CVE-2026-42602: Azure Auth Extension Auth Bypass Flaw

CVE-2026-42602 Overview

CVE-2026-42602 is an authentication bypass vulnerability in the azureauthextension component of the OpenTelemetry Collector Contrib distribution. The flaw affects versions 0.124.0 through 0.150.0 and allows any holder of a valid Azure access token to authenticate to receivers configured with auth: azure_auth. The extension fails to validate bearer tokens as JSON Web Tokens (JWTs), instead comparing client-supplied tokens to a server-minted token using string equality. Attackers can replay tokens issued for any Azure resource the configured service principal can access. This vulnerability is classified under [CWE-208] Observable Timing Discrepancy and related authentication weaknesses.

Critical Impact
Any valid Azure access token issued for a scope the collector's identity can request enables full authentication bypass against the OpenTelemetry receiver.

Affected Products

OpenTelemetry Collector Contrib azureauthextension version 0.124.0
OpenTelemetry Collector Contrib azureauthextension versions 0.125.0 through 0.149.x
OpenTelemetry Collector Contrib azureauthextension version 0.150.0

Discovery Timeline

2026-05-13 - CVE-2026-42602 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42602

Vulnerability Analysis

The azureauthextension provides bearer-token authentication for OpenTelemetry Collector receivers using Azure identities. The Authenticate method is expected to verify that the incoming token was issued by Azure Active Directory and is scoped to the receiver. Instead, the extension invokes its own configured credential to mint a fresh access token, then compares the client-supplied bearer to the freshly minted token using string equality.

The scope used to mint the server-side comparison token is derived from the client's Host header. An attacker controls the scope selection by setting the Host value to any Azure resource for which the collector's service principal or managed identity can obtain a token. This includes Azure Resource Manager (ARM), Microsoft Graph, Key Vault, Storage, and any other audience the identity has rights to.

Root Cause

The root cause is the absence of JWT validation. The extension never parses the token, never verifies its signature against Azure AD signing keys, never checks the aud (audience), iss (issuer), or exp (expiry) claims, and does not pin the expected scope. The string-equality comparison against an attacker-influenced token request transforms a server identity capability into an authentication oracle.

Attack Vector

An attacker who possesses any Azure access token issued to the collector's identity, or who can phish or steal such a token for an unrelated scope, sends it as a Bearer token to the collector. The attacker sets the Host header to match the resource for which the token was issued. The extension mints a matching token, the strings compare equal, and authentication succeeds. Managed identity tokens are typically valid for several hours and remain replayable for the full issued lifetime.

No verified exploit code is publicly available. Refer to the GitHub Security Advisory GHSA-pjv4-3c63-699f for full technical details.

Detection Methods for CVE-2026-42602

Indicators of Compromise

Unexpected Authorization: Bearer requests to OpenTelemetry receiver endpoints from source IPs outside the collector's normal telemetry producers.
HTTP requests to the collector containing Host header values that reference Azure resource audiences such as management.azure.com, graph.microsoft.com, vault.azure.net, or *.blob.core.windows.net.
Successful authentications to receivers using auth: azure_auth correlated with Azure AD sign-in logs for the collector's identity requesting tokens for unusual scopes.

Detection Strategies

Inspect collector access logs and reverse proxy logs for mismatches between expected telemetry producers and the Host header values presented during authentication.
Correlate Azure AD sign-in events for the collector's service principal or managed identity against token requests for non-telemetry audiences.
Audit the deployed version of the OpenTelemetry Collector Contrib distribution to identify nodes running azureauthextension between 0.124.0 and 0.150.0.

Monitoring Recommendations

Forward collector and Azure AD audit logs into a centralized analytics platform and alert on token issuance for scopes outside the documented telemetry pipeline.
Monitor for replayed bearer tokens by tracking jti claim reuse across distinct source IPs.
Track outbound network connections from receiver hosts that follow successful authentications using auth: azure_auth.

How to Mitigate CVE-2026-42602

Immediate Actions Required

Upgrade azureauthextension to a fixed release published after 0.150.0 as listed in the upstream advisory.
Rotate or constrain the collector's service principal or managed identity to minimize the set of audiences for which tokens can be minted.
Place the collector behind a network boundary that restricts inbound access to known telemetry producers and rejects untrusted Host headers.

Patch Information

A fix is tracked in the OpenTelemetry Collector Contrib repository. Review the GitHub Security Advisory GHSA-pjv4-3c63-699f for the patched version, the corrected JWT validation logic, and migration guidance for receiver configurations.

Workarounds

Disable auth: azure_auth on receivers until the collector is upgraded, and substitute mutual TLS or a different authenticator extension.
Front the collector with a reverse proxy or API gateway that performs proper JWT validation, pins the expected audience, and strips or normalizes the inbound Host header.
Restrict the collector identity to a single least-privilege Azure role with no token issuance rights for ARM, Graph, Key Vault, or Storage scopes.

bash

# Example: disable azure_auth on the OTLP receiver while patching
receivers:
  otlp:
    protocols:
      grpc:
        # auth:
        #   authenticator: azureauth   # disabled pending upgrade
        tls:
          cert_file: /etc/otelcol/server.crt
          key_file: /etc/otelcol/server.key
          client_ca_file: /etc/otelcol/clients-ca.crt