Authentication Bypass Vulnerability in OpenTelemetry Collector by OpenTelemetry
CVE-2026-55701
What is CVE-2026-55701?
The OpenTelemetry Collector Contrib contains a serious security flaw due to insufficient validation of webhook headers in its githubreceiver component prior to version 0.151.0. This vulnerability allows unauthenticated senders to submit arbitrary payloads, bypassing required headers authentication controls. If the Secret field is empty, the HMAC validation is also skipped, exposing the endpoint to unauthorized access and potential injection of malicious CI/CD trace data into the observability pipeline. This issue highlights the importance of ensuring proper validation mechanisms to maintain secure integrations. The vulnerability was addressed in version 0.151.0, which reinforces authentication methods for incoming webhook requests.
Affected Version(s)
github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver < 0.151.0
opentelemetry-collector-contrib < 0.151.0