Is CVE-2026-47701 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47701 being exploited in the wild.

How severe is CVE-2026-47701?

High severity, with a CVSS score of 7.7, published 14 September 2026.

Which products and versions are affected?

github.com/open-telemetry/opentelemetry-operator (Go) < 0.152.0, SEMVER:introduced=0,fixed=0.152.0.

Is there a fix for CVE-2026-47701?

Yes. github.com/open-telemetry/opentelemetry-operator (Go): upgrade to 0.152.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47701 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-47701?

Check whether you run github.com/open-telemetry/opentelemetry-operator (Go) or Opentelemetry Operator for Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47701: OpenTelemetry Operator arbitrary file disclosure in TargetAllocator

Q: Is there a fix for CVE-2026-47701?

Yes. github.com/open-telemetry/opentelemetry-operator (Go): upgrade to 0.152.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47701 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-47701?

Check whether you run github.com/open-telemetry/opentelemetry-operator (Go) or Opentelemetry Operator for Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47701 · Severity: high · CVSS 7.7 · Published 2026-09-14

The OpenTelemetry Operator for Kubernetes contains a vulnerability that allows users with permission to create or update monitoring configurations to steal sensitive system credentials. By pointing a configuration field to internal system files, an attacker can force the system to send its own security tokens or certificates to a server they control. This could allow an attacker to impersonate the monitoring service and gain broader access to the Kubernetes cluster.

Vendors: Go, Opentelemetry.

Quick answers

Is CVE-2026-47701 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47701 being exploited in the wild.
How severe is CVE-2026-47701?: High severity, with a CVSS score of 7.7, published 14 September 2026.
Which products and versions are affected?: github.com/open-telemetry/opentelemetry-operator (Go) < 0.152.0, SEMVER:introduced=0,fixed=0.152.0.
Is there a fix for CVE-2026-47701?: Yes. github.com/open-telemetry/opentelemetry-operator (Go): upgrade to 0.152.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47701 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-47701?: Check whether you run github.com/open-telemetry/opentelemetry-operator (Go) or Opentelemetry Operator for Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/open-telemetry/opentelemetry-operator (Go): upgrade to 0.152.0 or later
```
go get github.com/open-telemetry/opentelemetry-operator@v0.152.0
```

Technical details

A vulnerability in the OpenTelemetry Operator's TargetAllocator component (cmd/otel-allocator) allows for arbitrary local file read and exfiltration. The TargetAllocator watches ServiceMonitor resources and converts them into Prometheus scrape configurations, preserving the 'bearerTokenFile' field. An attacker with permissions to create or update ServiceMonitors can set this field to a sensitive path, such as the Kubernetes service account token. When the OpenTelemetry Collector performs a scrape, it reads the file from its own filesystem and sends the contents as a Bearer token to an attacker-controlled endpoint. This is a CWE-200 (Exposure of Sensitive Information) issue. A fix is available in version 0.152.0 which introduces the 'DenyFSAccessThroughSMs' guard to drop configurations referencing arbitrary local files.

Affected products

OpenTelemetry opentelemetry-operator < 0.152.0

Identifiers

CVE-2026-47701
GHSA-cxh2-4639-vmc5
GO-2026-5339

Timeline

2026-06-10: advisory: GitHub Advisory published
2026-06-10: patched: Fix released in version 0.152.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.