CVE-2026-55701: OpenTelemetry Collector Auth Bypass Flaw

CVE-2026-55701 Overview

CVE-2026-55701 is an authorization bypass vulnerability in the OpenTelemetry Collector Contrib githubreceiver component. The receiver validates the RequiredHeaders configuration at startup in receiver/githubreceiver/config.go but fails to enforce those headers on incoming webhook requests in receiver/githubreceiver/trace_receiver.go. An unauthenticated sender can bypass the operator-configured required_headers authentication control and submit arbitrary webhook payloads. When the Secret field is empty, github.ValidatePayload also skips HMAC validation, removing both configured authentication mechanisms. The vulnerability is tracked as CWE-863 (Incorrect Authorization) and is fixed in version 0.151.0.

Critical Impact
Successful exploitation allows unauthenticated attackers to inject fabricated CI/CD trace data into the observability pipeline, corrupting monitoring, alerting, and downstream analytics.

Affected Products

OpenTelemetry Collector Contrib versions prior to 0.151.0
githubreceiver component with required_headers configured for authentication
githubreceiver deployments with an empty Secret field

Discovery Timeline

2026-09-15 - CVE-2026-55701 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-55701

Vulnerability Analysis

The githubreceiver component ingests GitHub webhook events and converts them into OpenTelemetry traces for CI/CD observability. Operators can protect the webhook endpoint using two mechanisms: required_headers for static header-based authentication and Secret for HMAC signature validation via github.ValidatePayload. The vulnerability breaks both controls in a specific configuration path.

While startup validation confirms that RequiredHeaders is well-formed, the handleReq() function processes incoming HTTP requests without comparing request headers against the configured values. Attackers who can reach the receiver endpoint over the network can therefore submit crafted webhook payloads without presenting the required header token.

Root Cause

The root cause is a missing enforcement check in the request handler. Configuration values loaded from config.go were never referenced inside trace_receiver.go at request time. When the Secret field is also unset, github.ValidatePayload short-circuits HMAC verification, leaving the endpoint fully unauthenticated despite an operator configuring required_headers.

Attack Vector

An attacker with network access to the exposed githubreceiver webhook endpoint sends an HTTP POST with a fabricated GitHub webhook payload. No credentials, secret, or required headers are needed. The receiver accepts the payload and generates OpenTelemetry spans, polluting the observability pipeline with attacker-controlled CI/CD trace data.

 func (gtr *githubTracesReceiver) handleReq(w http.ResponseWriter, req *http.Request) {
 	ctx := gtr.obsrecv.StartTracesOp(req.Context())
 
+	for k, v := range gtr.cfg.WebHook.RequiredHeaders {
+		if req.Header.Get(k) != string(v) {
+			gtr.logger.Sugar().Debugf("required header check failed", zap.String("header", k))
+			http.Error(w, "invalid request", http.StatusBadRequest)
+			return
+		}
+	}
+
 	p, err := github.ValidatePayload(req, []byte(gtr.cfg.WebHook.Secret))
 	if err != nil {
 		gtr.logger.Sugar().Debugf("unable to validate payload", zap.Error(err))

Source: GitHub Commit 54143cc. The patch iterates over each configured required header and rejects the request with HTTP 400 when any header does not match before invoking ValidatePayload.

Detection Methods for CVE-2026-55701

Indicators of Compromise

Webhook requests to the githubreceiver endpoint originating from IP ranges outside GitHub's published webhook source ranges.
Trace data referencing repositories, workflows, or commit SHAs that do not exist in the organization's source control.
Sudden volume anomalies in CI/CD spans emitted by the OpenTelemetry Collector without corresponding activity in GitHub Actions run logs.

Detection Strategies

Inspect collector access logs for POST requests missing the headers declared in the receiver's required_headers configuration.
Correlate ingested GitHub trace spans against authoritative GitHub Actions audit logs to identify fabricated events.
Alert on webhook payloads received when the X-Hub-Signature-256 header is absent while required_headers are configured.

Monitoring Recommendations

Enable verbose logging on the githubreceiver and forward logs to a centralized SIEM for correlation with GitHub audit events.
Track the collector version deployed across environments and alert when versions prior to 0.151.0 are detected.
Monitor egress and ingress network policies on the collector to ensure only trusted source ranges can reach the webhook endpoint.

How to Mitigate CVE-2026-55701

Immediate Actions Required

Upgrade OpenTelemetry Collector Contrib to version 0.151.0 or later on all deployments running the githubreceiver.
Configure a non-empty Secret field on the receiver to enforce HMAC signature validation via github.ValidatePayload.
Restrict network access to the receiver endpoint to GitHub's documented webhook IP ranges using firewall rules or an ingress allowlist.
Audit historical trace data for suspicious CI/CD spans that may have been injected before the patch was applied.

Patch Information

The fix is included in OpenTelemetry Collector Contrib v0.151.0. The change is tracked in Pull Request #47854 and detailed in GitHub Security Advisory GHSA-w5cv-pw74-4rxc. The commit adds explicit header validation inside handleReq() before payload processing.

Workarounds

Place the receiver behind a reverse proxy or API gateway that enforces the required headers and rejects non-compliant requests before they reach the collector.
Terminate GitHub webhooks at an intermediary service that validates the HMAC signature and forwards only verified payloads to the collector.
Disable the githubreceiver component until upgrade is possible if no compensating controls exist.

bash

# Verify the installed collector version
otelcol-contrib --version

# Example receiver configuration with both authentication mechanisms enforced
cat <<EOF > githubreceiver.yaml
receivers:
  github:
    webhook:
      endpoint: 0.0.0.0:19418
      path: /events
      secret: "${GITHUB_WEBHOOK_SECRET}"
      required_headers:
        X-Custom-Auth: "${REQUIRED_HEADER_VALUE}"
EOF