# OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

TargetAllocator preserved ServiceMonitor bearerTokenFile into scrape config, letting a tenant exfiltrate the Collector pod's service account JWT to an attacker-controlled target.

- Payout: Research
- Severity: high
- Program: OpenTelemetry Operator
- Found by: everping
- Disclosed: 2026-06-10
- CVE: CVE-2026-47701
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-cxh2-4639-vmc5
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-cxh2-4639-vmc5
- Tags: area:cloud domain:cloud domain:infra impact:internal-access impact:privesc kind:research platform:ghsa sev:high tech:kubernetes technique:source-review vuln:access-control vuln:info-disclosure vuln:secrets-leak

**Target:** cmd/otel-allocator (TargetAllocator) converting ServiceMonitor endpoints to Prometheus scrape configs
**Root cause:** TargetAllocator copies the ServiceMonitor endpoint's bearerTokenFile verbatim into HTTPClientConfig.Authorization.CredentialsFile without restricting filesystem paths, so the Collector reads any local file at scrape time and sends it as bearer auth.
**Steps:**
1. Deploy Collector with `targetAllocator.prometheusCR.enabled: true` and a serviceMonitorSelector matching a namespace the attacker can write.
2. Create a ServiceMonitor with an endpoint whose `bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token` and a scrape target the attacker controls.
3. TargetAllocator converts the endpoint, preserving bearerTokenFile as CredentialsFile in the generated scrape config.
4. Collector's Prometheus receiver loads the config, reads the token file from its own pod filesystem, and sends `Authorization: Bearer <token>` to the attacker's target on each scrape interval.
5. Attacker replays the stolen JWT against the Kubernetes API with the Collector's service account permissions.
**How found:** Not stated; likely code review of the ServiceMonitor-to-scrape-config conversion noticing bearerTokenFile passes through unvalidated, paralleling Prometheus Operator's ArbitraryFSAccessThroughSMs issue.
**Exploitation:** Tenant with ServiceMonitor write creates a monitor pointing at an attacker-controlled scrape endpoint with bearerTokenFile set to the mounted service account token path; the Collector ships its JWT to that endpoint every scrape interval, which the attacker then uses against the Kubernetes API.
**Escalation:** Stolen Collector service account typically holds cluster-wide pod/node/endpoint/namespace/service list, enabling enumeration of further targets; same primitive reads any pod-local file including mounted certs and other tokens.
**Insight:** When a controller translates a tenant-supplied CRD field into a file path consumed by another component, check for pass-through of file-reading fields (bearerTokenFile, caFile, certFile, keyFile) — the reader runs with the victim pod's identity, not the tenant's.