opentelemetry-operator
Technical details about the ‘opentelemetry-operator’ component.
Generated on: 2026-10-23
Software Bill of Materials
Dependencies (Image)
| Dependency | Version | License | Vulnerabilities | Severity | Status |
|---|---|---|---|---|---|
| google.golang.org/grpc | v1.71.0 | Unknown | CVE-2026-33186 (google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation) | CRITICAL | fixed (in 1.79.3) |
| github.com/docker/docker | v27.4.1+incompatible | Unknown | CVE-2026-41567 (docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload) | HIGH | affected (in Not specified) |
| github.com/open-telemetry/opentelemetry-operator | v0.125.0 | Unknown | CVE-2026-47701 (opentelemetry-operator: OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth) | HIGH | fixed (in 0.152.0) |
| github.com/prometheus/prometheus | v0.301.0 | Unknown | CVE-2026-42151 (github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API) | HIGH | fixed (in 0.311.3) |
| go.opentelemetry.io/otel/sdk | v1.35.0 | Unknown | CVE-2026-24051 (opentelemetry-go: OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking) | HIGH | fixed (in 1.40.0) |
| golang.org/x/crypto | v0.36.0 | Unknown | CVE-2025-47913 (golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS) | HIGH | fixed (in 0.43.0) |
| golang.org/x/net | v0.38.0 | Unknown | CVE-2026-25681 (golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting) | HIGH | fixed (in 0.55.0) |
| golang.org/x/text | v0.23.0 | Unknown | CVE-2026-56851 (golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile) | HIGH | fixed (in 0.41.0) |
| go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc | v0.11.0 | Unknown | CVE-2026-81871 (go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration) | MEDIUM | fixed (in 0.21.0) |
| go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp | v0.11.0 | Unknown | CVE-2026-39882 (github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Memory exhaustion via uncapped HTTP response body reading) | MEDIUM | fixed (in 0.19.0) |
| go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp | v1.35.0 | Unknown | CVE-2026-39882 (github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Memory exhaustion via uncapped HTTP response body reading) | MEDIUM | fixed (in 1.43.0) |
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp | v1.35.0 | Unknown | CVE-2026-39882 (github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Memory exhaustion via uncapped HTTP response body reading) | MEDIUM | fixed (in 1.43.0) |
| go.opentelemetry.io/otel/sdk/log | v0.11.0 | Unknown | CVE-2026-81872 (go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission) | MEDIUM | fixed (in 0.21.0) |
| go.opentelemetry.io/otel/exporters/otlp/otlptrace | v1.35.0 | Unknown | CVE-2026-81870 (github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging) | LOW | fixed (in 1.45.0) |
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc | v1.35.0 | Unknown | CVE-2026-81870 (github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging) | LOW | fixed (in 1.45.0) |
| cloud.google.com/go/auth | v0.13.0 | Unknown | - | ||
| cloud.google.com/go/auth/oauth2adapt | v0.2.6 | Unknown | - | ||
| cloud.google.com/go/compute/metadata | v0.6.0 | Unknown | - | ||
| dario.cat/mergo | v1.0.2 | Unknown | - | ||
