—

GO-2026-5339

OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth in github.com/open-telemetry/opentelemetry-operator

Details

OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth in github.com/open-telemetry/opentelemetry-operator

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / github.com/open-telemetry/opentelemetry-operator

Introduced in: 0 Fixed in: 0.152.0

Fix go get github.com/open-telemetry/opentelemetry-operator@v0.152.0

References

https://github.com/open-telemetry/opentelemetry-operator/security/advisories/GHSA-cxh2-4639-vmc5 [ADVISORY]
https://github.com/open-telemetry/opentelemetry-operator/pull/5104 [FIX]