CVE-2026-55701

Name of the Vulnerable Software and Affected Versions opentelemetry-collector-contrib (affected versions not specified)

Description The githubreceiver webhook handler fails to enforce the required headers configuration. While these headers are validated during startup, they are not checked on incoming requests in the handleReq() function. This issue is exacerbated because the Secret field defaults to empty and lacks validation; when empty, HMAC validation is skipped. Consequently, if an operator relies solely on required headers for authentication without setting a secret, the webhook endpoint remains entirely unauthenticated. This allows an attacker to send arbitrary webhook payloads to the endpoint and inject fake CI/CD trace data into the observability pipeline.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.