CVE-2026-42602 open-telemetry CVE debrief

Who should care

Organizations running OpenTelemetry Collector Contrib with the Azure Authenticator Extension (azureauthextension) versions 0.124.0 through 0.150.0, particularly those exposing OpenTelemetry receivers to networks where Azure access tokens may be obtainable by unauthorized parties. Security teams monitoring for authentication bypass vulnerabilities in cloud-native observability infrastructure, and Azure administrators responsible for managed identity and service principal scope governance.

Technical summary

The azureauthextension in OpenTelemetry Collector Contrib versions 0.124.0 to 0.150.0 contains a critical authentication bypass. The extension's Authenticate method does not perform JWT validation on incoming bearer tokens. It instead requests a new access token using its own configured credentials, using the client-supplied Host header to determine the token scope, then compares the client's token to this freshly minted token using string equality. An attacker with any valid Azure access token for any resource the collector's identity can access can replay that token against the collector by providing a matching Host header. The attack requires network access to the receiver and a valid token (low privilege bar), has no user interaction requirement, and results in complete authentication bypass with integrity and availability impact. Tokens are valid for their full lifetime, typically hours.

Defensive priority

HIGH

Recommended defensive actions

• Upgrade azureauthextension to a fixed version beyond 0.150.0 as indicated in the vendor security advisory.
• Review OpenTelemetry receiver configurations using auth: azure_auth and verify that only the intended Azure resources are in scope for the configured identity.
• Audit Azure AD sign-in logs and token issuance records for any anomalous token requests or usage patterns that may indicate exploitation.
• Implement network-level controls to restrict access to OpenTelemetry receivers to authorized hosts where architecture permits.
• Monitor for unexpected Host header values in requests to receivers using azure_auth authentication.
• Review and reduce the scopes and Azure resource permissions granted to the service principal or managed identity used by the collector to the minimum required.

Evidence notes

The NVD record lists CPE criteria for opentelemetry:opentelemetry_collector_contrib for Go, with vulnerable versions from 0.124.0 through 0.150.0 inclusive. The GitHub Security Advisory is cited as the primary reference with tags indicating it contains exploit information, mitigation steps, and vendor advisory content. Weaknesses enumerated include CWE-208 (Observable Timing Discrepancy), CWE-287 (Improper Authentication), CWE-290 (Authentication Bypass by Spoofing), CWE-294 (Authentication Bypass by Capture-replay), and CWE-347 (Improper Verification of Cryptographic Signature).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.