Vulnerability Reportotel/opentelemetry-collector-contrib:0.165.0

otel/opentelemetry-collector-contrib:latestotel/opentelemetry-collector-contrib:0.165.0

digestsha256:e40d61f10c9a617cca1ffd1be4d7e2b3a4b0f0001798ff07e58cabe82e618cea

Executive Summary

Last scanned: Nov 10, 2026

Threat ScoreSAFE• The scan found one reachable-from-network finding with a maximum severity of 4.0, which is low and does not set the verdict.• No known exploited vulnerabilities are listed for this image, and no findings are set to affect the verdict.• The main process is a statically linked Go program, so OS library flaws are not reachable through it.• The image is pinned by digest and published by a sponsored open-source project, with a trust verdict of TRUSTED.• The container runs as a non-root user (10001:10001), which limits the impact of any compromise.

0/100SAFE

ReputationSPONSORED OSS• Docker Sponsored OSS (Trusted Community)• Pinned by digest (Immutable)

TRUSTED

This image is safe for production use. The scan found one low-severity issue that is reachable from the network in normal operation, but its severity is low and it does not change the overall assessment. Keeping the image pinned by digest and running it as a non-root user are good practices that should be maintained, and routine rescanning as new releases appear is still advisable.

Already in good shape · 1 hardening step left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

1 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.58.0 No fix yet	—	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.