Medium, CVSS 6.9GoPublished
opentelemetry-collector-contrib: githubreceiver silently ignores configured required_headers authentication
CVE-2026-55701 · GHSA-w5cv-pw74-4rxc
- Affected
- Go github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver <= 0.150.0
- Fixed in
- 0.151.0· Vendor fix available
- Issue
- githubreceiver Silently Ignores Configured requiredheaders Authentication Summary The githubreceiver webhook handler does not enforce the requiredheaders configuration. Headers are validated at startup (config rejects empty keys/values) but never checked on incoming requests. This follows the same pattern as GHSA-prf6-xjxh-p698 (awsfirehosereceiver auth bypass). Verified against current main. Details In receiver/githubreceiver/config.go, the RequiredHeaders field is defined (line 45) and validated at startup (lines 93-101). But receiver/githubreceiver/tracereceiver.go in handleReq() (lines 131-185) never references RequiredHeaders. The gitlabreceiver enforces the same config correctly at receiver/gitlabreceiver/tracesreceiver.go:266-270: for key, value := range gtr.cfg.WebHook.RequiredHeaders { if r.Header.Get(key) != string(value) { return "", fmt.Errorf("%w: %s", errInvalidHeader, key) } } Amplifying factor The Secret field defaults to empty and has no validation requiring it to be…
Recommended action: Upgrade to 0.151.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.