This Red Hat security advisory covers the release of Red Hat build of OpenTelemetry 3.6.0, which addresses multiple security vulnerabilities including CVE-2025-22868, CVE-2025-27144, CVE-2025-29786, and CVE-2025-30204. The update introduces enhancements such as support for TLS certificates in the TPM Software Stack (TSS) 2.0 format and automatic reconciliation and upgrade of OpenTelemetryCollector custom resources by the Operator. No breaking changes or deprecations are introduced. Known issues with AWS CloudWatch Logs, EMF, and X-Ray exporters remain, specifically related to endpoint protocol specification errors, with a workaround to include the protocol in endpoint URLs. The advisory does not explicitly confirm patch availability but provides upgrade instructions and references for applying the update. The vulnerabilities involve weaknesses categorized under CWEs 1286, 770, and 405, indicating issues related to improper access control and resource management.

The vulnerabilities addressed in this advisory are rated high severity by Red Hat Product Security. They potentially affect Red Hat OpenShift distributed tracing components and related OpenTelemetry builds. The impact involves security weaknesses that could affect the integrity and reliability of telemetry data collection and processing. No known exploits in the wild have been reported. The advisory does not specify detailed exploitation scenarios or direct impact outcomes beyond the classification of severity and the affected components.

Users should apply the Red Hat build of OpenTelemetry 3.6.0 update following the official upgrade instructions provided by Red Hat, available at https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators. The Operator included in this release automatically upgrades OpenTelemetryCollector custom resources and retries upgrades on failure with exponential backoff. There are no explicit bug fixes beyond the security updates, and no breaking changes to consider. For deployments using AWS exporters, ensure the endpoint configuration includes the protocol (e.g., https://) to avoid unsupported protocol scheme errors. Patch status is not explicitly confirmed in the advisory; therefore, users should verify the current remediation status via the vendor advisory link https://access.redhat.com/errata/RHSA-2025:9167.