Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
OpenTelemetry Collector Contrib FIPS may let attackers act
published 7 months ago
Summary
The OpenTelemetry Collector Contrib FIPS package contains several security weaknesses that could let a malicious user interfere with data collection or execute unauthorized actions. These problems are fixed in newer releases of the package, so updating to the latest version is the recommended step. If you cannot upgrade immediately, limit exposure by restricting network access to the collector.
What to do
- Update cleanstart opentelemetry-collector-contrib-fips to version 0.144.0-r3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | opentelemetry-collector-contrib-fips |
< 0.144.0-r3 Fix: upgrade to 0.144.0-r3
|
Original advisory text
Security fixes for CVE-2020-8912, CVE-2025-68121, CVE-2026-24051, CVE-2026-25679, CVE-2026-26958, CVE-2026-27139, CVE-2026-27141, CVE-2026-27142, CVE-2026-33186, ghsa-6g7g-w4f8-9c9x, ghsa-cfpf-hrx2-8rv6, ghsa-fw7p-63qq-7hpr, ghsa-p77j-4mvh-x3m3 applied in versions: 0.142.0-r0, 0.144.0-r0, 0.144.0-r1, 0.144.0-r2, 0.144.0-r3
Multiple security vulnerabilities affect the opentelemetry-collector-contrib-fips package. These issues are resolved in later releases. See references for individual vulnerability details.
References
- https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advis... Vendor Advisory
- https://osv.dev/vulnerability/CVE-2020-8912 URL
- https://osv.dev/vulnerability/CVE-2025-68121 URL
- https://osv.dev/vulnerability/CVE-2026-24051 URL
- https://osv.dev/vulnerability/CVE-2026-25679 URL
- https://osv.dev/vulnerability/CVE-2026-26958 URL
- https://osv.dev/vulnerability/CVE-2026-27139 URL
- https://osv.dev/vulnerability/CVE-2026-27141 URL
- https://osv.dev/vulnerability/CVE-2026-27142 URL
- https://osv.dev/vulnerability/CVE-2026-33186 URL
- https://osv.dev/vulnerability/ghsa-6g7g-w4f8-9c9x URL
- https://osv.dev/vulnerability/ghsa-cfpf-hrx2-8rv6 URL
- https://osv.dev/vulnerability/ghsa-fw7p-63qq-7hpr URL
- https://osv.dev/vulnerability/ghsa-p77j-4mvh-x3m3 URL
- https://nvd.nist.gov/vuln/detail/CVE-2020-8912 URL
- https://nvd.nist.gov/vuln/detail/CVE-2025-68121 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-24051 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-25679 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-26958 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-27139 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-27141 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-27142 URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-33186 URL
Timeline
Published1 Apr 2026
Updated18 Sep 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-LD15132 · OSV
Track software like this
Free during beta