We use cookies to improve your experience on our site.
AVID-2026-R1517
Description
open-telemetry has an Observable Timing Discrepancy (CVE-2024-42368)
Details
OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. The bearertokenauth extension’s server authenticator performs a simple, non-constant time string comparison of the received & configured bearer tokens. This impacts anyone using the bearertokenauth server authenticator. Malicious clients with network access to the collector may perform a timing attack against a collector with this authenticator to guess the configured token, by iteratively sending tokens and comparing the response time. This would allow an attacker to introduce fabricated or bad data into the collector’s telemetry pipeline. The observable timing vulnerability was fixed by using constant-time comparison in 0.107.0
Reason for inclusion in AVID: The CVE describes a timing-attack vulnerability in the bearer token authenticator of OpenTelemetry Collector Contrib, a software component used in deployment/operational stacks. This component is commonly used in ML/AI pipelines for observability (traces/metrics/logs). The issue affects a software supply chain component (dependencies/serving/monitoring stack) that AI systems rely on, and it is a security vulnerability (timing-based token guess could impact data integrity of telemetry). The report includes explicit details, affected artifacts, CVSS data, and references, providing sufficient signal for curation.
References
- NVD entry
- https://github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-rfxf-mf63-cpqv
- https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/34516
- https://github.com/open-telemetry/opentelemetry-collector-contrib/commit/c9bd3eff0bb357d9c812a0d8defd3b09db95699a
Affected or Relevant Artifacts
- Developer: open-telemetry
- Deployer: open-telemetry
- Artifact Details:
| Type | Name |
|---|---|
| System | opentelemetry-collector-contrib |
Impact
AVID Taxonomy Categorization
- Risk domains: Security
- SEP subcategories: S0100: Software Vulnerability
- Lifecycle stages: L06: Deployment
CVSS
| Version | 3.1 |
| Vector String | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
| Base Score | 6.5 |
| Base Severity | 🟠 Medium |
| Attack Vector | NETWORK |
| Attack Complexity | 🟢 Low |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | 🟢 Low |
| Availability Impact | 🟢 Low |
CWE
| ID | Description |
|---|---|
| CWE-208 | CWE-208: Observable Timing Discrepancy |
Other information
- Report Type: Advisory
- Credits:
- Date Reported: 2024-08-13
- Version: 0.3.3
- AVID Entry