The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/trace_receiver.go handleReq() does not check those headers on incoming webhook requests. An unauthenticated sender can therefore bypass an operator's required_headers authentication control and submit arbitrary webhook payloads. When the Secret field is empty, github.ValidatePayload also skips HMAC validation, leaving the webhook endpoint without either configured authentication mechanism. Successful exploitation can inject fabricated CI/CD trace data into the observability pipeline. This issue is fixed in version 0.151.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior
    to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders
    configuration at startup, but receiver/githubreceiver/trace_receiver.go handleReq() does not check those
    headers on incoming webhook requests. An unauthenticated sender can therefore bypass an operator's
    required_headers authentication control and submit arbitrary webhook payloads. When the Secret field is
    empty, github.ValidatePayload also skips HMAC validation, leaving the webhook endpoint without either
    configured authentication mechanism. Successful exploitation can inject fabricated CI/CD trace data into
    the observability pipeline. This issue is fixed in version 0.151.0. (CVE-2026-55701)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior     to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders     configuration at startup, but receiver/githubreceiver/trace_receiver.go handleReq() does not check those     headers on incoming webhook requests. An unauthenticated sender can therefore bypass an operator's     required_headers authentication control and submit arbitrary webhook payloads. When the Secret field is     empty, github.ValidatePayload also skips HMAC validation, leaving the webhook endpoint without either     configured authentication mechanism. Successful exploitation can inject fabricated CI/CD trace data into     the observability pipeline. This issue is fixed in version 0.151.0. (CVE-2026-55701)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
459151	Echo: github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver: security update to 0.151.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459151	Echo: github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver: security update to 0.151.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
349284	Linux Distros Unpatched Vulnerability : CVE-2026-55701	Nessus	Misc.	Local	medium
443465	SCA: security update for github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver (GHSA-w5cv-pw74-4rxc)	Tenable Cloud Security	SCA Checks	Local	medium
443465	SCA: security update for github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver (GHSA-w5cv-pw74-4rxc)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-55701

medium

Tenable Plugins

medium

medium

medium

medium

medium