OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource attribute in exporter/sentryexporter/sentry_exporter.go through extractProjectSlug and getOrCreateProjectEndpoint, passes the raw project slug to GetOTLPEndpoints and GetProjectKeys in exporter/sentryexporter/sentry_client.go, and interpolates it into a Sentry API URL without applying projectSlugRegexp through validateRoutingConfig at runtime in exporter/sentryexporter/config.go. Special characters can turn the expected path suffix into query data in all deployments or introduce slash and dot segments that traverse paths when the Sentry deployment normalizes them, while the Collector attaches its operator-configured bearer token to the request. A successful request can reach token-authorized administrative, organization, member, or key endpoints within the configured Sentry organization, and an attacker-controlled project slug can redirect subsequently exported telemetry. Sentry token middleware prevents cross-organization access. This issue is fixed in version 0.154.0.

Source published

14 Sep 2026 17:28:15 UTC

Source modified

14 Sep 2026 18:00:10 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource attribute in exporter/sentryexporter/sentry_exporter.go through extractProjectSlug and getOrCreateProjectEndpoint, passes the raw project slug to GetOTLPEndpoints and GetProjectKeys in exporter/sentryexporter/sentry_client.go, and interpolates it into a Sentry API URL without applying projectSlugRegexp through validateRoutingConfig at runtime in exporter/sentryexporter/config.go. Special characters can turn the expected path suffix into query data in all deployments or introduce slash and dot segments that traverse paths when the Sentry deployment normalizes them, while the Collector attaches its operator-configured bearer token to the request. A successful request can reach token-authorized administrative, organization, member, or key endpoints within the configured Sentry organization, and an attacker-controlled project slug can redirect subsequently exported telemetry. Sentry token middleware prevents cross-organization access. This issue is fixed in version 0.154.0.

Source published

Sep 14, 2026, 5:28:15 PM (timezone not stated)

Source modified

Sep 14, 2026, 6:00:10 PM (timezone not stated)

Observed here

11 Nov 2026 12:09:00 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource attribute in exporter/sentryexporter/sentry_exporter.go through extractProjectSlug and getOrCreateProjectEndpoint, passes the raw project slug to GetOTLPEndpoints and GetProjectKeys in exporter/sentryexporter/sentry_client.go, and interpolates it into a Sentry API URL without applying projectSlugRegexp through validateRoutingConfig at runtime in exporter/sentryexporter/config.go. Special characters can turn the expected path suffix into query data in all deployments or introduce slash and dot segments that traverse paths when the Sentry deployment normalizes them, while the Collector attaches its operator-configured bearer token to the request. A successful request can reach token-authorized administrative, organization, member, or key endpoints within the configured Sentry organization, and an attacker-controlled project slug can redirect subsequently exported telemetry. Sentry token middleware prevents cross-organization access. This issue is fixed in version 0.154.0.

