open-telemetry opentelemetry-collector-contrib up to 0.150.0 azure_auth authentication spoofing

Summaryinfo

A vulnerability categorized as critical has been discovered in open-telemetry opentelemetry-collector-contrib up to 0.150.0. This affects the function azure_auth. Such manipulation leads to authentication spoofing. This vulnerability is listed as CVE-2026-42602. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as critical, has been found in open-telemetry opentelemetry-collector-contrib up to 0.150.0. Affected by this issue is the function azure_auth. The manipulation with an unknown input leads to a authentication spoofing vulnerability. Using CWE to declare the problem leads to CWE-290. This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. Impacted is confidentiality, integrity, and availability. CVE summarizes:

azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any OpenTelemetry receiver that uses auth: azure_auth. The extension's Authenticate method does not validate incoming bearer tokens as JWTs. Instead, it calls its own configured credential to obtain an access token and compares the client's token to the result with string equality — and the scope for that server-side token request is taken from the client-supplied Host header. As a result, a token minted for any Azure resource the service principal has ever been issued a token for (ARM, Graph, Key Vault, Storage, etc.) will authenticate to the collector if the attacker picks a matching Host. Tokens are replayable for the full issued lifetime (commonly several hours for managed identity tokens).

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-42602 since 04/29/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 05/14/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• open-telemetry

Name

• opentelemetry-collector-contrib

Version

• 0.150

Website

• Product: https://github.com/open-telemetry/opentelemetry-collector-contrib/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion