OCPBUGS-112562: CVE-2026-41178 - bump go.opentelemetry.io/otel to v1.44.0

[rissh]

Summary

• Bump go.opentelemetry.io/otel from v1.41.0 to v1.44.0 to fix CVE-2026-41178 (GO-2026-5158 / GHSA-5wrp-cwcj-q835).
• v1.41.0 is an affected pin; v1.44.0 is the #8222 fix (do not stop at v1.42.0).
• Indirect via Kubernetes/library-go serving (WithTracing → otelhttp → baggage.Parse). go mod tidy / go mod vendor included.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@rissh: This pull request references Jira Issue OCPBUGS-112562, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.1.0) matches configured target version for branch (5.1.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (core-networking-bot@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

• Bump go.opentelemetry.io/otel from v1.41.0 to v1.44.0 to fix CVE-2026-41178 (GO-2026-5158 / GHSA-5wrp-cwcj-q835).
• v1.41.0 is an affected pin; v1.44.0 is the #8222 fix (do not stop at v1.42.0).
• Indirect via Kubernetes/library-go serving (WithTracing → otelhttp → baggage.Parse). go mod tidy / go mod vendor included.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: c2ed5ea2-ddb8-4537-9d1e-6189099729a4

📥 Commits

Reviewing files that changed from the base of the PR and between 2a6a57f and 3131dc7.

⛔ Files ignored due to path filters (49)

• go.sum is excluded by !**/*.sum
• vendor/go.opentelemetry.io/otel/.golangci.yml is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/AGENTS.md is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/CHANGELOG.md is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/CLAUDE.md is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/CONTRIBUTING.md is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/Makefile is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/README.md is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/RELEASING.md is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/attribute/encoder.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/attribute/hash.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/attribute/internal/attribute.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/attribute/key.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/attribute/kv.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/attribute/set.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/attribute/type_string.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/attribute/value.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/baggage/baggage.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/dependencies.Dockerfile is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/metric/asyncfloat64.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/metric/asyncint64.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/metric/config.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/metric/doc.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/metric/instrument.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/metric/syncfloat64.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/metric/syncint64.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/propagation/baggage.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/propagation/trace_context.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/requirements.txt is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.37.0/attribute_group.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.39.0/attribute_group.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.39.0/httpconv/metric.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.39.0/otelconv/metric.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.39.0/rpcconv/metric.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.41.0/MIGRATION.md is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.41.0/README.md is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.41.0/attribute_group.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.41.0/doc.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.41.0/error_type.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.41.0/exception.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/semconv/v1.41.0/schema.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/trace/auto.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/trace/config.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/trace/internal/telemetry/span.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/trace/trace.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/trace/tracestate.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/version.go is excluded by !vendor/**, !**/vendor/**
• vendor/go.opentelemetry.io/otel/versions.yaml is excluded by !vendor/**, !**/vendor/**
• vendor/modules.txt is excluded by !vendor/**, !**/vendor/**

📒 Files selected for processing (1)

• go.mod

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Summary by CodeRabbit

• Chores
  • Updated internal observability dependencies to newer versions.
  • No user-facing features or behavior changes.

Walkthrough

The pull request updates three indirect OpenTelemetry dependencies to v1.44.0. The OpenTelemetry SDK dependency remains at v1.41.0.

Changes

OpenTelemetry dependency update

Layer / File(s)	Summary
Update indirect OpenTelemetry modules go.mod	Updates otel, otel/metric, and otel/trace to v1.44.0. Keeps otel/sdk at v1.41.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 3131d

This dependency-only security update has no actionable merge-blocking risk in the supplied evidence and is merge-ready after normal checks and review.

Suggested reviewers: arghosh93, danwinship, tssurya

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (2 errors)

Check name	Status	Explanation	Resolution
Commit Message Quality	❌ Error	The sole PR commit changes the OpenTelemetry dependency, but its body contains only a Signed-off-by trailer and does not explain why the change is needed.	Add a commit body that states the CVE and the affected dependency path, while retaining the concise subject and sign-off.
Title check	❌ Error	The title identifies the dependency update but is 73 characters and does not use the required affected-component prefix.	Shorten the title to fewer than 72 characters and prefix it with the affected component, such as "otel: Update to v1.44.0 for CVE-2026-41178".

