Skip to content
fr Sign in
6.9 Medium

CVE-2026-55701 The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector

Description

The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/trace_receiver.go handleReq() does not check those headers on incoming webhook requests. An unauthenticated sender can therefore bypass an operator's required_headers authentication control and submit arbitrary webhook payloads. When the Secret field is empty, github.ValidatePayload also skips HMAC validation, leaving the webhook endpoint without either configured authentication mechanism. Successful exploitation can inject fabricated CI/CD trace data into the observability pipeline. This issue is fixed in version 0.151.0.

Affected products and versions

Product Affected versions Fixed in
opentelemetry-collector-contrib 0.151 earliest → < 0.151.0 0.151.0
github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver 0.151 earliest → < 0.151.0 0.151.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of opentelemetry-collector-contrib

The 5 CVEs of opentelemetry-collector-contrib →
CVE-2026-47256 OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting,… 5.3 Medium CVE-2026-42602 azureauthextension is the Azure Authenticator Extension 8.1 High CVE-2024-45043 The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose delivery stream… 5.3 Medium CVE-2024-42368 OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting,… 6.5 Medium
Track this CVE