Read the docs
TI-2024-28354 Aliases CVE-2024-42368GHSA-rfxf-mf63-cpqv

open-telemetry has an Observable Timing Discrepancy

Priority LOW 36CWE-208Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
None · Low · Low
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-208.

Summary

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. The bearertokenauth extension's server authenticator performs a simple, non-constant time string comparison of the received & configured bearer tokens. This impacts anyone using the `bearertokenauth` server authenticator. Malicious clients with network access to the collector may perform a timing attack against a collector with this authenticator to guess the configured token, by iteratively sending tokens and comparing the response time. This would allow an attacker to introduce fabricated or bad data into the collector's telemetry pipeline. The observable timing vulnerability was fixed by using constant-time comparison in 0.107.0

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0062 49th percentileScored 2026-11-07
Fix Partial opentelemetry-collector-contrib (open-telemetry): 0.107.0github.com/open-telemetry/opentelemetry-collector-contrib/extension/bearertokenauthextension (Go): 0.107.0Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
open-telemetryopentelemetry-collector-contrib0.80.0 to before 0.107.00.107.0Patch availableCNA
—github.com/open-telemetry/opentelemetry-collector-contrib/extension/bearertokenauthextension (Go)0.80.0 to before 0.107.00.107.0Patch availableGHSA-rfxf-mf63-cpqv
  • opentelemetry-collector-contrib Vendoropen-telemetry Affected 0.80.0 to before 0.107.0 Fixed in 0.107.0 Patch available CNA
  • github.com/open-telemetry/opentelemetry-collector-contrib/extension/bearertokenauthextension (Go) Vendor— Affected 0.80.0 to before 0.107.0 Fixed in 0.107.0 Patch available GHSA-rfxf-mf63-cpqv

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:opentelemetry:opentelemetry_collector_contrib:*:*:*:*:*:*:*:*——open-telemetry
  • cpe:2.3:a:opentelemetry:opentelemetry_collector_contrib:*:*:*:*:*:*:*:* Versions — — ·open-telemetry

Remediation

  • Fix · CNA opentelemetry-collector-contrib (open-telemetry) Fixed in 0.107.0
  • Fix · GHSA-rfxf-mf63-cpqv github.com/open-telemetry/opentelemetry-collector-contrib/extension/bearertokenauthextension (Go) Fixed in 0.107.0 Advisory →

Red Hat 1 advisory

  • RHSA-2024:6274 Released 2024-09-04 · Red Hat rating Moderate
    Red Hat OpenShift distributed tracing 3.3.0 operator/operand containers
    • Red Hat OpenShift distributed tracing 3.3 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-collector-rhel8 +16

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift distributed tracing 3.3Fixed RHSA-2024:6274

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-42368
  2. 2026-10-03 Alias added: GHSA-rfxf-mf63-cpqv

References

Advisory 1

Other 4

  • TI-2024-23957 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC CVSS 3.1HIGH 8.2
  • TI-2026-42706 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header CVSS 3.1HIGH 7.5
  • TI-2026-33428 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI CVSS 3.1HIGH 7.5
  • TI-2026-33427 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages CVSS 3.1HIGH 7.5
  • TI-2026-33420 OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads CVSS 3.1HIGH 7.5
  • TI-2026-32777 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request CVSS 3.1HIGH 7.5
See all 62 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences