RHSA-2026:69268 - Security Advisory

Topic

Red Hat build of OpenTelemetry 3.11.1 has been released

Description

This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes.

Breaking changes:

• None

Deprecations:

• None

Technology Preview features:

• None

Enhancements:

• None

Bug fixes:

• Before this update, the Collector used a bare service name (`http://<name>-targetallocator:80`) to contact the Target Allocator, which did not match the standard `NO_PROXY=.svc` entry. As a consequence, on clusters behind a corporate HTTP proxy, the request was routed through the proxy, which returned an HTML authentication page instead of the expected JSON response, breaking the metrics scraping pipeline. With this release, the Target Allocator endpoint uses the FQDN (`http://<name>-targetallocator.<namespace>.svc:80`). As a result, the Collector reaches the Target Allocator directly without routing through the proxy. For more information, see https://issues.redhat.com/browse/TRACING-6784.

Known issues:

• None

Solution

For details on how to apply this update, refer to:

https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators

Affected Products

• Red Hat OpenShift distributed tracing

Fixes

• TRACING-6784 - OTEL collector inherits cluster proxy env vars, breaks TargetAllocator metrics scraping

CVEs

• CVE-2026-33818
• CVE-2026-39821
• CVE-2026-46600
• CVE-2026-56853
• CVE-2026-56854
• CVE-2026-56858
• CVE-2026-56859
• CVE-2026-56860
• CVE-2026-56862

References

• https://access.redhat.com/security/updates/classification/
• https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/red_hat_build_of_opentelemetry