| github.com/Azure/azure-sdk-for-go/sdk/azcore | v1.16.0 | Unknown | - | ||
| github.com/Azure/azure-sdk-for-go/sdk/azidentity | v1.8.0 | Unknown | - | ||
| github.com/Azure/azure-sdk-for-go/sdk/internal | v1.10.0 | Unknown | - | ||
| github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v5 | v5.7.0 | Unknown | - | ||
| github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v4 | v4.3.0 | Unknown | - | ||
| github.com/AzureAD/microsoft-authentication-library-for-go | v1.2.2 | Unknown | - | ||
| github.com/Code-Hex/go-generics-cache | v1.5.1 | Unknown | - | ||
| github.com/Masterminds/semver/v3 | v3.3.1 | Unknown | - | ||
| github.com/alecthomas/units | v0.0.0-20240927000941-0f3dac36c52b | Unknown | - | ||
| github.com/armon/go-metrics | v0.4.1 | Unknown | - | ||
| github.com/aws/aws-sdk-go | v1.55.5 | Unknown | - | ||
| github.com/beorn7/perks | v1.0.1 | Unknown | - | ||
| github.com/cenkalti/backoff/v4 | v4.3.0 | Unknown | - | ||
| github.com/cert-manager/cert-manager | v1.17.1 | Unknown | - | ||
| github.com/cespare/xxhash/v2 | v2.3.0 | Unknown | - | ||
| github.com/cncf/xds/go | v0.0.0-20241223141626-cff3c89139a3 | Unknown | - | ||
| github.com/davecgh/go-spew | v1.1.2-0.20180830191138-d8f796af33cc | Unknown | - | ||
| github.com/digitalocean/godo | v1.132.0 | Unknown | - | ||
| github.com/distribution/reference | v0.6.0 | Unknown | - | ||
| github.com/docker/go-connections | v0.4.0 | Unknown | - | ||
| github.com/docker/go-units | v0.5.0 | Unknown | - | ||
| github.com/emicklei/go-restful/v3 | v3.12.1 | Unknown | - | ||
| github.com/envoyproxy/go-control-plane/envoy | v1.32.4 | Unknown | - | ||
| github.com/envoyproxy/protoc-gen-validate | v1.2.1 | Unknown | - | ||
| github.com/evanphx/json-patch/v5 | v5.9.11 | Unknown | - | ||
| github.com/fatih/color | v1.16.0 | Unknown | - | ||
| github.com/felixge/httpsnoop | v1.0.4 | Unknown | - | ||
| github.com/fsnotify/fsnotify | v1.8.0 | Unknown | - | ||
| github.com/fxamacker/cbor/v2 | v2.7.0 | Unknown | - | ||
| github.com/go-logr/logr | v1.4.2 | Unknown | - | ||
| github.com/go-logr/stdr | v1.2.2 | Unknown | - | ||
| github.com/go-logr/zapr | v1.3.0 | Unknown | - | ||
| github.com/go-openapi/jsonpointer | v0.21.0 | Unknown | - | ||
| github.com/go-openapi/jsonreference | v0.21.0 | Unknown | - | ||
| github.com/go-openapi/swag | v0.23.0 | Unknown | - | ||
| github.com/go-resty/resty/v2 | v2.15.3 | Unknown | - | ||
| github.com/go-zookeeper/zk | v1.0.4 | Unknown | - | ||
| github.com/gogo/protobuf | v1.3.2 | Unknown | - | ||
| github.com/golang-jwt/jwt/v5 | v5.2.2 | Unknown | - | ||
| github.com/golang/protobuf | v1.5.4 | Unknown | - | ||
| github.com/google/btree | v1.1.3 | Unknown | - | ||
| github.com/google/gnostic-models | v0.6.9 | Unknown | - | ||
| github.com/google/go-cmp | v0.7.0 | Unknown | - | ||
| github.com/google/go-querystring | v1.1.0 | Unknown | - | ||
| github.com/google/gofuzz | v1.2.0 | Unknown | - | ||
| github.com/google/s2a-go | v0.1.8 | Unknown | - | ||
| github.com/google/uuid | v1.6.0 | Unknown | - | ||
| github.com/googleapis/enterprise-certificate-proxy | v0.3.4 | Unknown | - | ||
| github.com/googleapis/gax-go/v2 | v2.14.0 | Unknown | - | ||
| github.com/gophercloud/gophercloud | v1.14.1 | Unknown | - | ||
