Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-55701OpenTelemetry githubreceiver silently ignores configured required_headers authentication

Medium 6.9

In plain English

A medium-severity incorrect authorization in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver from open-telemetry. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.7%top 46.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/trace_receiver.go handleReq() does not check those headers on incoming webhook requests. An unauthenticated sender can therefore bypass an operator's required_headers authentication control and submit arbitrary webhook payloads. When the Secret field is empty, github.ValidatePayload also skips HMAC validation, leaving the webhook endpoint without either configured authentication mechanism. Successful exploitation can inject fabricated CI/CD trace data into the observability pipeline. This issue is fixed in version 0.151.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	golang-opentelemetry-contrib	no fix listed	DEBIAN-CVE-2026-55701
Debian:14	golang-opentelemetry-contrib	no fix listed	DEBIAN-CVE-2026-55701
Go	github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver	0.151.0	GO-2026-5690
Go	github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver	0.151.0	GHSA-w5cv-pw74-4rxc

Affected products (as reported)

Vendor	Product	Versions
open-telemetry	opentelemetry-collector-contrib	< 0.151.0
open-telemetry	github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver	< 0.151.0

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-w5cv-pw74-4rxc x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/47854 x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-collector-contrib/commit/54143ccd14f5ebd74ca741739d2099c7fbebbd98 x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-collector-contrib/releases/tag/v0.151.0 x_refsource_MISC