CLEANSTART-2026-AD88612: opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API

Q: Which deployed products should be prioritized for review?

The affected software list identifies cleanstart/elasticsearch and cleanstart/sonarqube. Review deployments of those products for the affected OpenTelemetry Java components.

Q: Does the advisory provide affected versions, configuration prerequisites, or temporary mitigations?

No. The provided data does not specify affected versions, exploit prerequisites, default-configuration impact, indicators of compromise, or compensating controls.

Published Nov 7, 2026

Updated

CVE-2026-118259 affects multiple packages. opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. See references for individual vulnerability details.

Affected Software

6 affected componentsFixes available

cleanstart/sonarqube<26.7.0.124771-r11

26.7.0.124771-r11

cleanstart/sonarqube<26.8.0.126808-r6

26.8.0.126808-r6

cleanstart/elasticsearch<9.2.8-r11

9.2.8-r11

cleanstart/elasticsearch<9.5.5-r2

9.5.5-r2

cleanstart/elasticsearch<9.5.5-r3

9.5.5-r3

cleanstart/elasticsearch<9.3.8-r14

9.3.8-r14

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.7.0.124771-r11
Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.8.0.126808-r6
Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.2.8-r11
Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.5.5-r2
Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.5.5-r3
Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.3.8-r14
Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.3.8-r15

Event History

Nov 7, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-118259

Frequently Asked Questions

Which deployed products should be prioritized for review?

The affected software list identifies cleanstart/elasticsearch and cleanstart/sonarqube. Review deployments of those products for the affected OpenTelemetry Java components.

Does the advisory provide affected versions, configuration prerequisites, or temporary mitigations?

No. The provided data does not specify affected versions, exploit prerequisites, default-configuration impact, indicators of compromise, or compensating controls.

CLEANSTART-2026-AD88612: opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployed products should be prioritized for review?

Does the advisory provide affected versions, configuration prerequisites, or temporary mitigations?

Company

Resources

Contact

Frequently Asked Questions

Which deployed products should be prioritized for review?

Does the advisory provide affected versions, configuration prerequisites, or temporary mitigations?