✅ Passed checks (22 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Pr Quality	✅ Passed	The description states the CVE motivation, affected path, selected v1.44.0 fix, and vendor commands; the change is a vendor bump exempt from CI details and has only 18 non-vendor lines.
Unit Tests For Go Changes	✅ Passed	The PR changes only go.mod/go.sum and excluded vendor files; counts show 0 production Go files under pkg/cmd and 0 bindata templates changed.
E2e Tests For Feature Changes	✅ Passed	The PR changes only dependency manifests and vendor files; no Go source files under pkg/ or cmd/ changed, so the E2E criteria do not apply.
Rbac Least Privilege	✅ Passed	The commit changes Go dependency files and OpenTelemetry vendor files only; git diff shows no changes under bindata/ or manifests/, so no RBAC rule changed.
Docs For Feature And Behavior Changes	✅ Passed	The commit only updates OpenTelemetry module metadata and vendored upstream code for a CVE fix; no CNO source, control flow, user configuration, architecture, or docs changed.
Stale Project Docs And Config	✅ Passed	The diff changes only Go module metadata and vendored OpenTelemetry files; CNO docs and .coderabbit.yaml remain unchanged and contain no affected OpenTelemetry paths or versions.
Go And Test Code Quality	✅ Passed	The pull request changes only go.mod, go.sum, and vendor/; the diff contains no modified Go code outside vendor/, so none of the nine conditions applies.
Ai-Generated Code Smell	✅ Passed	The commit only updates module metadata and vendored OpenTelemetry files; it adds no tests or project code, and code comments and variable names contain no AI-tool or prompt references.
Stable And Deterministic Test Names	✅ Passed	The HEAD diff changes dependency metadata and vendored OpenTelemetry files only; it adds no test paths or Ginkgo test-title constructs.
Test Structure And Quality	✅ Passed	The commit changes only go.mod/go.sum and vendored OpenTelemetry files; no Ginkgo test files or test code changed, so the listed test-quality checks are not applicable.
Microshift Test Compatibility	✅ Passed	The diff changes only Go dependency metadata and vendored OpenTelemetry files; it adds no *_test.go files or Ginkgo test declarations, so MicroShift compatibility checks do not apply.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The diff changes dependency manifests, sums, and vendored OpenTelemetry sources only. It adds no test-like paths or Ginkgo declarations, so the SNO check does not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	The parent-to-HEAD diff only updates Go module metadata and vendored OpenTelemetry files; it adds no manifests, operator/controller code, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	HEAD^..HEAD changes only dependency metadata and vendored OTel code; no changed Go file contains process entrypoints, suite setup, or added stdout/logging writes.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The pull request changes only OpenTelemetry module metadata and vendored library files; no Ginkgo e2e tests or test networking code were added.
No-Weak-Crypto	✅ Passed	The diff only updates OpenTelemetry dependencies; searches found no added weak-crypto APIs or secret comparisons. MD5/SHA1/3DES hits are semantic-convention names or comments.
Container-Privileges	✅ Passed	The PR changes dependency metadata, vendored OpenTelemetry code, and a Dockerfile image pin; it adds no container/Kubernetes manifest or privilege setting.
No-Sensitive-Data-In-Logs	✅ Passed	The commit changes dependency metadata and vendored OpenTelemetry only. Baggage parse errors were already logged, and the update adds no new application logging or sensitive-data output.
Description check	✅ Passed	The description clearly explains the OpenTelemetry dependency update and its CVE remediation purpose.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[rissh]

/pipeline required

[openshift-merge-bot]

Scheduling required tests:
/test e2e-aws-ovn-upgrade-ipsec

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn-fdp-qe
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-aws-ovn-upgrade
/test e2e-aws-ovn-windows
/test e2e-azure-ovn-upgrade
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-dualstack-bgp
/test e2e-metal-ipi-ovn-dualstack-bgp-local-gw
/test e2e-metal-ipi-ovn-ipv6
/test e2e-metal-ipi-ovn-ipv6-ipsec
/test e2e-ovn-ipsec-step-registry
/test hypershift-e2e-aks

[rissh]

/retest

[rissh]

/retest

[danwinship]

/lgtm

[openshift-merge-bot]

Scheduling required tests:
/test e2e-aws-ovn-upgrade-ipsec

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn-fdp-qe
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-serial-1of2
/test e2e-aws-ovn-serial-2of2
/test e2e-aws-ovn-upgrade
/test e2e-aws-ovn-windows
/test e2e-azure-ovn-upgrade
/test e2e-gcp-ovn
/test e2e-gcp-ovn-upgrade
/test e2e-metal-ipi-ovn-dualstack-bgp
/test e2e-metal-ipi-ovn-dualstack-bgp-local-gw
/test e2e-metal-ipi-ovn-ipv6
/test e2e-metal-ipi-ovn-ipv6-ipsec
/test e2e-ovn-ipsec-step-registry
/test hypershift-e2e-aks

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: danwinship, rissh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [danwinship]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rissh]

/retest

[rissh]

/retest

[rissh]

/retest

[danwinship]

/override ci/prow/e2e-metal-ipi-ovn-dualstack-bgp-local-gw

[danwinship]

@rissh this needs an appropriate /verified

[openshift-ci]

@danwinship: Overrode contexts on behalf of danwinship: ci/prow/e2e-metal-ipi-ovn-dualstack-bgp-local-gw

Details

In response to this:

/override ci/prow/e2e-metal-ipi-ovn-dualstack-bgp-local-gw

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[sunku5494]

/verified by CI

[openshift-ci-robot]

@sunku5494: This PR has been marked as verified by CI.

Details

In response to this:

/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@rissh: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@rissh: Jira Issue Verification Checks: Jira Issue OCPBUGS-112562
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-112562 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

Summary

• Bump go.opentelemetry.io/otel from v1.41.0 to v1.44.0 to fix CVE-2026-41178 (GO-2026-5158 / GHSA-5wrp-cwcj-q835).
• v1.41.0 is an affected pin; v1.44.0 is the #8222 fix (do not stop at v1.42.0).
• Indirect via Kubernetes/library-go serving (WithTracing → otelhttp → baggage.Parse). go mod tidy / go mod vendor included.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.