CVE-2026-42602 Details
Description
azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any OpenTelemetry receiver that uses auth: azure_auth. The extension's Authenticate method does not validate incoming bearer tokens as JWTs. Instead, it calls its own configured credential to obtain an access token and compares the client's token to the result with string equality — and the scope for that server-side token request is taken from the client-supplied Host header. As a result, a token minted for any Azure resource the service principal has ever been issued a token for (ARM, Graph, Key Vault, Storage, etc.) will authenticate to the collector if the attacker picks a matching Host. Tokens are replayable for the full issued lifetime (commonly several hours for managed identity tokens).
A server-side authentication bypass vulnerability has been identified in the Azure Authenticator Extension of the OpenTelemetry Collector Contrib, affecting versions 0.124.0 prior to 0.150.0. The vulnerability allows any party with a valid Azure access token to authenticate to OpenTelemetry receivers using Azure authentication. The issue arises because the extension's Authenticate method fails to properly validate bearer tokens as JSON Web Tokens (JWTs). Instead, it compares tokens using string equality, allowing tokens minted for various Azure resources to be reused for authentication. This flaw is exacerbated by the fact that tokens can be replayed for their entire issued lifetime, which is typically several hours for managed identity tokens.
Remove the Azure authentication from any receiver 'auth:' blocks. For proper Entra ID JWT validation on OTLP receivers, use the OIDC Authenticator Extension pointed at the tenant discovery URL, with the audience pinned from configuration.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-pjv4-3c63-699f | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-pjv4-3c63-699f | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-208 | Observable Timing Discrepancy | [email protected] |
| CWE-287 | Improper Authentication | [email protected] |
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
| CWE-294 | Authentication Bypass by Capture-replay | [email protected] |
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| opentelemetry opentelemetry collector contrib | >= 0.124.0, <= 0.150.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| May 14, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | New CVE Received | [email protected] |