Source published

14 Sep 2026 18:17:48 UTC

Source modified

25 Sep 2026 14:23:59 UTC

Observed here

25 Oct 2026 12:17:26 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary The Sentry exporter constructs Sentry API URLs by interpolating the span's service.name resource attribute into the URL path without validation. Because service.name is controlled by remote OTLP senders and the operator-configured bearer token is attached to every request, a crafted service name can reach arbitrary Sentry API endpoints reachable by that token — including privileged admin, organization, and member endpoints within the configured Sentry organization. Affected - exporter/sentryexporter/sentry_exporter.go (lines 715–737) — extractProjectSlug returns the attacker-controlled service.name directly as the slug. - exporter/sentryexporter/sentry_exporter.go (lines 745–809) — getOrCreateProjectEndpoint passes the raw slug to GetOTLPEndpoints at line 761. - exporter/sentryexporter/sentry_client.go (lines 190–244) — GetProjectKeys interpolates the slug into fmt.Sprintf URL path and attaches the operator bearer token on line 207. - exporter/sentryexporter/sentry_client.go (lines 327–363) — GetOTLPEndpoints calls GetProjectKeys on line 329 with the raw slug. - exporter/sentryexporter/config.go (lines 55–108) — projectSlugRegexp is applied only to operator config mappings inside validateRoutingConfig, never to runtime-derived slugs. Root cause 1. extractProjectSlug (sentry_exporter.go:715–737) reads service.name from pcommon.Resource.Attributes() without schema validation and returns the raw string on line 736. 2. GetProjectKeys (sentry_client.go:192) calls fmt.Sprintf("%s/api/0/projects/%s/%s/keys/", c.baseURL, orgSlug, projectSlug). The slug is treated as a single path segment but no validation is performed. 3. projectSlugRegexp (config.go:58) — defined as ^[a-z0-9_-]{1,50}$ — is referenced only inside validateRoutingConfig on line 98 (config-time only). No runtime callsite exists. 4. Go net/http preserves literal .. and / characters in URL paths when constructed via fmt.Sprintf. 5. The operator-configured DSN / bearer token is attached unconditionally to every outbound request (sentry_client.go:207): req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", c.authToken)). Exploitation Primary: query-string injection (reliable across all deployments) Attacker emits service.name = "foo?injected_query=". URL becomes https://sentry.io/api/0/projects/ORG-SLUG/foo?injected_query=/keys/. The trailing /keys/ is consumed as part of the query string. The resource endpoint is /api/0/projects/ORG-SLUG/foo. The attacker can reach any GET-based Sentry API endpoint reachable by the bearer token. This vector is not dependent on server-side path normalization and works in all deployment configurations. Secondary: path traversal (nginx-dependent) Attacker emits a span with service.name = "foo/../../members". Resulting URL: https://sentry.io/api/0/projects/ORG-SLUG/foo/../../members/keys/ After server-side normalization (nginx resolves .. segments): https://sentry.io/api/0/projects/ORG-SLUG/members/keys/ The operator bearer token authenticates the request. Effectiveness depends on whether the Sentry deployment normalizes .. segments before routing (standard nginx behaviour). Amplified: telemetry redirect for data exfiltration Attacker-owned Sentry project slug → span data for other applications is exported to an attacker-controlled Sentry project, leaking operational telemetry. The collector fetches the DSN/keys for the attacker's slug and subsequently forwards legitimate traces/logs to the attacker-controlled destination. Threat model - Attacker capabilities: remote OTLP trace sender (application-level span emission). - Operator capabilities: configures Sentry DSN, bearer token, base URL; sets up receiver pipeline. - The attacker does NOT control operator YAML. The attacker DOES control resource attribute values on spans they emit. Realistic deployment - Kubernetes cluster with OpenTelemetry Collector forwarding traces from multiple applications to Sentry SaaS or self-hosted Sentry. - One compromised or malicious application reaches the collector via OTLP. - The collector is configured with a valid Sentry bearer token for the organization. Remediation Apply the existing projectSlugRegexp to runtime-derived slugs, not only to operator config mappings: ``` import "regexp" var runtimeSlugPattern = regexp.MustCompile(`^[a-zA-Z0-9_-]+$`) func (s *endpointState) extractProjectSlug(attrs pcommon.Map) string { attrValue, exists := attrs.Get(s.attributeKey) if !exists || attrValue.Type() != pcommon.ValueTypeStr { return "" } serviceName := attrValue.Str() if serviceName == "" { return "" } if s.projectMapping != nil { if mappedSlug, ok := s.projectMapping[serviceName]; ok { return mappedSlug } } if !runtimeSlugPattern.MatchString(serviceName) { return "" // reject; drop the span or use a fallback default project } return serviceName } Alternatively, reject at URL construction: func (c *sentryClient) GetProjectKeys(ctx context.Context, orgSlug, projectSlug string) ([]projectKey, error) { if !runtimeSlugPattern.MatchString(projectSlug) { return nil, fmt.Errorf("invalid project slug: %q", projectSlug) } baseURL := fmt.Sprintf("%s/api/0/projects/%s/%s/keys/", c.baseURL, orgSlug, projectSlug) // ... } ``` Apply the runtime regex to ALL slug-derived URL components (including orgSlug if it can ever be attacker-influenced), not just to config-time validation. Credit Reported by independent security research by Martin Brodeur.

Source published

18 Jun 2026 15:04:10 UTC

Source modified

25 Jun 2026 18:56:10 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Publisher rating · MODERATE

opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token in github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter

Source published

25 Jun 2026 18:26:48 UTC

Source modified

25 Jun 2026 18:45:23 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.