CVE-2026-47256 is a medium-severity path traversal vulnerability in github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter (go), affecting versions < 0.154.0. It is fixed in 0.154.0.
Summary The Sentry exporter constructs Sentry API URLs by interpolating the span's service.name resource attribute into the URL path without validation. Because service.name is controlled by remote OTLP senders and the operator-configured bearer token is attached to every request, a crafted service name can reach arbitrary Sentry API endpoints reachable by that token, including privileged admin, organization, and member endpoints within the configured Sentry organization. Affected exporter/sentryexporter/sentryexporter.go (lines 715–737), extractProjectSlug returns the attacker-controlled service.name directly as the slug. exporter/sentryexporter/sentryexporter.go (lines 745–809), getOrCreateProjectEndpoint passes the raw slug to GetOTLPEndpoints at line 761. exporter/sentryexporter/sentryclient.go (lines 190–244), GetProjectKeys interpolates the slug into fmt.Sprintf URL path and attaches the operator bearer token on line 207. exporter/sentryexporter/sentryclient.go (lines 327–363), GetOTLPEndpoints calls GetProjectKeys on line 329 with the raw slug. exporter/sentryexporter/config.go (lines 55–108), projectSlugRegexp is applied only to operator config mappings inside validateRoutingConfig, never to runtime-derived slugs. Root cause extractProjectSlug (sentryexporter.go:715–737) reads service.name from pcommon.Resource.Attributes() without schema validation and returns the raw string on line 736. GetProjectKeys (sentryclient.go:192) calls fmt.Sprintf("%s/api/0/projects/%s/%s/keys/", c.baseURL, orgSlug, projectSlug). The slug is treated as a single path segment but no validation is performed. projectSlugRegexp (config.go:58), defined as ^[a-z0-9-]{1,50}$, is referenced only inside validateRoutingConfig on line 98 (config-time only). No runtime callsite exists. Go net/http preserves literal .. and / characters in URL paths when constructed via fmt.Sprintf. The operator-configured DSN / bearer token is attached unconditionally to every outbound request (sentryclient.go:207): req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", c.authToken)). Exploitation Primary: query-string injection (reliable across all deployments) Attacker emits service.name = "foo?injectedquery=". URL becomes https://sentry.io/api/0/projects/ORG-SLUG/foo?injectedquery=/keys/. The trailing /keys/ is consumed as part of the query string. The resource endpoint is /api/0/projects/ORG-SLUG/foo. The attacker can reach any GET-based Sentry API endpoint reachable by the bearer token. This vector is not dependent on server-side path normalization and works in all deployment configurations. Secondary: path traversal (nginx-dependent) Attacker emits a span with service.name = "foo/../../members". Resulting URL: https://sentry.io/api/0/projects/ORG-SLUG/foo/../../members/keys/ After server-side normalization (nginx resolves .. segments): https://sentry.io/api/0/projects/ORG-SLUG/members/keys/ The operator bearer token authenticates the request. Effectiveness depends on whether the Sentry deployment normalizes .. segments before routing (standard nginx behaviour). Amplified: telemetry redirect for data exfiltration Attacker-owned Sentry project slug → span data for other applications is exported to an attacker-controlled Sentry project, leaking operational telemetry. The collector fetches the DSN/keys for the attacker's slug and subsequently forwards legitimate traces/logs to the attacker-controlled destination. Threat model Attacker capabilities: remote OTLP trace sender (application-level span emission). Operator capabilities: configures Sentry DSN, bearer token, base URL; sets up receiver pipeline. The attacker does NOT control operator YAML. The attacker DOES control resource attribute values on spans they emit. Realistic deployment Kubernetes cluster with OpenTelemetry Collector forwarding traces from multiple applications to Sentry SaaS or self-hosted Sentry. One compromised or malicious application reaches the collector via OTLP. The collector is configured with a valid Sentry bearer token for the organization. Remediation Apply the existing projectSlugRegexp to runtime-derived slugs, not only to operator config mappings: import "regexp" var runtimeSlugPattern = regexp.MustCompile(^[a-zA-Z0-9_-]+$) func (s endpointState) extractProjectSlug(attrs pcommon.Map) string { attrValue, exists := attrs.Get(s.attributeKey) if !exists || attrValue.Type() != pcommon.ValueTypeStr { return "" } serviceName := attrValue.Str() if serviceName == "" { return "" } if s.projectMapping != nil { if mappedSlug, ok := s.projectMapping[serviceName]; ok { return mappedSlug } } if !runtimeSlugPattern.MatchString(serviceName) { return "" // reject; drop the span or use a fallback default project } return serviceName } Alternatively, reject at URL construction: func (c sentryClient) GetProjectKeys(ctx context.Context, orgSlug, projectSlug string) ([]projectKey, error) { if !runtimeSlugPattern.MatchString(projectSlug) { return nil, fmt.Errorf("invalid project slug: %q", projectSlug) } baseURL := fmt.Sprintf("%s/api/0/projects/%s/%s/keys/", c.baseURL, orgSlug, projectSlug) // ... } Apply the runtime regex to ALL slug-derived URL components (including orgSlug if it can ever be attacker-influenced), not just to config-time validation. Credit Reported by independent security research by Martin Brodeur.
Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.
CVE-2026-47256 has a CVSS score of 5.3 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment.
A fixed version is available (0.154.0). Upgrading removes the vulnerable code path.
go
github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter (< 0.154.0)github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter → 0.154.0 (go)Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter instead of chasing every advisory.
Kodem's runtime-powered SCA identifies whether CVE-2026-47256 is reachable in your applications. Explore open-source security for your team.
See if CVE-2026-47256 is reachable in your applications. Get a demo
Upgrade github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter to 0.154.0 or later to resolve this vulnerability.
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
CVE-2026-47256 is a medium-severity path traversal vulnerability in github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter (go), affecting versions < 0.154.0. It is fixed in 0.154.0. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
CVE-2026-47256 has a CVSS score of 5.3 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter (go) versions < 0.154.0 is affected.
Yes. CVE-2026-47256 is fixed in 0.154.0. Upgrade to this version or later.
Whether CVE-2026-47256 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
Upgrade github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter to 0.154.0 or later.