| github.com/gorilla/websocket | v1.5.3 | Unknown | - | ||
| github.com/grafana/regexp | v0.0.0-20240518133315-a468a5bfb3bc | Unknown | - | ||
| github.com/grpc-ecosystem/grpc-gateway/v2 | v2.26.1 | Unknown | - | ||
| github.com/hashicorp/consul/api | v1.30.0 | Unknown | - | ||
| github.com/hashicorp/cronexpr | v1.1.2 | Unknown | - | ||
| github.com/hashicorp/errwrap | v1.1.0 | Unknown | - | ||
| github.com/hashicorp/go-cleanhttp | v0.5.2 | Unknown | - | ||
| github.com/hashicorp/go-hclog | v1.6.3 | Unknown | - | ||
| github.com/hashicorp/go-immutable-radix | v1.3.1 | Unknown | - | ||
| github.com/hashicorp/go-multierror | v1.1.1 | Unknown | - | ||
| github.com/hashicorp/go-retryablehttp | v0.7.7 | Unknown | - | ||
| github.com/hashicorp/go-rootcerts | v1.0.2 | Unknown | - | ||
| github.com/hashicorp/go-version | v1.7.0 | Unknown | - | ||
| github.com/hashicorp/golang-lru | v0.6.0 | Unknown | - | ||
| github.com/hashicorp/nomad/api | v0.0.0-20241218080744-e3ac00f30eec | Unknown | - | ||
| github.com/hashicorp/serf | v0.10.1 | Unknown | - | ||
| github.com/hetznercloud/hcloud-go/v2 | v2.17.1 | Unknown | - | ||
| github.com/ionos-cloud/sdk-go/v6 | v6.3.0 | Unknown | - | ||
| github.com/jmespath/go-jmespath | v0.4.1-0.20220621161143-b0104c826a24 | Unknown | - | ||
| github.com/josharian/intern | v1.0.0 | Unknown | - | ||
| github.com/jpillora/backoff | v1.0.0 | Unknown | - | ||
| github.com/json-iterator/go | v1.1.12 | Unknown | - | ||
| github.com/kolo/xmlrpc | v0.0.0-20220921171641-a4b6fa1dd06b | Unknown | - | ||
| github.com/kylelemons/godebug | v1.1.0 | Unknown | - | ||
| github.com/linode/linodego | v1.43.0 | Unknown | - | ||
| github.com/mailru/easyjson | v0.9.0 | Unknown | - | ||
| github.com/mattn/go-colorable | v0.1.13 | Unknown | - | ||
| github.com/mattn/go-isatty | v0.0.20 | Unknown | - | ||
| github.com/miekg/dns | v1.1.62 | Unknown | - | ||
| github.com/mitchellh/mapstructure | v1.5.0 | Unknown | - | ||
| github.com/moby/docker-image-spec | v1.3.1 | Unknown | - | ||
| github.com/modern-go/concurrent | v0.0.0-20180306012644-bacd9c7ef1dd | Unknown | - | ||
| github.com/modern-go/reflect2 | v1.0.2 | Unknown | - | ||
| github.com/munnerz/goautoneg | v0.0.0-20191010083416-a7dc8b61c822 | Unknown | - | ||
| github.com/mwitkow/go-conntrack | v0.0.0-20190716064945-2f068394615f | Unknown | - | ||
| github.com/opencontainers/go-digest | v1.0.0 | Unknown | - | ||
| github.com/opencontainers/image-spec | v1.0.2 | Unknown | - | ||
| github.com/openshift/api | v0.0.0-20240124164020-e2ce40831f2e | Unknown | - | ||
| github.com/operator-framework/operator-lib | v0.17.0 | Unknown | - | ||
| github.com/ovh/go-ovh | v1.6.0 | Unknown | - | ||
| github.com/pkg/browser | v0.0.0-20240102092130-5ac0b6a4141c | Unknown | - | ||
| github.com/pkg/errors | v0.9.1 | Unknown | - | ||
| github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring | v0.80.1 | Unknown | - | ||
| github.com/prometheus/client_golang | v1.22.0 | Unknown | - | ||
| github.com/prometheus/client_model | v0.6.1 | Unknown | - | ||
| github.com/prometheus/common | v0.63.0 | Unknown | - | ||
| github.com/prometheus/procfs | v0.15.1 | Unknown | - | ||
| github.com/prometheus/sigv4 | v0.1.0 | Unknown | - | ||
| github.com/scaleway/scaleway-sdk-go | v1.0.0-beta.30 | Unknown | - | ||
| github.com/spf13/cobra | v1.9.1 | Unknown | - | ||
| github.com/spf13/pflag | v1.0.6 | Unknown | - | ||
| github.com/vultr/govultr/v2 | v2.17.2 | Unknown | - | ||
| github.com/x448/float16 | v0.8.4 | Unknown | - | ||
| go.opentelemetry.io/auto/sdk | v1.1.0 | Unknown | - | ||
| go.opentelemetry.io/collector/featuregate | v1.31.0 | Unknown | - | ||
| go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp | v0.60.0 | Unknown | - | ||
| go.opentelemetry.io/contrib/otelconf | v0.15.0 | Unknown | - | ||
| go.opentelemetry.io/otel | v1.35.0 | Unknown | - | ||
| go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc | v1.35.0 | Unknown | - | ||
| go.opentelemetry.io/otel/exporters/prometheus | v0.57.0 | Unknown | - | ||
| go.opentelemetry.io/otel/exporters/stdout/stdoutlog | v0.11.0 | Unknown | - | ||
| go.opentelemetry.io/otel/exporters/stdout/stdoutmetric | v1.35.0 | Unknown | - | ||
| go.opentelemetry.io/otel/exporters/stdout/stdouttrace | v1.35.0 | Unknown | - | ||
| go.opentelemetry.io/otel/log | v0.11.0 | Unknown | - | ||
| go.opentelemetry.io/otel/metric | v1.35.0 | Unknown | - | ||
| go.opentelemetry.io/otel/sdk/metric | v1.35.0 | Unknown | - | ||
| go.opentelemetry.io/otel/trace | v1.35.0 | Unknown | - | ||
| go.opentelemetry.io/proto/otlp | v1.5.0 | Unknown | - | ||
| go.uber.org/multierr | v1.11.0 | Unknown | - | ||
| go.uber.org/zap | v1.27.0 | Unknown | - | ||
| golang.org/x/exp | v0.0.0-20250106191152-7588d65b2ba8 | Unknown | - | ||
| golang.org/x/oauth2 | v0.28.0 | Unknown | - | ||
| golang.org/x/sync | v0.12.0 | Unknown | - | ||
| golang.org/x/sys | v0.31.0 | Unknown | CVE-2026-39824 (Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows) | UNKNOWN | fixed (in 0.44.0) |
| golang.org/x/term | v0.30.0 | Unknown | - | ||
| golang.org/x/time | v0.9.0 | Unknown | - | ||
| gomodules.xyz/jsonpatch/v2 | v2.4.0 | Unknown | - | ||
| google.golang.org/api | v0.213.0 | Unknown | - | ||
| google.golang.org/genproto/googleapis/api | v0.0.0-20250303144028-a0af3efb3deb | Unknown | - | ||
| google.golang.org/genproto/googleapis/rpc | v0.0.0-20250227231956-55c901821b1e | Unknown | - | ||
| google.golang.org/protobuf | v1.36.6 | Unknown | - | ||
| gopkg.in/evanphx/json-patch.v4 | v4.12.0 | Unknown | - | ||
| gopkg.in/inf.v0 | v0.9.1 | Unknown | - | ||
| gopkg.in/ini.v1 | v1.67.0 | Unknown | - | ||
| gopkg.in/yaml.v2 | v2.4.0 | Unknown | - | ||
| gopkg.in/yaml.v3 | v3.0.1 | Unknown | - | ||
| k8s.io/api | v0.32.3 | Unknown | - | ||
| k8s.io/apiextensions-apiserver | v0.32.3 | Unknown | - | ||
| k8s.io/apimachinery | v0.32.3 | Unknown | - | ||
| k8s.io/client-go | v0.32.3 | Unknown | - | ||
| k8s.io/component-base | v0.32.3 | Unknown | - | ||
| k8s.io/klog/v2 | v2.130.1 | Unknown | - | ||
| k8s.io/kube-openapi | v0.0.0-20241212222426-2c72e554b1e7 | Unknown | - | ||
| k8s.io/utils | v0.0.0-20241210054802-24370beab758 | Unknown | - | ||
| sigs.k8s.io/controller-runtime | v0.20.4 | Unknown | - | ||
| sigs.k8s.io/gateway-api | v1.1.0 | Unknown | - | ||
| sigs.k8s.io/json | v0.0.0-20241014173422-cfa47c3a1cc8 | Unknown | - | ||
| sigs.k8s.io/structured-merge-diff/v4 | v4.5.0 | Unknown | - | ||
| sigs.k8s.io/yaml | v1.4.0 | Unknown | - | ||
| stdlib | go1.24.3 | BSD-3-Clause | - | ||
| /manager | Unknown | Unknown | - |