CVE-2026-42602 - Vulnerability Analysis

Overview

azureauthextension 0.124.0 to 0.150.0 contains a server-side authentication bypass caused by improper validation of bearer tokens in the Authenticate method, letting attackers with any valid Azure token authenticate to OpenTelemetry receivers, exploit requires attacker to hold a valid Azure access token.

Severity & Score

Impact

Attackers can bypass authentication to OpenTelemetry receivers, potentially gaining unauthorized access to sensitive telemetry data.

Mitigation

Update to a version later than 0.150.0 or the latest available version.

References

• https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-pjv4-3c63-699f

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner