{"id":"CVE-2026-42602","revision":null,"records":[{"revision":"e7529666c8184a7193be2eaabb5a7a32","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-42602","aliases":[],"title":"azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay","description":"azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any OpenTelemetry receiver that uses auth: azure_auth. The extension's Authenticate method does not validate incoming bearer tokens as JWTs. Instead, it calls its own configured credential to obtain an access token and compares the client's token to the result with string equality — and the scope for that server-side token request is taken from the client-supplied Host header. As a result, a token minted for any Azure resource the service principal has ever been issued a token for (ARM, Graph, Key Vault, Storage, etc.) will authenticate to the collector if the attacker picks a matching Host. Tokens are replayable for the full issued lifetime (commonly several hours for managed identity tokens).","state":0,"publishedAt":"2026-05-13T20:12:18.936+00:00","modifiedAt":"2026-05-14T12:52:53.551+00:00","affected":[{"ecosystem":"Vendor product","name":"opentelemetry-collector-contrib","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"open-telemetry\",\n                    \"product\": \"opentelemetry-collector-contrib\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 0.124.0, <= 0.150.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","score":8.1,"severity":"HIGH"}],"references":["https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-pjv4-3c63-699f"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-42602","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-42602","identifiers":["CVE-2026-42602"]},"retained":false,"historicalAffected":[]},{"revision":"de180072dc944fb2ace78ee3e4dd0408","observedAt":"2026-10-28T05:15:25.086+00:00","statement":{"source":"euvd","id":"EUVD-2026-30160","aliases":["CVE-2026-42602","GHSA-pjv4-3c63-699f"],"title":"azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configure…","description":"azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any OpenTelemetry receiver that uses auth: azure_auth. The extension's Authenticate method does not validate incoming bearer tokens as JWTs. Instead, it calls its own configured credential to obtain an access token and compares the client's token to the result with string equality — and the scope for that server-side token request is taken from the client-supplied Host header. As a result, a token minted for any Azure resource the service principal has ever been issued a token for (ARM, Graph, Key Vault, Storage, etc.) will authenticate to the collector if the attacker picks a matching Host. Tokens are replayable for the full issued lifetime (commonly several hours for managed identity tokens).","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","score":8.1,"severity":null}],"references":["https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-pjv4-3c63-699f"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30160","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 13, 2026, 8:12:18 PM","dateUpdated":"May 14, 2026, 12:52:53 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-30160","identifiers":["EUVD-2026-30160","CVE-2026-42602","GHSA-pjv4-3c63-699f"]},"retained":false,"historicalAffected":[]},{"revision":"d05b8112bda34f298d99b3d19ff4b6fd","observedAt":"2026-10-27T11:12:04.713+00:00","statement":{"source":"nvd","id":"CVE-2026-42602","aliases":[],"title":"azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configure…","description":"azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any OpenTelemetry receiver that uses auth: azure_auth. The extension's Authenticate method does not validate incoming bearer tokens as JWTs. Instead, it calls its own configured credential to obtain an access token and compares the client's token to the result with string equality — and the scope for that server-side token request is taken from the client-supplied Host header. As a result, a token minted for any Azure resource the service principal has ever been issued a token for (ARM, Graph, Key Vault, Storage, etc.) will authenticate to the collector if the attacker picks a matching Host. Tokens are replayable for the full issued lifetime (commonly several hours for managed identity tokens).","state":0,"publishedAt":"2026-05-13T21:16:47.21+00:00","modifiedAt":"2026-10-26T14:10:00.13+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","score":8.1,"severity":"HIGH"}],"references":["https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-pjv4-3c63-699f"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42602","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-208","CWE-287","CWE-290","CWE-294","CWE-347"],"productCriteria":["cpe:2.3:a:opentelemetry:opentelemetry_collector_contrib:*:*:*:*:*:go:*:*"],"sourceDates":{"published":"2026-05-13T21:16:47.210","lastModified":"2026-10-26T14:10:00.130"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-42602","identifiers":["CVE-2026-42602"]},"retained":false,"historicalAffected":[]},{"revision":"fdf7a85ed1bd4194ae22c8d5e8a19c3b","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-pjv4-3c63-699f","aliases":["CVE-2026-42602","GO-2026-5544"],"title":"opentelemetry-collector-contrib's azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay","description":"### Summary\n\nA server-side authentication bypass in `azureauthextension` allows any party who holds a single valid Azure access token for *any scope the collector's configured identity can mint for* to authenticate to any OpenTelemetry receiver that uses `auth: azure_auth`. The extension's `Authenticate` method does not validate incoming bearer tokens as JWTs. Instead, it calls its own configured credential to obtain an access token and compares the client's token to the result with string equality — and the scope for that server-side token request is taken from the client-supplied `Host` header. As a result, a token minted for any Azure resource the service principal has ever been issued a token for (ARM, Graph, Key Vault, Storage, etc.) will authenticate to the collector if the attacker picks a matching `Host`. Tokens are replayable for the full issued lifetime (commonly several hours for managed identity tokens).\n\nSeverity: High (CVSS 8.1). See \"Threat model\" below for the preconditions that inform that score.\n\n### Root cause\n\nThe extension implements both `extensionauth.HTTPClient` (outbound: \"attach my identity to requests I send\") and `extensionauth.Server` (inbound: \"validate a credential someone presented to me\"). Those two interfaces look symmetric but are not: holding a credential to present says nothing about the ability to validate a credential someone else presents. The outbound path only requires `credential.GetToken()`; the inbound path requires JWT signature verification against the issuer's JWKS, issuer/audience/exp/nbf checks, and an algorithm allowlist — none of which the extension does.\n\nPR #39178 (\"Implement extensionauth.HTTPClient and extensionauth.Server interface functions\") added the `Server` path in v0.124.0 by reusing the same credential object and comparing strings. That server-side path is present in every release through v0.150.0. The outbound `HTTPClient` path (used by Azure exporters) is unaffected.\n\n### Details\n\nVulnerable code — `extension/azureauthextension/extension.go:208–235`:\n\n```go\nfunc (a *authenticator) Authenticate(ctx context.Context, headers map[string][]string) (context.Context, error) {\n    auth, err := getHeaderValue(\"Authorization\", headers)\n    if err != nil { return ctx, err }\n    host, err := getHeaderValue(\"Host\", headers)\n    if err != nil { return ctx, err }\n\n    authFormat := strings.Split(auth, \" \")\n    if len(authFormat) != 2 { /* ... */ }\n    if authFormat[0] != \"Bearer\" { /* ... */ }\n\n    token, err := a.getTokenForHost(ctx, host)   // asks the collector's own identity\n    if err != nil { return ctx, err }\n    if authFormat[1] != token {                  // string comparison, not JWT validation\n        return ctx, errors.New(\"unauthorized: invalid token\")\n    }\n    return ctx, nil\n}\n```\n\nAnd `getTokenForHost` at `extension.go:187–206`:\n\n```go\noptions := policy.TokenRequestOptions{\n    Scopes: []string{\n        fmt.Sprintf(\"https://%s/.default\", host),   // client-supplied Host chooses scope\n    },\n}\n```\n\nTwo independent problems compose here:\n\n**1. No JWT validation.** Real Entra ID bearer validation requires verifying the JWT signature against the tenant JWKS and checking `iss`, `aud`, `exp`, `nbf`, plus an algorithm allowlist. The extension does none of this. The \"expected\" value is a token the server mints from its own credential, not a signature to verify. Any party that already holds a valid token for the collector's identity — a co-tenant pod that shares the managed identity, any peer authenticated with the same service principal, any component that retained an `Authorization:` header — can replay it directly.\n\n**2. Attacker-controlled audience.** The scope used to mint the \"expected\" token comes from the client-supplied `Host` header: `https://<Host>/.default`. The `azcore` credential returns a consistent token per (identity, scope) pair within the cache window, so an attacker can pick any scope the SP has been issued a token for and match it by setting `Host` accordingly. This is the sharper of the two flaws: it means a token leaked from an unrelated Azure integration — ARM, Graph, Key Vault, a different Storage account — authenticates to the collector.\n\nThe correct primitive is a real JWT validator — e.g. `github.com/coreos/go-oidc/v3` pointed at the tenant's discovery endpoint, with audience and issuer pinned *server-side from configuration*, never derived from request headers.