This advisory covers the release of Red Hat OpenTelemetry 3.5.1 for OpenShift distributed tracing, which includes fixes for four security vulnerabilities: CVE-2025-22868, CVE-2025-27144, CVE-2025-29786, and CVE-2025-30204. The vulnerabilities correspond to CWEs 1286, 770, and 405, indicating issues related to improper access control, resource management, or authorization. The release does not introduce breaking changes or new features but focuses on security improvements and bug fixes. No CVSS scores are provided, and no known exploits have been reported. The vendor advisory directs users to upgrade to this version to remediate the issues.

The vulnerabilities addressed are rated as high severity by Red Hat, indicating significant security risks if left unpatched. The specific impact details are not provided, but the associated CWEs suggest potential unauthorized access or resource misuse. No known exploits in the wild have been reported, reducing immediate risk. However, the presence of multiple CVEs in a core tracing component could affect the confidentiality, integrity, or availability of affected systems if exploited.

Red Hat has released OpenTelemetry 3.5.1 containing fixes for the identified vulnerabilities. Users should apply this update following Red Hat's official upgrade documentation for OpenShift operators. Since this is a product update rather than a cloud service, remediation requires user action to upgrade to the fixed version. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated or required beyond applying the update.