CVE-2026-55701
Received Received - Intake

Authentication Bypass in OpenTelemetry Collector Contrib

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/trace_receiver.go handleReq() does not check those headers on incoming webhook requests. An unauthenticated sender can therefore bypass an operator's required_headers authentication control and submit arbitrary webhook payloads. When the Secret field is empty, github.ValidatePayload also skips HMAC validation, leaving the webhook endpoint without either configured authentication mechanism. Successful exploitation can inject fabricated CI/CD trace data into the observability pipeline. This issue is fixed in version 0.151.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-55701
EUVD
EUVD-2026-78778

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
open_telemetry githubreceiver to 0.151.0 (exc)
open_telemetry githubreceiver 0.151.0
open_telemetry opentelemetry_collector_contrib to 0.151.0 (exc)
open_telemetry opentelemetry_collector_contrib 0.151.0
opentelemetry collector_contrib 0.151.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the githubreceiver component in the OpenTelemetry Collector Contrib. The issue is that while the configuration validates required headers at startup, it fails to enforce them during incoming webhook requests. This allows unauthenticated attackers to bypass authentication controls and submit arbitrary webhook payloads without proper headers.

Detection Guidance

Check if your OpenTelemetry Collector Contrib version is below 0.151.0. Inspect githubreceiver configuration for required_headers settings. Monitor webhook endpoints for requests missing configured headers. Use network logs to detect unauthorized payload submissions.

Impact Analysis

An attacker can exploit this to inject fabricated CI/CD trace data into the observability pipeline without authentication. This could lead to false data in monitoring systems, misleading security or performance analysis, and potential compromise of trace integrity.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized data injection into monitoring systems. For GDPR, it may affect data integrity and audit trails. For HIPAA, it could compromise trace data used in healthcare operations. Unauthorized data changes may violate integrity and access control requirements.

Mitigation Strategies

Upgrade OpenTelemetry Collector Contrib to version 0.151.0 or later. Ensure githubreceiver required_headers configuration is properly enforced. Review and block unauthorized webhook payloads. Verify authentication mechanisms are active on all endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55701. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart