CVE-2026-55701: The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver val

Executive brief

The OpenTelemetry Collector's GitHub receiver, which processes data from GitHub webhooks, fails to check for required security headers. This allows an attacker to send fake data into a company's monitoring and observability systems, potentially corrupting CI/CD trace data. If no secret is configured, the system has no authentication at all, making it easy for unauthorized parties to inject malicious or misleading information.

Technical details

The githubreceiver component in opentelemetry-collector-contrib contains an incorrect authorization vulnerability (CWE-863). While the 'required_headers' configuration is validated at startup, the 'handleReq' function in 'trace_receiver.go' fails to check these headers against incoming requests. Furthermore, if the 'Secret' field is left empty, HMAC validation is skipped entirely. A remote, unauthenticated attacker can exploit this by sending crafted HTTP POST requests to the webhook endpoint to inject fraudulent CI/CD trace data. The issue is resolved in version 0.151.0.

Affected products

• OpenTelemetry opentelemetry-collector-contrib/receiver/githubreceiver <= 0.150.0

Timeline

• 2026-06-15: disclosed: Advisory published to open-telemetry repository
• 2026-06-18: advisory: GitHub Advisory published and reviewed
• 2026-06-18: patched: Fix released in version 0.151.0

References

• https://api.github.com/users/kodareef5
• https://github.com/kodareef5
• https://api.github.com/users/kodareef5/gists%7B/gist_id%7D
• https://api.github.com/users/kodareef5/repos
• https://avatars.githubusercontent.com/u/261977334?v=4
• https://api.github.com/users/kodareef5/events%7B/privacy%7D