Sep 2026) - [CVE-2026-55701: OpenTelemetry Collector githubreceiver auth bypass via missing header check](https://junglewise.ai/threats/cve-2026-55701-opentelemetry-collector-githubreceiver-auth-bypass-via-missing) (medium, CVSS 4, published 15 Sep 2026) - [CVE-2026-47256: OpenTelemetry Sentry Exporter path traversal via service.name](https://junglewise.ai/threats/cve-2026-47256-opentelemetry-sentry-exporter-path-traversal-via-service-name) (medium, CVSS 5.3, published 14 Sep 2026) - [CVE-2026-47701: OpenTelemetry Operator arbitrary file disclosure in TargetAllocator](https://junglewise.ai/threats/cve-2026-47701-opentelemetry-operator-arbitrary-file-disclosure-in) (high, CVSS 7.7, published 14 Sep 2026) - [CVE-2026-48496: OpenTelemetry ebpf-profiler denial of service in processPIDEvents](https://junglewise.ai/threats/cve-2026-48496-opentelemetry-ebpf-profiler-denial-of-service-in-processpidevents) (medium, CVSS 6.2, published 11 Sep 2026) - [CVE-2026-45404: OpenTelemetry-Go unsynchronized baggage map race condition](https://junglewise.ai/threats/cve-2026-45404-opentelemetry-go-unsynchronized-baggage-map-race-condition) (medium, CVSS 4, published 24 Aug 2026) - [CVE-2026-59892: OpenTelemetry opentelemetry-js denial of service in JaegerPropagator](https://junglewise.ai/threats/cve-2026-59892-opentelemetry-opentelemetry-js-denial-of-service-in) (high, CVSS 7.5, published 8 Jul 2026) - [CVE-2026-54712: OpenTelemetry Java Instrumentation DoS in RMI context propagation](https://junglewise.ai/threats/cve-2026-54712-opentelemetry-java-instrumentation-dos-in-rmi-context-propagation) (medium, CVSS 5.3, published 1 Jul 2026) - [CVE-2026-54704: OpenTelemetry Java Instrumentation information disclosure in JDBC auto-instrumentation](https://junglewise.ai/threats/cve-2026-54704-opentelemetry-java-instrumentation-information-disclosure-in-jdbc) (medium, CVSS 6.5, published 1 Jul 2026) - [CVE-2026-54285: OpenTelemetry opentelemetry-js unbounded memory allocation in W3C Baggage](https://junglewise.ai/threats/cve-2026-54285-opentelemetry-opentelemetry-js-unbounded-memory-allocation-in-w3c) (medium, CVSS 5.3, published 22 Jun 2026) - [CVE-2026-44967: OpenTelemetry-cpp memory exhaustion in OTLP HTTP exporters](https://junglewise.ai/threats/cve-2026-44967-opentelemetry-cpp-memory-exhaustion-in-otlp-http-exporters) (medium, CVSS 5.3, published 12 Jun 2026) - [CVE-2026-45287: OpenTelemetry-Go file descriptor leak in schema ParseFile](https://junglewise.ai/threats/cve-2026-45287-opentelemetry-go-file-descriptor-leak-in-schema-parsefile) (medium, CVSS 4, published 4 Jun 2026) - [CVE-2026-41178: OpenTelemetry-Go Denial of Service via oversized baggage headers](https://junglewise.ai/threats/cve-2026-41178-opentelemetry-go-denial-of-service-via-oversized-baggage-headers) (medium, CVSS 5.3, published 4 Jun 2026) - [CVE-2026-45686: OpenTelemetry eBPF Instrumentation integer overflow in Memcached parser](https://junglewise.ai/threats/cve-2026-45686-opentelemetry-ebpf-instrumentation-integer-overflow-in-memcached) (high, CVSS 7.5, published 2 Jun 2026) - [CVE-2026-45685: OpenTelemetry eBPF Instrumentation denial of service in MongoDB parser](https://junglewise.ai/threats/cve-2026-45685-opentelemetry-ebpf-instrumentation-denial-of-service-in-mongodb) (high, CVSS 7.5, published 2 Jun 2026) - [CVE-2026-45684: OpenTelemetry eBPF Instrumentation buffer over-read in log enricher](https://junglewise.ai/threats/cve-2026-45684-opentelemetry-ebpf-instrumentation-buffer-over-read-in-log) (medium, CVSS 4.9, published 2 Jun 2026) ## Most severe Opentelemetry vulnerabilities - [CVE-2026-33701: OpenTelemetry Java Instrumentation RCE via Unsafe Deserialization in RMI](https://junglewise.ai/threats/cve-2026-33701-opentelemetry-java-instrumentation-rce-via-unsafe-deserialization) (critical, CVSS 9.8, published 27 Mar 2026) - [CVE-2026-41433: OpenTelemetry eBPF Instrumentation arbitrary file overwrite in Java injector](https://junglewise.ai/threats/cve-2026-41433-opentelemetry-ebpf-instrumentation-privileged-java-agent) (high, CVSS 8.4, published 24 Apr 2026) - [CVE-2026-42602: OpenTelemetry azureauthextension authentication bypass via token replay](https://junglewise.ai/threats/cve-2026-42602-opentelemetry-azureauthextension-authentication-bypass-via-token) (high, CVSS 8.1, published 13 May 2026) - [CVE-2026-47701: OpenTelemetry Operator arbitrary file disclosure in TargetAllocator](https://junglewise.ai/threats/cve-2026-47701-opentelemetry-operator-arbitrary-file-disclosure-in) (high, CVSS 7.7, published 14 Sep 2026) - [CVE-2026-29181: OpenTelemetry OpenTelemetry-Go resource exhaustion in baggage header extraction](https://junglewise.ai/threats/cve-2026-29181-opentelemetry-opentelemetry-go-resource-exhaustion-in-baggage) (high, CVSS 7.5, published 7 Apr 2026) - [CVE-2026-59892: OpenTelemetry opentelemetry-js denial of service in JaegerPropagator](https://junglewise.ai/threats/cve-2026-59892-opentelemetry-opentelemetry-js-denial-of-service-in) (high, CVSS 7.5, published 8 Jul 2026) - [CVE-2026-45685: OpenTelemetry eBPF Instrumentation denial of service in MongoDB parser](https://junglewise.ai/threats/cve-2026-45685-opentelemetry-ebpf-instrumentation-denial-of-service-in-mongodb) (high, CVSS 7.5, published 2 Jun 2026) - [CVE-2026-45686: OpenTelemetry eBPF Instrumentation integer overflow in Memcached parser](https://junglewise.ai/threats/cve-2026-45686-opentelemetry-ebpf-instrumentation-integer-overflow-in-memcached) (high, CVSS 7.5, published 2 Jun 2026) - [CVE-2026-45678: OpenTelemetry OBI denial of service in Postgres protocol parser](https://junglewise.ai/threats/cve-2026-45678-opentelemetry-obi-denial-of-service-in-postgres-protocol-parser) (high, CVSS 7.5, published 2 Jun 2026) - [CVE-2026-44902: OpenTelemetry opentelemetry-js denial of service in Prometheus exporter](https://junglewise.ai/threats/cve-2026-44902-opentelemetry-opentelemetry-js-denial-of-service-in-prometheus) (high, CVSS 7.5, published 27 May 2026) ## Vulnerabilities per week 4 vulnerabilities in the last four weeks, down 50% on the four before (8). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 7 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 2 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 1 | 0 | 0 | ## Opentelemetry technologies - [Opentelemetry-Ebpf-Instrumentation](https://junglewise.ai/threats/technologies/ebpf-instrumentation): 11 vulnerabilities - [Opentelemetry](https://junglewise.ai/threats/technologies/opentelemetry): 8 vulnerabilities - [Opentelemetry-Go](https://junglewise.ai/threats/technologies/opentelemetry-go): 7 vulnerabilities - [Opentelemetry Otelhttp](https://junglewise.ai/threats/technologies/otelhttp): 6 vulnerabilities - [OpenTelemetry Go SDK](https://junglewise.ai/threats/technologies/go-sdk): 5 vulnerabilities - [Opentelemetry Java Instrumentation](https://junglewise.ai/threats/technologies/java-instrumentation): 3 vulnerabilities - [Opentelemetry-Javaagent](https://junglewise.ai/threats/technologies/opentelemetry-javaagent): 3 vulnerabilities - [Opentelemetry-Api](https://junglewise.ai/threats/technologies/opentelemetry-opentelemetry-api): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Opentelemetry vulnerabilities", https://junglewise.ai/threats/vendors/opentelemetry, 13 November 2026.