Sentry Exporter Vulnerability in OpenTelemetry Framework
CVE-2026-47256
What is CVE-2026-47256?
The Sentry exporter in OpenTelemetry before version 0.154.0 is vulnerable to improper input validation, specifically in how it handles the service.name resource attribute from a remote OTLP sender. The vulnerability arises as the raw project slug is sent to critical API endpoints without sufficient validation, allowing for the introduction of special characters that can manipulate the API request path. This opens a pathway for attackers to control project slugs, potentially redirecting telemetry data and accessing administrative endpoints in the Sentry organization, which could lead to unauthorized data exposure. This issue has been addressed in version 0.154.0, and users are recommended to update their OpenTelemetry Collector immediately to mitigate risks.
Affected Version(s)
github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter < 0.154.0
opentelemetry-collector-contrib < 0.154.0