7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47701

CVE-2026-47701: OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

Affected

Repository: github.com/open-telemetry/opentelemetry-operator Component: cmd/otel-allocator (TargetAllocator) Companion: Prometheus Operator API types (CRDs)

Summary

OpenTelemetry Operator's TargetAllocator watches ServiceMonitor resources via the Prometheus Operator CR watcher and converts each selected endpoint into a Prometheus scrape configuration entry. The endpoint field bearerTokenFile is preserved through the conversion as HTTPClientConfig.Authorization.CredentialsFile. The OpenTelemetry Collector, configured with the Prometheus receiver, then loads that scrape config and, at scrape time, reads the file from its own pod filesystem and sends the contents as Authorization: Bearer ... to the scrape endpoint.

A tenant who can create or update a ServiceMonitor selected by TargetAllocator can set bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token and a scrape target the tenant controls. The Collector then ships its mounted service account JWT to that target on every scrape interval.

The Prometheus Operator project addressed the same primitive via the ArbitraryFSAccessThroughSMs.Deny admission/runtime guard.

Preconditions

The OpenTelemetry Collector needs to be deployed with targetAllocator.prometheusCR.enabled: true and serviceMonitorSelector / serviceMonitorNamespaceSelector matching at least one namespace where the attacker can create or update ServiceMonitor (or paired with a TargetAllocator resource with the same respective settings). The Collector pod needs to have its service account token mounted. The Collector needs to be able to reach the scrape target chosen by the attacker.

Impact

Tenant ServiceMonitor write becomes equivalent to the OpenTelemetry Collector pod's service account against the Kubernetes API. Real impact depends on what the Collector service account is granted in a given deployment. Typical cluster monitoring setups grant pod, node, endpoint, namespace, and service list across the cluster, which is enough to enumerate and identify further targets. The same primitive can read any file the Collector pod has on disk including mounted certificates and other tokens.

Miggo Vulnerability Database

→

CVE-2026-47701

CVE-2026-47701:

7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/open-telemetry/opentelemetry-operator	go	< 0.152.0	0.152.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-cxh2-4639-vmc5, allows for arbitrary file reads in the OpenTelemetry Operator for Kubernetes. This is due to the improper handling of the bearerTokenFile field in ServiceMonitor and PodMonitor resources. An attacker with permissions to create or modify these resources can specify a path to a sensitive file on the Collector's pod. The TargetAllocator component of the operator would then instruct the Collector to read this file and use its contents as a bearer token for scraping metrics, effectively exfiltrating the file's content.

The patch for this vulnerability introduces a new configuration option, DenyFSAccessThroughSMs. When enabled, this feature activates a filtering mechanism within the PrometheusCRWatcher.LoadConfig function. The core of the fix is in the newly added filterScrapeConfigs and deniedFSAccessReason functions. These functions inspect the generated scrape configurations and drop any that use bearerTokenFile, tlsConfig.caFile, tlsConfig.certFile, or tlsConfig.keyFile, thus preventing the arbitrary file read. The primary vulnerable function is PrometheusCRWatcher.LoadConfig because it is the function responsible for generating the insecure configuration before the patch was applied.

Vulnerable functions

github.com/open-telemetry/opentelemetry-operator/cmd/otel-allocator/internal/watcher.PrometheusCRWatcher.LoadConfig

cmd/otel-allocator/internal/watcher/promOperator.go

This function is responsible for processing `ServiceMonitor` and `PodMonitor` custom resources and converting them into Prometheus scrape configurations. Before the patch, it did not validate the `bearerTokenFile` field, which could be abused by a user with permissions to create or edit these resources. By setting `bearerTokenFile` to a sensitive file path (e.g., a service account token), an attacker could cause the OpenTelemetry Collector to read that file and send its contents as a bearer token to a target controlled by the attacker. The vulnerability lies in the lack of validation within this function, which processes the untrusted configuration.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.