https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 11:42:13 +0000 https://vulnerability.circl.lu/vuln/cve-2026-46600 <p><strong>Affected:</strong> Go standard library net, golang.org/x/net/dns/dnsmessage</p> <p>Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.</p> <p><strong>Affected:</strong> Go standard library net, golang.org/x/net/dns/dnsmessage</p> <p>Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.</p> https://vulnerability.circl.lu/vuln/cve-2026-46600 https://vulnerability.circl.lu/vuln/ghsa-cxh2-4639-vmc5 <p><strong>Affected:</strong> Go: github.com/open-telemetry/opentelemetry-operator</p> <p>## Affected</p> <p>Repository: github.com/open-telemetry/opentelemetry-operator Component: cmd/otel-allocator (TargetAllocator) Companion: Prometheus Operator API types (CRDs)</p> <p>## Summary</p> <p>OpenTelemetry Operator&#39;s TargetAllocator watches `ServiceMonitor` resources via the Prometheus Operator CR watcher and converts each selected endpoint into a Prometheus scrape configuration entry. The endpoint field `bearerTokenFile` is preserved through the conversion as `HTTPClientConfig.Authorization.CredentialsFile`. The OpenTelemetry Collector, configured with the Prometheus receiver, then loads that scrape config and, at scrape time, reads the file from its own pod filesystem and sends the contents as `Authorization: Bearer ...` to the scrape endpoint.</p> <p>A tenant who can create or update a `ServiceMonitor` selected by TargetAllocator can set `bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token` and a scrape target the tenant controls. The Collector then ships its mounted service account JWT to that target on every scrape interval.</p> <p>The Prometheus Operator project addressed the same primitive via the `ArbitraryFSAccessThroughSMs.Deny` admission/runtime guard.</p> <p>## Preconditions</p> <p>The OpenTelemetry Collector needs to be deployed with `targetAllocator.prometheusCR.enabled: true` and `serviceMonitorSelector` / `serviceMonitorNamespaceSelector` matching at least one namespace where the attacker can create or update `ServiceMonitor` (or paired with a TargetAllocator resource with t…</p> <p><strong>Affected:</strong> Go: github.com/open-telemetry/opentelemetry-operator</p> <p>## Affected</p> <p>Repository: github.com/open-telemetry/opentelemetry-operator Component: cmd/otel-allocator (TargetAllocator) Companion: Prometheus Operator API types (CRDs)</p> <p>## Summary</p> <p>OpenTelemetry Operator&#39;s TargetAllocator watches `ServiceMonitor` resources via the Prometheus Operator CR watcher and converts each selected endpoint into a Prometheus scrape configuration entry. The endpoint field `bearerTokenFile` is preserved through the conversion as `HTTPClientConfig.Authorization.CredentialsFile`. The OpenTelemetry Collector, configured with the Prometheus receiver, then loads that scrape config and, at scrape time, reads the file from its own pod filesystem and sends the contents as `Authorization: Bearer ...` to the scrape endpoint.</p> <p>A tenant who can create or update a `ServiceMonitor` selected by TargetAllocator can set `bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token` and a scrape target the tenant controls. The Collector then ships its mounted service account JWT to that target on every scrape interval.</p> <p>The Prometheus Operator project addressed the same primitive via the `ArbitraryFSAccessThroughSMs.Deny` admission/runtime guard.</p> <p>## Preconditions</p> <p>The OpenTelemetry Collector needs to be deployed with `targetAllocator.prometheusCR.enabled: true` and `serviceMonitorSelector` / `serviceMonitorNamespaceSelector` matching at least one namespace where the attacker can create or update `ServiceMonitor` (or paired with a TargetAllocator resource with t…</p> https://vulnerability.circl.lu/vuln/ghsa-cxh2-4639-vmc5