Bug 2499680 (CVE-2026-47701)

Summary:	CVE-2026-47701 opentelemetry-operator: OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	mwringe
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in OpenTelemetry Operator for Kubernetes. A tenant with permissions to create or update a ServiceMonitor resource can configure the `bearerTokenFile` field to point to the Collector's service account token path. This causes the Collector to send its mounted service account JSON Web Token (JWT) to an attacker-controlled scrape target. This vulnerability allows for information disclosure, potentially granting the attacker the same level of access as the OpenTelemetry Collector pod's service account within the Kubernetes API. This could lead to further enumeration and identification of targets, and potentially reading other sensitive files on the Collector pod.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-13 14:36:03 UTC

OpenTelemetry Operator's TargetAllocator watches ServiceMonitor resources via the Prometheus Operator CR watcher and converts each selected endpoint into a Prometheus scrape configuration entry. The endpoint field bearerTokenFile is preserved through the conversion as HTTPClientConfig.Authorization.CredentialsFile. A tenant who can create or update a ServiceMonitor selected by TargetAllocator can set bearerTokenFile to /var/run/secrets/kubernetes.io/serviceaccount/token and a scrape target the tenant controls. The Collector then ships its mounted service account JWT to that target on every scrape interval. Preconditions: the Collector must be deployed with targetAllocator.prometheusCR.enabled: true and serviceMonitorSelector matching a namespace where the attacker can create ServiceMonitor. The Collector pod must have its service account token mounted and be able to reach the attacker's scrape target. Fixed in opentelemetry-operator 0.152.0 via PR #5104 which adds DenyFSAccessThroughSMs support.