Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
OpenTelemetry-Go may let attackers run code
published 1 month ago
Summary
The Go version of OpenTelemetry used in cleanstart/grafana-alloy, cleanstart/weaviate-fips, and cleanstart/temporal-server contains flaws that could let a malicious actor execute code on the server. This could lead to unauthorized actions or data loss. Apply the latest updates provided by each vendor to close the gaps.
What to do
- Update cleanstart grafana-alloy to version 1.19.2-r1.
- Update cleanstart weaviate-fips to version 1.38.18-r1.
- Update cleanstart temporal-server to version 1.31.3-r2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | grafana-alloy |
< 1.19.2-r1 Fix: upgrade to 1.19.2-r1
|
| CleanStart | cleanstart | weaviate-fips |
< 1.38.18-r1 Fix: upgrade to 1.38.18-r1
|
| CleanStart | cleanstart | temporal-server |
< 1.31.3-r2 Fix: upgrade to 1.31.3-r2
|
Original advisory text
OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details.
Timeline
Published6 Oct 2026
Updated6 Oct 2026
First seen6 Oct 2026
Sources
CLEANSTART-2026-WJ82120 · OSV
Track software like this
Free during beta