CVE-2026-47701
Description
A flaw was found in OpenTelemetry Operator for Kubernetes. A tenant with permissions to create or update a ServiceMonitor resource can configure the bearerTokenFile field to point to the Collector's service account token path. This causes the Collector to send its mounted service account JSON Web Token (JWT) to an attacker-controlled scrape target. This vulnerability allows for information disclosure, potentially granting the attacker the same level of access as the OpenTelemetry Collector pod's service account within the Kubernetes API. This could lead to further enumeration and identification of targets, and potentially reading other sensitive files on the Collector pod.
Statement
A flaw was found in the OpenTelemetry Operator for Kubernetes. The TargetAllocator preserves the ServiceMonitor bearerTokenFile field through to the Collector's Prometheus scrape configuration. A tenant who can create or update a ServiceMonitor can set bearerTokenFile to the Collector's mounted service account token path, causing the Collector to send its JWT to an attacker-controlled scrape target on every scrape interval. Red Hat OpenShift distributed tracing 3.10 ships a fixed version of the operator (>= 0.152.0) and is not affected.
Mitigation
Upgrade to opentelemetry-operator 0.152.0 or later, which adds DenyFSAccessThroughSMs support to drop ServiceMonitor and PodMonitor endpoints that reference arbitrary files on the file system.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.7 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Changed | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Red Hat CVSS v3 Score Explanation
CNA score accepted. Authenticated tenant with ServiceMonitor write can exfiltrate Collector SA token via bearerTokenFile.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
