Vulnerability Reportotel/opentelemetry-collector-contrib:0.164.0

otel/opentelemetry-collector-contrib:latestotel/opentelemetry-collector-contrib:0.164.0

digestsha256:340c9ca6a36617084c6661bdc4f0fe92b7cda5a805d61673ec8db375fddc522b

Executive Summary

Last scanned: Nov 2, 2026

Threat ScoreSAFE• The scan found one vulnerability that could be reached in normal operation, and its highest severity is 4.0, which is low.• No vulnerabilities were found that could be exploited only after the container is already compromised.• The image is published by otel with a reputation verdict of RELIABLE and is pinned by digest, so its exact contents are fixed.• The container runs as a non-root user (10001:10001), which limits the impact of any compromise.• The single finding does not reach the threat score threshold for any higher verdict, so it does not change the overall result.

0/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (1404M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. The scan found one low-severity issue, with a maximum severity of 4.0, which does not change the overall verdict. Nothing in the results points to a path that an outside attacker could easily use to take control of the service. The image is pinned by digest and runs without root privileges, which further reduces risk. Keep the image updated and rescan regularly, since new findings can appear over time.

Already in good shape · 1 hardening step left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

1 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.58.0 No fix yet	—	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.