CLEANSTART-2026-SH05010

Dashboard / Vulnerabilities / CLEANSTART-2026-SH05010

CLEANSTART-2026-SH05010

Summary: malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Details: Multiple security vulnerabilities affect the opentelemetry-collector-contrib package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details.

References: https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SH05010.json, https://osv.dev/vulnerability/CVE-2026-10722, https://osv.dev/vulnerability/CVE-2026-27145, https://osv.dev/vulnerability/CVE-2026-33816, https://osv.dev/vulnerability/CVE-2026-34986, https://osv.dev/vulnerability/CVE-2026-39821, https://osv.dev/vulnerability/CVE-2026-39824, https://osv.dev/vulnerability/CVE-2026-39883, https://osv.dev/vulnerability/CVE-2026-41602, https://osv.dev/vulnerability/CVE-2026-42504, https://osv.dev/vulnerability/CVE-2026-42507, https://osv.dev/vulnerability/CVE-2026-46595, https://osv.dev/vulnerability/CVE-2026-56864, https://osv.dev/vulnerability/CVE-2026-56865, https://osv.dev/vulnerability/ghsa-6g7g-w4f8-9c9x, https://osv.dev/vulnerability/ghsa-p77j-4mvh-x3m3, https://osv.dev/vulnerability/ghsa-xmrv-pmrh-hhx2, https://nvd.nist.gov/vuln/detail/CVE-2026-10722, https://nvd.nist.gov/vuln/detail/CVE-2026-27145, https://nvd.nist.gov/vuln/detail/CVE-2026-33816, https://nvd.nist.gov/vuln/detail/CVE-2026-34986, https://nvd.nist.gov/vuln/detail/CVE-2026-39821, https://nvd.nist.gov/vuln/detail/CVE-2026-39824, https://nvd.nist.gov/vuln/detail/CVE-2026-39883, https://nvd.nist.gov/vuln/detail/CVE-2026-41602, https://nvd.nist.gov/vuln/detail/CVE-2026-42504, https://nvd.nist.gov/vuln/detail/CVE-2026-42507, https://nvd.nist.gov/vuln/detail/CVE-2026-46595, https://nvd.nist.gov/vuln/detail/CVE-2026-56864, https://nvd.nist.gov/vuln/detail/CVE-2026-56865