CVE-2026-4701: OTEL Operator ServiceMonitor bearerTokenFile Arbitrary File Read (High)

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Name: Prometheus Target Allocator: Arbitrary local file read via ServiceMonitor bearerTokenFile, with contents sent as Bearer authentication CVE ID: CVE-2026-4701 Severity: High (CVSS v3.1 Score: 7.7) Vulnerability Type: Arbitrary File Read Description: The TargetAllocator in the OpenTelemetry Operator scrapes and converts ServiceMonitor resources via the Prometheus Operator CR watcher. The field is preserved and converted into an authentication configuration. The Collector reads the contents of this file and sends them in the Authorization header. An attacker who can create or update a ServiceMonitor can set to point to an arbitrary file (e.g., ), thereby reading the file's contents. Impact Affected Component: (TargetAllocator) Affected Versions: < 0.152.0 Fixed Version: 0.152.0 Impact: - Attackers can read sensitive files such as certificates and tokens mounted on the Collector pod's disk. - They can enumerate ServiceMonitor configurations in the cluster to discover additional targets. - This corresponds to the missing admission/runtime guard found in Prometheus Operator. Resolution Fixed Version: 0.152.0 Fix Details: - Supports disabling Service and PodMonitor endpoints that read arbitrary files. - When a or endpoint references an arbitrary file, TargetAllocator discards the affected ServiceMonitor and PodMonitor endpoints. - Once enabled, endpoints referencing , , , , or are removed from the generated scrape configuration. - This is equivalent to the admission/runtime guard in Prometheus Operator. POC / Exploit Code No POC or exploit code blocks are included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-4701: OTEL Operator ServiceMonitor bearerTokenFile Arbitrary File Read (High)

More from this source