CVE-2026-55701: 
vulnerability analysis and mitigation

CVE-2026-55701 is an authentication bypass vulnerability in the githubreceiver component of the OpenTelemetry Collector Contrib project, where the webhook handler silently ignores the operator-configured required_headers authentication mechanism. Discovered and published on June 15, 2026 by researcher kodareef5, it affects all versions of github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver up to and including v0.150.0. The vulnerability has a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, OTel Advisory).

The root cause is an Incorrect Authorization flaw (CWE-863): while RequiredHeaders is defined in receiver/githubreceiver/config.go (line 45) and validated at startup (lines 93–101), the handleReq() function in receiver/githubreceiver/trace_receiver.go (lines 131–185) never checks incoming request headers against the configured values. This contrasts with the gitlabreceiver, which correctly enforces the same configuration by iterating over RequiredHeaders and rejecting requests with mismatched header values. The vulnerability is compounded by the fact that the Secret field defaults to empty, causing github.ValidatePayload to skip HMAC validation entirely — meaning an operator relying solely on required_headers for authentication has effectively zero authentication on the webhook endpoint (GitHub Advisory, OTel Advisory).

An unauthenticated remote attacker can send arbitrary webhook payloads to the githubreceiver endpoint, bypassing all operator-configured authentication. The primary impact is an integrity violation: attackers can inject fake CI/CD trace data into the observability pipeline, potentially corrupting telemetry records, misleading monitoring dashboards, or masking malicious activity within the pipeline. Confidentiality and availability of the vulnerable system are not directly impacted, but poisoned observability data could undermine incident response and security monitoring decisions (GitHub Advisory).

1. Reconnaissance: Identify internet-facing OpenTelemetry Collector instances running the githubreceiver component (versions ≤ 0.150.0) by scanning for exposed webhook endpoints, typically on the configured HTTP port.
2. Confirm authentication bypass: Send a test HTTP POST request to the githubreceiver webhook endpoint without any required_headers values. If the server accepts the request (returns HTTP 200 or processes the payload), the endpoint is vulnerable.
3. Craft malicious payload: Construct a GitHub webhook-style JSON payload mimicking a CI/CD event (e.g., a push or workflow_run event) with fabricated trace data.
4. Inject payload: Submit the crafted payload via HTTP POST to the webhook endpoint. Because handleReq() never validates RequiredHeaders and Secret defaults to empty (skipping HMAC validation), the payload is accepted and ingested into the observability pipeline.
5. Achieve objective: The injected fake CI/CD trace data is processed by the pipeline, potentially corrupting telemetry, masking real events, or misleading operators relying on the observability data for security monitoring (GitHub Advisory, OTel Advisory).

• Network: Unexpected HTTP POST requests to the githubreceiver webhook endpoint originating from IP addresses not associated with GitHub's webhook IP ranges (published at https://api.github.com/meta); high volume of webhook requests without valid required_headers values.
• Logs: OpenTelemetry Collector logs showing successful ingestion of webhook payloads from unexpected sources; absence of header validation errors despite required_headers being configured.
• Observability Pipeline: Anomalous or duplicate CI/CD trace data appearing in the telemetry backend (e.g., traces referencing non-existent repositories, workflows, or commit SHAs); sudden spikes in ingested trace volume not correlated with actual CI/CD activity.

Upgrade to github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver version 0.151.0 or later, which adds RequiredHeaders enforcement to handleReq() matching the gitlabreceiver pattern. As an immediate workaround, operators should configure a non-empty Secret value to enable HMAC validation via github.ValidatePayload, which provides an independent authentication layer. Additionally, restrict network access to the githubreceiver webhook endpoint using firewall rules or an API gateway that enforces IP allowlisting to GitHub's published webhook IP ranges (GitHub Advisory, OTel Advisory).

The advisory notes that this vulnerability follows the same pattern as a prior auth bypass in the awsfirehosereceiver (GHSA-prf6-xjxh-p698), suggesting a systemic issue with header-based authentication enforcement across multiple OpenTelemetry Collector Contrib receivers. No significant public commentary, media coverage, or vendor statements beyond the GitHub advisory have been identified at this time (GitHub Advisory).