github.com/open-telemetry/opentelemetry-operator

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

1. High, CVSS 7.7GoPublished 10 Jun 2026

   OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

   CVE-2026-47701 · GHSA-cxh2-4639-vmc5

   Affected

   • Go github.com/open-telemetry/opentelemetry-operator < 0.152.0

   Fixed in

   0.152.0· Vendor fix available

   Issue

   Affected Repository: github.com/open-telemetry/opentelemetry-operator Component: cmd/otel-allocator (TargetAllocator) Companion: Prometheus Operator API types (CRDs) Summary OpenTelemetry Operator's TargetAllocator watches ServiceMonitor resources via the Prometheus Operator CR watcher and converts each selected endpoint into a Prometheus scrape configuration entry. The endpoint field bearerTokenFile is preserved through the conversion as HTTPClientConfig.Authorization.CredentialsFile. The OpenTelemetry Collector, configured with the Prometheus receiver, then loads that scrape config and, at scrape time, reads the file from its own pod filesystem and sends the contents as Authorization: Bearer ... to the scrape endpoint. A tenant who can create or update a ServiceMonitor selected by TargetAllocator can set bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token and a scrape target the tenant controls. The Collector then ships its mounted service account JWT to that…

   Recommended action: Upgrade to 0.152.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:github.comSource checked 26 Oct 2026, 15:23 UTCEvidence →