{"cve":"CVE-2026-55701","nvd":{"published":"2026-09-15T16:17:15.617","modified":"2026-09-30T17:43:24.057","status":"Awaiting Analysis","description":"The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/trace_receiver.go handleReq() does not check those headers on incoming webhook requests. An unauthenticated sender can therefore bypass an operator's required_headers authentication control and submit arbitrary webhook payloads. When the Secret field is empty, github.ValidatePayload also skips HMAC validation, leaving the webhook endpoint without either configured authentication mechanism. Successful exploitation can inject fabricated CI/CD trace data into the observability pipeline. This issue is fixed in version 0.151.0.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":6.9},"cvss_v3":null,"cwes":["CWE-863"],"references":["https://github.com/open-telemetry/opentelemetry-collector-contrib/commit/54143ccd14f5ebd74ca741739d2099c7fbebbd98","https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/47854","https://github.com/open-telemetry/opentelemetry-collector-contrib/releases/tag/v0.151.0","https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-w5cv-pw74-4rxc"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:53:43.293028046+00:00"},"epss":{"cve":"CVE-2026-55701","score":0.00701,"percentile":0.52958,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-w5cv-pw74-4rxc","url":"https://osv.dev/vulnerability/GHSA-w5cv-pw74-4rxc","summary":"opentelemetry-collector-contrib: githubreceiver silently ignores configured required_headers authentication","modified":"2026-06-25T23:11:38.482632465Z","packages":[{"ecosystem":"Go","name":"github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver","purl":"pkg:golang/github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver","ranges":["<0.151.0"],"fixed":["0.151.0"]}]},{"id":"GO-2026-5690","url":"https://osv.dev/vulnerability/GO-2026-5690","summary":"opentelemetry-collector-contrib: githubreceiver silently ignores configured required_headers authentication in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver","modified":"2026-06-25T23:01:26.836448656Z","packages":[{"ecosystem":"Go","name":"github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver","purl":"pkg:golang/github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver","ranges":["<0.151.0"],"fixed":["0.151.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}