CVE-2024-42368

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. The bearertokenauth extension's server authenticator performs a simple, non-constant time string comparison of the received & configured bearer tokens. This impacts anyone using the `bearertokenauth` server authenticator. Malicious clients with network access to the collector may perform a timing attack against a collector with this authenticator to guess the configured token, by iteratively sending tokens and comparing the response time. This would allow an attacker to introduce fabricated or bad data into the collector's telemetry pipeline. The observable timing vulnerability was fixed by using constant-time comparison in 0.107.0

• CWE-208

• https://github.com/open-telemetry/opentelemetry-collector-contrib/commit/c9bd3eff0bb357d9c812a0d8defd3b09db95699a
• https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/34516
• https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-rfxf-mf63-cpqv

Published

Aug 13, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-42362Hertzbeat is an open source, real-time monitoring system. He…8.8
• CVE-2024-42363Prior to 3385, the user-controlled role parameter enters the…8.8
• CVE-2024-42364Homepage is a highly customizable homepage with Docker and s…6.5
• CVE-2024-42365Asterisk is an open source private branch exchange (PBX) and…8.8
• CVE-2024-42366VRCX is an assistant/companion application for VRChat. In ve…9
• CVE-2024-42367aiohttp is an asynchronous HTTP client/server framework for …4.8
• CVE-2024-42369matrix-js-sdk is a Matrix messaging protocol Client-Server S…5.3
• CVE-2024-4237A vulnerability, which was classified as critical, was found…8.8
• CVE-2024-42370Litestar is an Asynchronous Server Gateway Interface (ASGI) …8.3
• CVE-2024-42371The RFC enabled function module allows a low privileged user…5.4
• CVE-2024-42372Due to missing authorization check in SAP NetWeaver AS Java …6.5
• CVE-2024-42373SAP Student Life Cycle Management (SLcM) fails to conduct pr…5.4