en
OpenTelemetry is a vendor-neutral, open-source observability framework and CNCF graduated project for cloud-native software. It defines standards and provides APIs, SDKs, automatic instrumentation, and collector services for generating, collecting, processing, and exporting traces, metrics, and logs.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
As of 10/20/2026, open-telemetry recorded 11 security vulnerabilities in the last 90 days across 8 products, including 2 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, opentelemetry-go had the most security vulnerabilities in the open-telemetry ecosystem, with 5 vulnerabilities—approximately 45.45% of the provider's total vulnerabilities during this period.
CVE-2026-104872Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attributeCVE-2026-81871OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinningCVE-2026-81872OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is fullCVE-2026-81869OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncationCVE-2026-81870OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs59 Results | Page 1 of 6
| SeverityMedium |
| SeverityMedium |
| SeverityMedium |
| SeverityLow |
| SeverityMedium |
| SeverityMedium |
| SeverityHigh |
| SeverityMedium |
| SeverityHigh |