OpenTelemetry Operator TargetAllocator: a tenant ServiceMonitor can exfiltrate the Collector's service-account token

Impact

With targetAllocator.prometheusCR.enabled, the TargetAllocator preserves a ServiceMonitor endpoint's bearerTokenFile as the scrape credentials file, and the DenyFSAccessThroughSMs guard was absent. Any tenant who can create or update a ServiceMonitor matched by the operator's selectors can point bearerTokenFile at /var/run/secrets/kubernetes.io/serviceaccount/token (or another mounted secret) and aim the scrape at an endpoint they control - the Collector then mails that file's contents as a bearer header every scrape interval. On a shared GPU cluster where tenants own their own namespaces and monitoring CRs, this converts namespace-level access into whatever the Collector's service account can do cluster-wide, which for a metrics collector is usually broad read across pods and nodes. Requires the token or another sensitive file to be mounted and the Collector to be able to reach the attacker's target.

Who can reach it

Any authenticated tenant with RBAC to create or update a ServiceMonitor in a namespace covered by serviceMonitorSelector/serviceMonitorNamespaceSelector, plus network egress from the Collector pod to a tenant-controlled endpoint.

What to do

Upgrade the OpenTelemetry Operator to 0.152.0, which restores the DenyFSAccessThroughSMs control. Operator upgrade plus a rollout of the TargetAllocator and Collector deployments - a daemon restart, no node drain. Until then, tighten who can write ServiceMonitor objects in selected namespaces, and rotate the Collector service-account token if you suspect it was scraped out.

References

Related entries

• Dell OpenManage Server Administrator (improper authentication): An unauthenticated remote attacker gets unauthorizedCVE-2026-56793 · Dell OpenManage Server Administrator (improper authentication)High
• Ansible AWX: notification backends allow SSRF from the control node and leak webhook credentialsCVE-2026-71366 · Ansible AWX notification backends (webhook, Mattermost, Rocket.Chat, Grafana)High
• Grafana Alloy: ServiceMonitor bearerTokenFile reads any file and ships it to an attacker scrape targetCVE-2026-75889 · Grafana Alloy (prometheus.operator.servicemonitors component)High
• GitLab EE: stale pipeline execution policies run CI/CD with the new group's privileges after project transferCVE-2026-81839 · GitLab EE (scheduled pipeline execution policy records, project transfer cleanup)High
• Grafana Mimir Alertmanager: tenant receiver config reads arbitrary host files into notification headersCVE-2026-81938 · Grafana Mimir Alertmanager (tenant receiver configuration)High
• Ansible automation-controller: survey length-validation error leaks a stored password in plaintextCVE-2026-84499 · Red Hat Ansible Automation Platform automation-controller (survey password validation error)High