CVE-2026-47256

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource attribute in exporter/sentryexporter/sentry_exporter.go through extractProjectSlug and getOrCreateProjectEndpoint, passes the raw project slug to GetOTLPEndpoints and GetProjectKeys in exporter/sentryexporter/sentry_client.go, and interpolates it into a Sentry API URL without applying projectSlugRegexp through validateRoutingConfig at runtime in exporter/sentryexporter/config.go. Special characters can turn the expected path suffix into query data in all deployments or introduce slash and dot segments that traverse paths when the Sentry deployment normalizes them, while the Collector attaches its operator-configured bearer token to the request. A successful request can reach token-authorized administrative, organization, member, or key endpoints within the configured Sentry organization, and an attacker-controlled project slug can redirect subsequently exported telemetry. Sentry token middleware prevents cross-organization access. This issue is fixed in version 0.154.0.

• CWE-22
• CWE-74

• https://github.com/open-telemetry/opentelemetry-collector-contrib/commit/3113638f216143f523b57f447728464337ae4903
• https://github.com/open-telemetry/opentelemetry-collector-contrib/releases/tag/v0.154.0
• https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-4jvg-4jfx-fmhc
• https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-4jvg-4jfx-fmhc

Published

Sep 14, 2026

Last Modified

Sep 25, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47250mcp-server-kubernetes is a Model Context Protocol server for…6.1
• CVE-2026-47251libheif is a HEIF and AVIF file format decoder and encoder. …6.1
• CVE-2026-47252Anyquery is an SQL query engine built on top of SQLite. Prio…9
• CVE-2026-47253Anyquery is an SQL query engine built on top of SQLite. Prio…7.3
• CVE-2026-47254libheif is a HEIF and AVIF file format decoder and encoder. …6.1
• CVE-2026-47255AgenticMail gives AI agents real email addresses and phone n…8.2
• CVE-2026-4726Denial-of-service in the XML component. This vulnerability w…7.5
• CVE-2026-47260Koel is a free, open-source music streaming solution. Prior …7.7
• CVE-2026-47261Wasmtime is a runtime for WebAssembly. In versions prior to …7.5
• CVE-2026-47262containerd is an open-source container runtime. Versions pri…5.5
• CVE-2026-47263Discourse is an open-source discussion platform. From versio…4.3
• CVE-2026-47264Discourse is an open-source discussion platform. From versio…5.3