Package
redpanda-operator-26.2
Component
go.opentelemetry.io/otel/sdk/log
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
Not fixed upstream: CVE-2026-81872 is fixed in go.opentelemetry.io/otel/sdk/log 0.21.0, which requires go.opentelemetry.io/otel/log 0.21.0. That otel/log release removed the Value and KeyValue types. Redpanda Operator depends on github.com/redpanda-data/common-go/otelutil, which still uses the removed types. That library has no tagged releases, and its newest published version (commit 9566b7beb637, 2026-09-22) still requires go.opentelemetry.io/otel/log 0.19.0. The newest Redpanda Operator releases, v26.1.12 and v26.2.4, depend on it. Until it adopts the replacement API, the fixed sdk/log cannot be used in this package. Waiting for the first upstream release containing the fix.
References: https://nvd.nist.gov/vuln/detail/CVE-2026-81872 https://github.com/advisories/GHSA-hjf4-fphr-2h65 https://github.com/open-telemetry/opentelemetry-go/blob/log/v0.21.0/CHANGELOG.md https://github.com/redpanda-data/common-go/blob/main/otelutil/log/logr.go#L57
Status