Vulnerability Reportotel/opentelemetry-collector:0.161.0

This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The most relevant finding is CVE-2026-78669, a denial-of-service issue in the HTTP/2 handling used by the collector's gRPC receiver; a malicious client could consume CPU and disrupt telemetry ingestion. There are 15 exposed findings and 4 post-exploit findings, but the maximum exposed severity is 6.38 and no exposed finding reaches 7.0, so the verdict remains NEEDS_ATTENTION. The image's popular community reputation and digest pinning are positive, but the gRPC receiver's HTTP/2 path remains the practical risk to remediate.