CVE-2026-42602 is a server-side authentication bypass vulnerability in the azureauthextension of opentelemetry-collector-contrib (versions 0.124.0 to 0.150.0). The Authenticate method fails to properly validate incoming bearer tokens as JWTs and instead compares the client's token to a token obtained from its configured credential using string equality. The scope for the server-side token request is derived from the client-supplied Host header, allowing tokens minted for any Azure resource accessible by the service principal to authenticate if the attacker matches the Host header. This results in replayable tokens being accepted for the full token lifetime, enabling unauthorized authentication to OpenTelemetry receivers using azure_auth.

An attacker possessing any valid Azure access token for any scope the collector's configured identity can mint can bypass authentication to OpenTelemetry receivers using azure_auth. This can lead to unauthorized access and potentially high impact on integrity and availability of the telemetry data or services relying on the collector. The vulnerability does not affect confidentiality directly but allows impersonation and unauthorized actions within the collector's scope.

A patch is available for this vulnerability. Since the affected product is a cloud service, the vendor typically manages remediation server-side. Users should verify with the vendor advisory for confirmation of patch deployment and ensure they are running a version later than 0.150.0 or have applied the official fix. Until patched, avoid relying on azureauthextension for authentication or implement additional validation controls if possible.