Vulnerability with high severity in an indirect dependency: github.com/docker/docker v28.5.2+incompatible

[RaiAnand10]

Component(s)

opentelemetry-operator

What happened?

Description

The opentelemetry-operator has indirect dependency on github.com/docker/docker:

opentelemetry-operator/go.mod

Line 93 in 97d1355

github.com/docker/docker v28.5.2+incompatible // indirect

and that version of docker has couple of reported CVEs (one of them has severity: high):

┌──────────────────────────┬────────────────┬──────────┬────────┬──────────────────────┬──────────────────────────────┬──────────────────────────────────────────────────────────────┐
│         Library          │ Vulnerability  │ Severity │ Status │  Installed Version   │        Fixed Version         │                            Title                             │
├──────────────────────────┼────────────────┼──────────┼────────┼──────────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/docker/docker │ CVE-2026-34040 │ HIGH     │ fixed  │ v28.5.2+incompatible │ 29.3.1                       │ Moby has AuthZ plugin bypass when provided oversized request │
│                          │                │          │        │                      │                              │ bodies                                                       │
│                          │                │          │        │                      │                              │ https://avd.aquasec.com/nvd/cve-2026-34040                   │
│                          ├────────────────┼──────────┤        │                      │                              ├──────────────────────────────────────────────────────────────┤
│                          │ CVE-2026-33997 │ MEDIUM   │        │                      │                              │ moby: docker: github.com/moby/moby: Moby: Privilege          │
│                          │                │          │        │                      │                              │ validation bypass during plugin installation                 │
│                          │                │          │        │                      │                              │ https://avd.aquasec.com/nvd/cve-2026-33997                   │
├──────────────────────────┼────────────────┼──────────┤        ├──────────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤

The CVEs are fixed in a newer version of docker but looks like the github module has been changed to github.com/moby/moby and github.com/docker/docker is discontinued after v28.5.2.
Wanted to first check if this is already in plans for the next release. Due to the switch in module name, tackling this in a custom dockerfile isn't trivial either and hence raising this issue to fix this in the upstream dependency.

Steps to Reproduce

• Run a docker build of opentelemetry-operator from this repo
• Run trivy on the built image to find the above CVEs

Expected Result

Expecting to see no CVEs

Actual Result

Seeing two CVEs coming from github.com/docker/docker

┌──────────────────────────┬────────────────┬──────────┬────────┬──────────────────────┬──────────────────────────────┬──────────────────────────────────────────────────────────────┐
│         Library          │ Vulnerability  │ Severity │ Status │  Installed Version   │        Fixed Version         │                            Title                             │
├──────────────────────────┼────────────────┼──────────┼────────┼──────────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/docker/docker │ CVE-2026-34040 │ HIGH     │ fixed  │ v28.5.2+incompatible │ 29.3.1                       │ Moby has AuthZ plugin bypass when provided oversized request │
│                          │                │          │        │                      │                              │ bodies                                                       │
│                          │                │          │        │                      │                              │ https://avd.aquasec.com/nvd/cve-2026-34040                   │
│                          ├────────────────┼──────────┤        │                      │                              ├──────────────────────────────────────────────────────────────┤
│                          │ CVE-2026-33997 │ MEDIUM   │        │                      │                              │ moby: docker: github.com/moby/moby: Moby: Privilege          │
│                          │                │          │        │                      │                              │ validation bypass during plugin installation                 │
│                          │                │          │        │                      │                              │ https://avd.aquasec.com/nvd/cve-2026-33997                   │
├──────────────────────────┼────────────────┼──────────┤        ├──────────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤

Kubernetes Version

1.33.8

Operator version

0.148.0

Collector version

not-relevant

Environment information

Environment

Applies to any environment

Log output

Additional context

No response

Tip

_{React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it. Learn more here.}

[swiatekm]

Opentelemetry Operator is not affected by these vulnerabilities. github.com/docker/docker is a transitive dependency pulled in by the github.com/prometheus/prometheus/discovery package. It only uses the client side of the docker package, whereas the vulnerabilities affect the server side.

The operator binary itself shouldn't need to include the affected code at all, and an immediate improvement we can make is to ensure it doesn't. The target allocator binary technically doesn't need it, but with the way the discovery package is structured in prometheus, it may not be easy to get rid of it.

In any case, this isn't something we have control over. Prometheus needs to do it first, and since the update involves using the new docker client packages, we can't simply bump the version in our go.mod.

[swiatekm]

We might be able to get rid of a significant number of unnecessary dependencies if we restrict target allocator to only use Kubernetes Service Discovery. Currently we import all of them via https://github.com/prometheus/prometheus/blob/main/discovery/install/install.go, but Target Allocator only works for the Kubernetes targets either way. WDYT @open-telemetry/operator-approvers ?

[jaronoff97]

prometheus/prometheus#18433 prometheus has fixed this and we will bump when they cut a release