\n\n### Proof of concept\n\nBoth variants assume a collector running with `azureauthextension` v0.124.0–v0.150.0, configured with any credential mode and referenced from a receiver's `auth:` block:\n\n```yaml\nextensions:\n  azure_auth:\n    managed_identity:\n      client_id: ${CLIENT_ID}\n\nreceivers:\n  otlp:\n    protocols:\n      http:\n        endpoint: 0.0.0.0:4318\n        auth:\n          authenticator: azure_auth\n\nservice:\n  extensions: [azure_auth]\n  pipelines:\n    traces:\n      receivers: [otlp]\n      exporters: [debug]\n```\n\n#### Variant A — Replay (same scope)\n\nThe attacker controls a workload that shares the collector's managed identity (common in AKS when multiple pods bind the same UAMI). Both workloads query IMDS for `https://management.azure.com/.default` and receive the same cached token. The attacker replays:\n\n```\nPOST /v1/traces HTTP/1.1\nHost: management.azure.com\nAuthorization: Bearer eyJ...            # token minted for management.azure.com\nContent-Type: application/json\n\n{\"resourceSpans\":[...]}\n```\n\n`Authenticate` calls `getTokenForHost(ctx, \"management.azure.com\")`, receives the identical cached token, and the string comparison passes.\n\n#### Variant B — Scope confusion (the stronger case)\n\nThe attacker holds a token for the SP issued for a *different* Azure resource — say Key Vault, obtained from an entirely unrelated integration. The collector was never intended to accept Key Vault tokens. The attacker sets `Host` to match:\n\n```\nPOST /v1/traces HTTP/1.1\nHost: vault.azure.net\nAuthorization: Bearer eyJ...            # token minted for vault.azure.net\nContent-Type: application/json\n\n{\"resourceSpans\":[...]}\n```\n\n`Authenticate` calls `getTokenForHost(ctx, \"vault.azure.net\")`. The collector's credential mints (or returns cached) a token for `https://vault.azure.net/.default` — the same token the attacker holds, because both come from the same SP issued for the same scope by the same IdP. Comparison passes. The collector accepts telemetry gated on \"proof of identity to Key Vault.\"\n\nIn a correct implementation, the JWT's `aud` would be pinned server-side to a value unrelated to `Host`, and Variant B would fail regardless of what the attacker put in the `Host` header.\n\nA small Go reproducer can be built around the extension's own test harness: the existing `TestAuthenticate` in `extension_test.go` is effectively a demonstration of the broken behavior — it passes when the client-supplied token equals the server-side token for the given `Host`, which is exactly what an attacker arranges.\n\n### Impact\n\n**Vulnerability class:** Improper Authentication (CWE-287), with contributing CWE-347 (Improper Verification of Cryptographic Signature — no JWT validation), CWE-294 (Authentication Bypass by Capture-replay — tokens replayable for full TTL), and CWE-290 (Authentication Bypass by Spoofing — client `Host` header chooses the expected scope).\n\n**Threat model / precondition.** The attacker needs to already hold (or be able to obtain) a valid Azure access token issued to the collector's SP for any scope. In practice this is satisfied by: (a) controlling another workload that binds the same managed identity, (b) compromising any peer authenticated with the same SP, or (c) observing an `Authorization:` header from any prior legitimate request for the SP. This is what drives the 8.1 score — the precondition is non-trivial but is routine in multi-workload Azure environments.\n\n**Who is impacted.** Any operator of `opentelemetry-collector-contrib` v0.124.0 through v0.150.0 who configured `azureauthextension` on a receiver's `auth:` block. This applies to both HTTP and gRPC receivers — gRPC receivers surface `:authority` as `Host` through the collector's header handling, so the same exploit path applies there.\n\n**Deployments most at risk:**\n- Multi-workload Azure environments where the collector shares a managed identity with other workloads (any such workload can authenticate as an arbitrary telemetry source).\n- Deployments that forward `Authorization:` headers through proxies, service meshes, or logging pipelines (one leaked token is enough, and persists for the token TTL — typically several hours for MI tokens, not the 60-minute user-token window).\n- Multi-tenant environments where different customers' telemetry converges at a collector protected by this extension.\n\n**Consequences.** Unauthenticated (from the collector's perspective) ingest of arbitrary traces, metrics, and logs. Downstream effects depend on the collector's exporters and include telemetry-backend poisoning, log injection (masking real attacker activity in SIEMs), metric manipulation to trigger or suppress alerts, cost-amplification against pay-per-datapoint backends, and adversarial traces that corrupt service-graph and incident-triage signals.\n\n**Not impacted.** The extension's outbound `extensionauth.HTTPClient` path, used by Azure exporters, is unaffected. Operators who use `azureauthextension` only on exporters can continue doing so.\n\n### Mitigation\n\nUntil a patched release is available, remove `azure_auth` from any receiver `auth:` blocks. For genuine Entra ID JWT validation on OTLP receivers, use `oidcauthextension` pointed at the tenant discovery URL, with audience pinned from configuration:\n\n```yaml\nextensions:\n  oidc:\n    issuer_url: https://login.microsoftonline.com/<tenant-id>/v2.0\n    audience: <expected-api-audience>\n```\n\n### Resources\n\n- PR introducing the vulnerable server-side path: [#39178](https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/39178)\n- Affected versions: v0.124.0 – v0.150.0\n\nAssisted-by: Opus 4.7","state":0,"publishedAt":"2026-05-06T22:32:43+00:00","modifiedAt":"2026-09-10T03:51:06.7130717+00:00","affected":[{"ecosystem":"Go","name":"github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.124.0"},{"kind":"last_affected","version":"0.150.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-pjv4-3c63-699f","https://nvd.nist.gov/vuln/detail/CVE-2026-42602","https://github.com/open-telemetry/opentelemetry-collector-contrib"],"sourceUrl":"https://github.com/advisories/GHSA-pjv4-3c63-699f","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-pjv4-3c63-699f","identifiers":["GHSA-pjv4-3c63-699f","CVE-2026-42602","GO-2026-5544"]},"retained":false,"historicalAffected":[]},{"revision":"10e9387c56ab4eccb07386a7946996a9","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5544","aliases":["CVE-2026-42602","GHSA-pjv4-3c63-699f"],"title":"Authenticate method auth bypass in github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension","description":"Authenticate method auth bypass in github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension","state":0,"publishedAt":"2026-06-25T22:34:34+00:00","modifiedAt":"2026-10-01T20:45:09.6828639+00:00","affected":[{"ecosystem":"Go","name":"github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.124.0"},{"kind":"fixed","version":"0.151.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-pjv4-3c63-699f"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5544","license":"OSV · upstream source license applies","key":"osv:GO-2026-5544","identifiers":["GO-2026-5544","CVE-2026-42602","GHSA-pjv4-3c63-699f"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-28T08:06:21.3224229+00:00","complete":true,"records":1760,"lastAttemptAt":"2026-10-28T08:06:21.3224229+00:00","lastSuccessAt":"2026-10-28T08:06:21.4738044+00:00","error":null,"lastVerifiedAt":"2026-10-28T08:06:21.473805+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-d2186f400c54d65f61687f78bb1a00d184d2e215877d0194d7ed70caee809a44-d3e81f89111bb0d33cac14dd0db97453c7217c57124333cc944f6fba75122549","complete":true,"records":415603,"lastAttemptAt":"2026-10-28T08:06:20.8316261+00:00","lastSuccessAt":"2026-10-28T08:06:20.7809924+00:00","error":null,"lastVerifiedAt":"2026-10-28T08:06:20.8316261+00:00","snapshotPublishedAt":"2026-10-28T07:25:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-bb16e205630d4b0ba1f570ba3b772f14","complete":false,"records":12181,"lastAttemptAt":"2026-10-28T08:17:51.3532496+00:00","lastSuccessAt":"2026-10-28T08:17:51.348+00:00","error":"18 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-10-28T08:17:51.348+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":7482,"expectedIdentifiers":13514,"failedIdentifiers":18},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-28T08:06:21.3224229+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-28T08:06:21.3224229+00:00","lastSuccessAt":"2026-10-28T08:06:21.4745901+00:00","error":null,"lastVerifiedAt":"2026-10-28T08:06:21.4745902+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-8d16a738328646698f9217d8ea11893c","complete":true,"records":13449,"lastAttemptAt":"2026-10-28T08:06:22.1670852+00:00","lastSuccessAt":"2026-10-27T22:48:29.491+00:00","error":null,"lastVerifiedAt":"2026-10-27T22:48:29.491+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13514,"expectedIdentifiers":13514,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-f7cb12508d9e6a348c8a60f772ed85529cc80cd2ff853da1099b57754b20e943","complete":true,"records":9790,"lastAttemptAt":"2026-10-28T08:06:21.1851365+00:00","lastSuccessAt":"2026-10-27T21:49:03.9756799+00:00","error":null,"lastVerifiedAt":"2026-10-28T08:06:21.1851365+00:00","snapshotPublishedAt":"2026-10-27T21:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-72e5e79de0026dd0562d40734074a2236a06886643d67182b8381eaee757dbf7","complete":true,"records":1966,"lastAttemptAt":"2026-10-28T08:06:20.9821116+00:00","lastSuccessAt":"2026-10-27T21:46:38.0277323+00:00","error":null,"lastVerifiedAt":"2026-10-28T08:06:20.9821116+00:00","snapshotPublishedAt":"2026-10-27T21:18:15+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-3a5b306d60fc44677a03a8afc99d87e6c5402770ef68d560f94a8c3ad3802b75","complete":true,"records":3001,"lastAttemptAt":"2026-10-28T08:06:21.2896994+00:00","lastSuccessAt":"2026-10-27T16:45:49.0050993+00:00","error":null,"lastVerifiedAt":"2026-10-28T08:06:21.2896994+00:00","snapshotPublishedAt":"2026-10-27T16:33:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-cf3d7f231228fbafaf00b899a3529c24d9add8aab904e519be8d085668fa0c9c","complete":true,"records":230856,"lastAttemptAt":"2026-10-28T08:06:21.0816412+00:00","lastSuccessAt":"2026-10-28T07:08:12.8687117+00:00","error":null,"lastVerifiedAt":"2026-10-28T08:06:21.0816412+00:00","snapshotPublishedAt":"2026-10-28T06:48:05+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}