CVE-2026-47256
Received Received - Intake

Path Traversal in OpenTelemetry Sentry Exporter

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource attribute in exporter/sentryexporter/sentry_exporter.go through extractProjectSlug and getOrCreateProjectEndpoint, passes the raw project slug to GetOTLPEndpoints and GetProjectKeys in exporter/sentryexporter/sentry_client.go, and interpolates it into a Sentry API URL without applying projectSlugRegexp through validateRoutingConfig at runtime in exporter/sentryexporter/config.go. Special characters can turn the expected path suffix into query data in all deployments or introduce slash and dot segments that traverse paths when the Sentry deployment normalizes them, while the Collector attaches its operator-configured bearer token to the request. A successful request can reach token-authorized administrative, organization, member, or key endpoints within the configured Sentry organization, and an attacker-controlled project slug can redirect subsequently exported telemetry. Sentry token middleware prevents cross-organization access. This issue is fixed in version 0.154.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-47256
EUVD
EUVD-2026-77692

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
open_telemetry opentelemetry_collector_contrib 0.154.0
open_telemetry opentelemetry_collector_contrib to 0.154.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal and injection vulnerability in OpenTelemetry's Sentry exporter. The issue occurs because the exporter uses a remote sender-controlled attribute (service.name) to construct Sentry API URLs without proper validation. Attackers can manipulate this attribute to inject special characters or path segments, potentially redirecting requests to unauthorized administrative endpoints within the configured Sentry organization.

Detection Guidance

To detect this vulnerability, inspect OpenTelemetry Collector Contrib logs for unusual Sentry API requests. Check for service.name attributes containing special characters like /, ?, or .. in spans. Monitor network traffic for unexpected API calls to Sentry endpoints with admin or member paths.

Impact Analysis

An attacker could access sensitive data or perform administrative actions within your Sentry organization by exploiting this flaw. They might read confidential information, modify settings, or gain unauthorized access to endpoints like admin, organization, or member APIs using the collector's bearer token.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of personal or health data due to path traversal or injection may result in compliance breaches, regulatory penalties, and loss of trust.

Mitigation Strategies

Upgrade to OpenTelemetry Collector Contrib v0.154.0 or later. Review and restrict service.name attributes from untrusted sources. Implement network-level controls to block unauthorized Sentry API access. Validate all Sentry exporter configurations for proper slug handling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47256. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart