OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource attribute in exporter/sentryexporter/sentry_exporter.go through extractProjectSlug and getOrCreateProjectEndpoint, passes the raw project slug to GetOTLPEndpoints and GetProjectKeys in exporter/sentryexporter/sentry_client.go, and interpolates it into a Sentry API URL without applying projectSlugRegexp through validateRoutingConfig at runtime in exporter/sentryexporter/config.go. Special characters can turn the expected path suffix into query data in all deployments or introduce slash and dot segments that traverse paths when the Sentry deployment normalizes them, while the Collector attaches its operator-configured bearer token to the request. A successful request can reach token-authorized administrative, organization, member, or key endpoints within the configured Sentry organization, and an attacker-controlled project slug can redirect subsequently exported telemetry. Sentry token middleware prevents cross-organization access. This issue is fixed in version 0.154.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for
    instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs.
    Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource
    attribute in exporter/sentryexporter/sentry_exporter.go through extractProjectSlug and
    getOrCreateProjectEndpoint, passes the raw project slug to GetOTLPEndpoints and GetProjectKeys in
    exporter/sentryexporter/sentry_client.go, and interpolates it into a Sentry API URL without applying
    projectSlugRegexp through validateRoutingConfig at runtime in exporter/sentryexporter/config.go. Special
    characters can turn the expected path suffix into query data in all deployments or introduce slash and dot
    segments that traverse paths when the Sentry deployment normalizes them, while the Collector attaches its
    operator-configured bearer token to the request. A successful request can reach token-authorized
    administrative, organization, member, or key endpoints within the configured Sentry organization, and an
    attacker-controlled project slug can redirect subsequently exported telemetry. Sentry token middleware
    prevents cross-organization access. This issue is fixed in version 0.154.0. (CVE-2026-47256)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for     instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs.
    Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource     attribute in exporter/sentryexporter/sentry_exporter.go through extractProjectSlug and     getOrCreateProjectEndpoint, passes the raw project slug to GetOTLPEndpoints and GetProjectKeys in     exporter/sentryexporter/sentry_client.go, and interpolates it into a Sentry API URL without applying     projectSlugRegexp through validateRoutingConfig at runtime in exporter/sentryexporter/config.go. Special     characters can turn the expected path suffix into query data in all deployments or introduce slash and dot     segments that traverse paths when the Sentry deployment normalizes them, while the Collector attaches its     operator-configured bearer token to the request. A successful request can reach token-authorized     administrative, organization, member, or key endpoints within the configured Sentry organization, and an     attacker-controlled project slug can redirect subsequently exported telemetry. Sentry token middleware     prevents cross-organization access. This issue is fixed in version 0.154.0. (CVE-2026-47256)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
462460	Echo: github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter: security update to 0.154.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
462460	Echo: github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter: security update to 0.154.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
349285	Linux Distros Unpatched Vulnerability : CVE-2026-47256	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-47256

medium

Tenable Plugins

medium

medium

medium