CVE-2026-47701

Name of the Vulnerable Software and Affected Versions opentelemetry-operator (affected versions not specified)

Description The TargetAllocator in the OpenTelemetry Operator processes ServiceMonitor resources and converts endpoints into Prometheus scrape configurations. A tenant with permissions to create or update a ServiceMonitor can specify the bearerTokenFile parameter to point to sensitive files on the Collector pod's filesystem, such as /var/run/secrets/kubernetes.io/serviceaccount/token. During the scrape process, the OpenTelemetry Collector reads the contents of the specified file and sends it as a Bearer token to a target controlled by the attacker. This allows an attacker to steal the Collector pod's service account JWT or read any other file accessible to the pod, potentially enabling unauthorized access to the Kubernetes API depending on the permissions granted to the Collector's service account.

Recommendations Enable the DenyFSAccessThroughSMs setting to ensure the Target Allocator drops ServiceMonitor and PodMonitor endpoints that reference arbitrary files on the file system, specifically those using bearerTokenFile, tlsConfig.caFile, tlsConfig.certFile, or tlsConfig.keyFile.