OpenTelemetry Operator's TargetAllocator watches ServiceMonitor resources via the Prometheus Operator CR watcher and converts each selected endpoint into a Prometheus scrape configuration entry. The endpoint field bearerTokenFile is preserved through the conversion as HTTPClientConfig.Authorization.CredentialsFile. A tenant who can create or update a ServiceMonitor selected by TargetAllocator can set bearerTokenFile to /var/run/secrets/kubernetes.io/serviceaccount/token and a scrape target the tenant controls. The Collector then ships its mounted service account JWT to that target on every scrape interval. Preconditions: the Collector must be deployed with targetAllocator.prometheusCR.enabled: true and serviceMonitorSelector matching a namespace where the attacker can create ServiceMonitor. The Collector pod must have its service account token mounted and be able to reach the attacker's scrape target. Fixed in opentelemetry-operator 0.152.0 via PR #5104 which adds DenyFSAccessThroughSMs support.