{"schemaVersion":3,"id":"CVE-2026-47701","aliases":["CGA-93gj-97rm-8vj3","CGA-mj65-gfmv-rxgp","CGA-p7mh-5q66-2q95","CGA-pc4x-rv8f-jqfj","CGA-vg59-x263-2fpc","CGA-x73m-2mm9-w4xv","GHSA-cxh2-4639-vmc5","GO-2026-5339","CGA-2977-qr92-qpp2","CGA-58fh-7jv6-w6gg","CGA-78f8-vghx-fmx9","CGA-cpp9-h8g3-xhw3","CGA-gmr2-9w7v-x465","CGA-j87r-93p3-cf2p","CGA-m452-rpvh-7w4v","CGA-mx3v-wpgc-mhq6"],"status":"published","duplicateOf":null,"title":null,"description":"The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as HTTPClientConfig.Authorization.CredentialsFile. A tenant who can create or update a ServiceMonitor matched by serviceMonitorSelector and serviceMonitorNamespaceSelector can point bearerTokenFile at a file in the Collector pod, including /var/run/secrets/kubernetes.io/serviceaccount/token, and direct scraping to a tenant-controlled endpoint. The Collector reads that file at scrape time and sends its contents as bearer authorization on every scrape interval. Exploitation also requires the Collector service-account token or another sensitive file to be mounted and the Collector to reach the chosen target. The DenyFSAccessThroughSMs control was absent, allowing disclosure of the Collector's service-account JWT or other mounted files, and resulting Kubernetes API impact is limited by the Collector service account's permissions. This issue is fixed in version 0.152.0.","dates":{"published":"2026-09-14T15:32:56.806Z","modified":"2026-09-14T16:43:18.575Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.7,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.7,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":7.7,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","exploitability":7.9,"impact":6.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Go","score":7.7,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","exploitability":7.9,"impact":6.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":7.7,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","exploitability":7.9,"impact":6.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.7,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0046,"percentile":0.38869,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0.181,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.00279},"history":[{"date":"2026-09-15T00:00:00.000Z","score":0.00279,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00279,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00279,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00279,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00279,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00279,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00279,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00279,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00279,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.0046,"percentile":0.38869}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.00279,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00279,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00279,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.0046,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.0046,"percentile":0.38869}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/200.html"}],"affected":[{"vendor":"chainguard","product":"kserve-localmodel","name":"kserve-localmodel","label":"kserve-localmodel","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kserve-localmodel","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kserve-localmodelnode-agent","name":"kserve-localmodelnode-agent","label":"kserve-localmodelnode-agent","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kserve-localmodelnode-agent","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kserve-localmodelnode-agent-fips","name":"kserve-localmodelnode-agent-fips","label":"kserve-localmodelnode-agent-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kserve-localmodelnode-agent-fips","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kserve-manager","name":"kserve-manager","label":"kserve-manager","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kserve-manager","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kserve-manager-fips","name":"kserve-manager-fips","label":"kserve-manager-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kserve-manager-fips","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kube-logging-operator","name":"kube-logging-operator","label":"kube-logging-operator","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kube-logging-operator","purlType":"apk","versions":[{"text":"< 6.6.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.6.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kube-logging-operator-fips","name":"kube-logging-operator-fips","label":"kube-logging-operator-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kube-logging-operator-fips","purlType":"apk","versions":[{"text":"< 6.6.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.6.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kserve-localmodel","name":"kserve-localmodel","label":"kserve-localmodel","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kserve-localmodel","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kserve-manager","name":"kserve-manager","label":"kserve-manager","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kserve-manager","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kube-logging-operator","name":"kube-logging-operator","label":"kube-logging-operator","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kube-logging-operator","purlType":"apk","versions":[{"text":"< 6.6.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.6.0-r2","eol":null,"hubHref":null},{"vendor":"github.com/open-telemetry","product":"opentelemetry-operator","name":"github.com/open-telemetry/opentelemetry-operator","label":"opentelemetry-operator","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/open-telemetry/opentelemetry-operator","purlType":"golang","versions":[{"text":"< 0.152.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.152.0","eol":null,"hubHref":null},{"vendor":"open-telemetry","product":"opentelemetry-operator","name":"opentelemetry-operator","label":"opentelemetry-operator","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.152.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.152.0","eol":null,"hubHref":"/vendor/open-telemetry/opentelemetry-operator"}],"affectedCount":12,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/open-telemetry/opentelemetry-operator/security/advisories/GHSA-cxh2-4639-vmc5","label":"github.com/open-telemetry/opentelemetry-operator/security/advisories/GHSA-cxh2-4639-vmc5","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","Advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-operator/pull/5104","label":"github.com/open-telemetry/opentelemetry-operator/pull/5104","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX"]},{"url":"https://github.com/open-telemetry/opentelemetry-operator/commit/95a8c2a3dc64a762d3ab8eba8c903b5702a03a9c","label":"github.com/open-telemetry/opentelemetry-operator/commit/95a8c2a3dc64a762d3ab8eba8c903b5702a03a9c","hostname":"github.com","tags":["X Refsource MISC"]},{"url":"https://github.com/open-telemetry/opentelemetry-operator/releases/tag/v0.152.0","label":"github.com/open-telemetry/opentelemetry-operator/releases/tag/v0.152.0","hostname":"github.com","tags":["X Refsource MISC"]},{"url":"https://github.com/open-telemetry/opentelemetry-operator","label":"github.com/open-telemetry/opentelemetry-operator","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:21483-1"],"duplicates":[],"related":["CGA-9MQF-WXGF-RMVC","OPENSUSE-SU-2026:21483-1"]},"timeline":[{"kind":"published","date":"2026-09-14T15:32:56.806Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-14T16:43:18.575Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T20:55:14.319Z","stale":false,"partial":false}}