The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as HTTPClientConfig.Authorization.CredentialsFile. A tenant who can create or update a ServiceMonitor matched by serviceMonitorSelector and serviceMonitorNamespaceSelector can point bearerTokenFile at a file in the Collector pod, including /var/run/secrets/kubernetes.io/serviceaccount/token, and direct scraping to a tenant-controlled endpoint. The Collector reads that file at scrape time and sends its contents as bearer authorization on every scrape interval. Exploitation also requires the Collector service-account token or another sensitive file to be mounted and the Collector to reach the chosen target. The DenyFSAccessThroughSMs control was absent, allowing disclosure of the Collector's service-account JWT or other mounted files, and resulting Kubernetes API impact is limited by the Collector service account's permissions. This issue is fixed in version 0.152.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0,
    cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true
    preserve a selected ServiceMonitor endpoint's bearerTokenFile value as
    HTTPClientConfig.Authorization.CredentialsFile. A tenant who can create or update a ServiceMonitor matched
    by serviceMonitorSelector and serviceMonitorNamespaceSelector can point bearerTokenFile at a file in the
    Collector pod, including /var/run/secrets/kubernetes.io/serviceaccount/token, and direct scraping to a
    tenant-controlled endpoint. The Collector reads that file at scrape time and sends its contents as bearer
    authorization on every scrape interval. Exploitation also requires the Collector service-account token or
    another sensitive file to be mounted and the Collector to reach the chosen target. The
    DenyFSAccessThroughSMs control was absent, allowing disclosure of the Collector's service-account JWT or
    other mounted files, and resulting Kubernetes API impact is limited by the Collector service account's
    permissions. This issue is fixed in version 0.152.0. (CVE-2026-47701)

ID	Name	Product	Family	Type	Severity
462283	Echo: github.com/open-telemetry/opentelemetry-operator: security update to 0.152.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
462283	Echo: github.com/open-telemetry/opentelemetry-operator: security update to 0.152.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
443044	SCA: security update for github.com/open-telemetry/opentelemetry-operator (GHSA-cxh2-4639-vmc5)	Tenable Cloud Security	SCA Checks	Local	high
443044	SCA: security update for github.com/open-telemetry/opentelemetry-operator (GHSA-cxh2-4639-vmc5)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-47701

high

Tenable Plugins

high

high

high

high