The OpenTelemetry Collector Contrib repository includes a githubreceiver component that prior to version 0.151.0 validates required headers only at startup but does not check them on incoming webhook requests in the handleReq() function. This allows unauthenticated senders to bypass the required_headers authentication control. Additionally, if the Secret field is empty, the github.ValidatePayload function skips HMAC validation, resulting in no authentication mechanism on the webhook endpoint. Exploiting this vulnerability enables injection of arbitrary CI/CD trace data into the observability pipeline. The vulnerability is addressed in version 0.151.0.

An attacker can bypass authentication controls on the githubreceiver webhook endpoint and submit arbitrary webhook payloads. This can result in injection of fabricated CI/CD trace data into the observability pipeline, potentially misleading observability and monitoring systems. The vulnerability does not require privileges or user interaction and can be exploited remotely over the network.

Upgrade the opentelemetry-collector-contrib component to version 0.151.0 or later, where this issue is fixed. There is no indication that any other mitigation is effective or recommended. Patch status is confirmed fixed in 0.151.0.