OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-863.
Summary
The OpenTelemetry Collector module AWS firehose receiver is for ingesting AWS Kinesis Data Firehose delivery stream messages and parsing the records received based on the configured record type. `awsfirehosereceiver` allows unauthenticated remote requests, even when configured to require a key. OpenTelemetry Collector can be configured to receive CloudWatch metrics via an AWS Firehose Stream. Firehose sets the header `X-Amz-Firehose-Access-Key` with an arbitrary configured string. The OpenTelemetry Collector awsfirehosereceiver can optionally be configured to require this key on incoming requests. However, when this is configured it **still accepts incoming requests with no key**. Only OpenTelemetry Collector users configured with the “alpha” `awsfirehosereceiver` module are affected. This module was added in version v0.49.0 of the “Contrib” distribution (or may be included in custom builds). There is a risk of unauthorized users writing metrics. Carefully crafted metrics could hide other malicious activity. There is no risk of exfiltrating data. It’s likely these endpoints will be exposed to the public internet, as Firehose does not support private HTTP endpoints. A fix was introduced in PR #34847 and released with v0.108.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| open-telemetry | opentelemetry-collector-contrib | 0.49.0 to before 0.108.0 | 0.108.0 | Patch available | CNA |
| — | github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver (Go) | 0.49.0 to before 0.108.0 | 0.108.0 | Patch available | GHSA-prf6-xjxh-p698 |
- opentelemetry-collector-contrib Vendoropen-telemetry Affected 0.49.0 to before 0.108.0 Fixed in 0.108.0 Patch available CNA
- github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver (Go) Vendor— Affected 0.49.0 to before 0.108.0 Fixed in 0.108.0 Patch available GHSA-prf6-xjxh-p698
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:opentelemetry:opentelemetry_collector_contrib:0.49.0:*:*:*:*:*:*:* | 0.49.0 | — | open-telemetry |
- cpe:2.3:a:opentelemetry:opentelemetry_collector_contrib:0.49.0:*:*:*:*:*:*:* Versions 0.49.0 — ·open-telemetry
Remediation
- Fix · CNA opentelemetry-collector-contrib (open-telemetry) Fixed in 0.108.0
- Fix · GHSA-prf6-xjxh-p698 github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver (Go) Fixed in 0.108.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-45043
- 2026-10-03 Alias added: GHSA-prf6-xjxh-p698
References
Other 12
- https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-prf6-xjxh-p698
- https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/34847
- https://github.com/open-telemetry/opentelemetry-collector-releases/pull/74
- https://docs.aws.amazon.com/firehose/latest/dev/controlling-access.html#using-iam-http
- https://docs.aws.amazon.com/firehose/latest/dev/httpdeliveryrequestresponse.html
- https://github.com/open-telemetry/opentelemetry-collector#alpha
- https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/receiver/awsfirehosereceiver
- https://github.com/open-telemetry/opentelemetry-collector-releases/releases/tag/v0.108.0
- https://github.com/open-telemetry/opentelemetry-collector-releases/tree/main/distributions/otelcol-contrib
- https://github.com/google/security-research/security/advisories/GHSA-q9wq-xc9h-xrw9
- https://github.com/open-telemetry/opentelemetry-collector-contrib/commit/371bf6afbd7cfa3253fa1674f5444064e86ef0ac
- https://github.com/open-telemetry/opentelemetry-collector-contrib
More open-telemetry vulnerabilities
- TI-2024-23957 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC CVSS 3.1HIGH 8.2
- TI-2026-42706 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header CVSS 3.1HIGH 7.5
- TI-2026-33428 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI CVSS 3.1HIGH 7.5
- TI-2026-33427 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages CVSS 3.1HIGH 7.5
- TI-2026-33420 OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads CVSS 3.1HIGH 7.5
- TI-2026-32777 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request CVSS 3.1HIGH 7.5
Sources
- CVE-2024-45043 · CVE Program
- CVE-2024-45043 · NVD
- FIRST EPSS
- GHSA-prf6-xjxh-p698 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences