CVE-2026-47701High· 7.7▾ TwilightThe OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as HTTPClientConfig.Authorization.CredentialsFile. A tenant who can create or update a ServiceMonitor matched by serviceMonitorSelector and serviceMonitorNamespaceSelector can point bearerTokenFile at a file in the Collector pod, including /var/run/secrets/kubernetes.io/serviceaccount/token, and direct scraping to a tenant-controlled endpoint. The Collector reads that file at scrape time and sends its contents as bearer authorization on every scrape interval. Exploitation also requires the Collector service-account token or another sensitive file to be mounted and the Collector to reach the chosen target. The DenyFSAccessThroughSMs control was absent, allowing disclosure of the Collector's service-account JWT or other mounted files, and resulting Kubernetes API impact is limited by the Collector service account's permissions. This issue is fixed in version 0.152.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/open-telemetry/opentelemetry-operator < 0.152.0Patched in:
github.com/open-telemetry/opentelemetry-operator 0.152.0Source: https://github.com/advisories/GHSA-cxh2-4639-vmc5
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-81870Low· 2.0OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81871Medium· 6.3OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-47256Medium· 5.3OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs
CVE-2026-55701Medium· 6.9The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector
CVE-2026-81872Medium· 6.3OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81869Medium· 5.1OpenTelemetry-Go is the Go implementation of OpenTelemetry