CVE-2026-47256

Name of the Vulnerable Software and Affected Versions opentelemetry-collector-contrib sentryexporter (affected versions not specified)

Description The Sentry exporter fails to validate the service.name resource attribute when constructing Sentry API URLs. Because this attribute is controlled by remote OTLP senders and the operator-configured bearer token is attached to every request, a crafted service name can be used to reach arbitrary Sentry API endpoints. This includes privileged admin, organization, and member endpoints within the configured Sentry organization.

Technical details include:

Exploitation can occur via query-string injection, where an attacker uses a service name like foo?injected query= to manipulate the request, or via path traversal using .. segments (depending on server-side normalization, such as nginx) to access restricted endpoints. Additionally, an attacker can redirect telemetry to an attacker-controlled Sentry project to exfiltrate operational data.

Recommendations Apply the projectSlugRegexp (or a similar runtime regex such as ^[a-zA-Z0-9 -]+$) to all runtime-derived slugs within the extractProjectSlug() function to reject invalid service names.

Alternatively, implement validation within the GetProjectKeys() function to ensure the projectSlug matches the required pattern before constructing the URL.

Apply runtime regex validation to all slug-derived URL components to prevent unauthorized API access.