Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3GoPublished

    opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token

    CVE-2026-47256 · GHSA-4jvg-4jfx-fmhc

    Affected
    • Go github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter < 0.154.0
    Fixed in
    0.154.0· Vendor fix available
    Issue
    The Sentry exporter constructs Sentry API URLs by interpolating the span's service.name resource attribute into the URL path without validation. Because service.name is controlled by remote OTLP senders and the operator-configured bearer token is attached to every request, a crafted service name can reach arbitrary Sentry API endpoints reachable by that token — including privileged admin, organization, and member endpoints within the configured Sentry organization. Affected - exporter/sentryexporter/sentryexporter.go (lines 715–737) — extractProjectSlug returns the attacker-controlled service.name directly as the slug. - exporter/sentryexporter/sentryexporter.go (lines 745–809) — getOrCreateProjectEndpoint passes the raw slug to GetOTLPEndpoints at line 761. - exporter/sentryexporter/sentryclient.go (lines 190–244) — GetProjectKeys interpolates the slug into fmt.Sprintf URL path and attaches the operator bearer token on line 207. - exporter/sentryexporter/sentryclient.go…

    Recommended action: Upgrade to 0.154.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →