CVE-2026-55701 OpenTelemetry githubreceiver silently ignores configured required_headers authentication

What is CVE-2026-55701?

CVE-2026-55701 is a medium-severity vulnerability in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver, published on 15 Sep 2026.

Official description

The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/trace_receiver.go handleReq() does not check those headers on incoming webhook requests. An unauthenticated sender can therefore bypass an operator's required_headers authentication control and submit arbitrary webhook payloads. When the Secret field is empty, github.ValidatePayload also skips HMAC validation, leaving the webhook endpoint without either configured authentication mechanism. Successful exploitation can inject fabricated CI/CD trace data into the observability pipeline. This issue is fixed in version 0.151.0.

Weakness: CWE-863

Which versions are affected by CVE-2026-55701?

3 open source packages ship an affected version, including github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver.

How do I fix CVE-2026-55701?

Upgrade github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver to 0.151.0 or later.

Is CVE-2026-55701 being exploited?

There is no known exploitation of CVE-2026-55701 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-55701, ECHO-afb7-f2ac-1f9d, GHSA-w5cv-pw74-4rxc, GO-2026-5690, MINI-3rvj-hrg4-3rq9, MINI-74cq-922c-fj5v and 4 more.