OpenTelemetry Operator TargetAllocator: a tenant ServiceMonitor can exfiltrate the Collector's service-account token

Impact

With targetAllocator.prometheusCR.enabled, the TargetAllocator preserves a ServiceMonitor endpoint's bearerTokenFile as the scrape credentials file, and the DenyFSAccessThroughSMs guard was absent. Any tenant who can create or update a ServiceMonitor matched by the operator's selectors can point bearerTokenFile at /var/run/secrets/kubernetes.io/serviceaccount/token (or another mounted secret) and aim the scrape at an endpoint they control - the Collector then mails that file's contents as a bearer header every scrape interval. On a shared GPU cluster where tenants own their own namespaces and monitoring CRs, this converts namespace-level access into whatever the Collector's service account can do cluster-wide, which for a metrics collector is usually broad read across pods and nodes. Requires the token or another sensitive file to be mounted and the Collector to be able to reach the attacker's target.

Who can reach it

Any authenticated tenant with RBAC to create or update a ServiceMonitor in a namespace covered by serviceMonitorSelector/serviceMonitorNamespaceSelector, plus network egress from the Collector pod to a tenant-controlled endpoint.

What to do

Upgrade the OpenTelemetry Operator to 0.152.0, which restores the DenyFSAccessThroughSMs control. Operator upgrade plus a rollout of the TargetAllocator and Collector deployments - a daemon restart, no node drain. Until then, tighten who can write ServiceMonitor objects in selected namespaces, and rotate the Collector service-account token if you suspect it was scraped out.

References

Related entries

• Dell OpenManage Server Administrator (improper authentication): An unauthenticated remote attacker gets unauthorizedCVE-2026-56793 · Dell OpenManage Server Administrator (improper authentication)High
• Ansible AWX: notification backends allow SSRF from the control node and leak webhook credentialsCVE-2026-71366 · Ansible AWX notification backends (webhook, Mattermost, Rocket.Chat, Grafana)High
• Grafana Alloy: ServiceMonitor bearerTokenFile reads any file and ships it to an attacker scrape targetCVE-2026-75889 · Grafana Alloy (prometheus.operator.servicemonitors component)High
• GlusterFS (brick, mknod): Mknod can create device nodes that point at real devices on the storage server, so a clientCVE-2018-10923 · GlusterFS (brick, mknod)High
• HashiCorp Vault: GCP secrets engine drops existing IAM Conditions when creating/updating rolesetsCVE-2023-5077 · HashiCorp VaultHigh
• NetApp ONTAP 9 role-based access control: A user holding several remote accounts with different roles performs actionsCVE-2024-21985 · NetApp ONTAP 9 role-based access controlHigh