OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-47701 · Microsoft / collected KEV context

EUVD-2026-77578

GHSA-cxh2-4639-vmc5

GO-2026-5339

cve-program · CVE-2026-47701

• https://github.com/open-telemetry/opentelemetry-operator/security/advisories/GHSA-cxh2-4639-vmc5
• https://github.com/open-telemetry/opentelemetry-operator/pull/5104
• https://github.com/open-telemetry/opentelemetry-operator/commit/95a8c2a3dc64a762d3ab8eba8c903b5702a03a9c
• https://github.com/open-telemetry/opentelemetry-operator/releases/tag/v0.152.0

euvd · EUVD-2026-77578

• https://github.com/open-telemetry/opentelemetry-operator/security/advisories/GHSA-cxh2-4639-vmc5
• https://github.com/open-telemetry/opentelemetry-operator/pull/5104
• https://github.com/open-telemetry/opentelemetry-operator/commit/95a8c2a3dc64a762d3ab8eba8c903b5702a03a9c
• https://github.com/open-telemetry/opentelemetry-operator/releases/tag/v0.152.0

nvd · CVE-2026-47701

• https://github.com/open-telemetry/opentelemetry-operator/commit/95a8c2a3dc64a762d3ab8eba8c903b5702a03a9c
• https://github.com/open-telemetry/opentelemetry-operator/pull/5104
• https://github.com/open-telemetry/opentelemetry-operator/releases/tag/v0.152.0
• https://github.com/open-telemetry/opentelemetry-operator/security/advisories/GHSA-cxh2-4639-vmc5

osv · GHSA-cxh2-4639-vmc5

• https://github.com/open-telemetry/opentelemetry-operator/security/advisories/GHSA-cxh2-4639-vmc5
• https://github.com/open-telemetry/opentelemetry-operator/pull/5104
• https://github.com/open-telemetry/opentelemetry-operator

osv · GO-2026-5339

• https://github.com/open-telemetry/opentelemetry-operator/security/advisories/GHSA-cxh2-4639-vmc5
• https://github.com/open-telemetry/opentelemetry-operator/pull/5104

No related operational record is retained in the current change model.