StackRadar

CVE-2026-42602

High

Advisory

Published 6 May 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.1
base score, highest
EPSS
0.002
13th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
18
of 17,781 indexed, latest versions
Container images
12
deployed by those charts
Fix available
None
affected package

opentelemetry-collector-contrib's azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay

Carried by container images the latest versions of 18 of 17,781 indexed charts deploy, on 12 images.

Affected packageAffected versionsFixed inImages
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextensiongolangv0.134.0, v0.139.0, v0.142.0, v0.143.0+7 moreno fix listed12
OSV records
GHSA-pjv4-3c63-699fGO-2026-5544

Charts affected

18 by stars
ChartLatestAffected imagesRadar Score
signozsignoz0.141.11 of 5See more

signoz signoz 0.141.1

1 of the 5 container images this version deploys carry CVE-2026-42602.

Container imageDigestPackageFixed in
signoz/signoz-otel-collector:v0.144.972aa1e4c1ec5
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.144.0
no fix listed

Open the chart page →

7,568
k8s-infrasignoz0.17.11 of 1See more

k8s-infra signoz 0.17.1

1 of the 1 container images this version deploys carry CVE-2026-42602.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.139.0faf125d656fa
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.139.0
no fix listed

Open the chart page →

1,039
uptraceuptrace2.0.21 of 2See more

uptrace uptrace 2.0.2

1 of the 2 container images this version deploys carry CVE-2026-42602.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:latest799dc6cf12c9
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.160.0
no fix listed

Open the chart page →

1,619
opentelemetry-demoopentelemetry-helmVerified publisher0.41.11 of 34See more

opentelemetry-demo opentelemetry-helm 0.41.1

1 of the 34 container images this version deploys carry CVE-2026-42602.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.156.0125bdbeb7590
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.156.0
no fix listed

Open the chart page →

22,420
otel-collectorarieotechVerified publisher0.1.01 of 1See more

otel-collector arieotech 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42602.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.154.0b3079f45e19b
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.154.0
no fix listed

Open the chart page →

245
catalyst-agentscatalyst-agents0.1.301 of 18See more

catalyst-agents catalyst-agents 0.1.30

1 of the 18 container images this version deploys carry CVE-2026-42602.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.156.0125bdbeb7590
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.156.0
no fix listed

Open the chart page →

15,027
dapr-agentsdapr-agents-devVerified publisher0.1.51 of 31See more

dapr-agents dapr-agents-dev 0.1.5

1 of the 31 container images this version deploys carry CVE-2026-42602.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.145.0a7343f018690
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.145.0
no fix listed

Open the chart page →

22,193
pyroscope-monitoringgrafana0.1.11 of 6See more

pyroscope-monitoring grafana 0.1.1

1 of the 6 container images this version deploys carry CVE-2026-42602.

Container imageDigestPackageFixed in
grafana/otel-lgtm:0.11.1009d8c3ce4f3a
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.134.0
no fix listed

Open the chart page →

8,188
jaegerhuseyinbabalVerified publisher0.1.01 of 3See more

jaeger huseyinbabal 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-42602.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:latest799dc6cf12c9
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.160.0
no fix listed

Open the chart page →

1,477
network-enforcerkubewardenVerified publisher0.1.21 of 3See more

network-enforcer kubewarden 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-42602.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.160.0799dc6cf12c9
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.160.0
no fix listed

Open the chart page →

2,545
openlitopenlit1.24.01 of 3See more

openlit openlit 1.24.0

1 of the 3 container images this version deploys carry CVE-2026-42602.

Container imageDigestPackageFixed in
ghcr.io/openlit/openlit:1.24.02434560e8f0e
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.142.0
no fix listed

Open the chart page →

5,017
soha-observabilityopensohaVerified publisher0.2.11 of 2See more

soha-observability opensoha 0.2.1

1 of the 2 container images this version deploys carry CVE-2026-42602.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.157.0f2f01157055a
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.157.0
no fix listed

Open the chart page →

336
lgtm-stackquench-lgtm-stackVerified publisher0.0.191 of 9See more

lgtm-stack quench-lgtm-stack 0.0.19

1 of the 9 container images this version deploys carry CVE-2026-42602.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/otel-collectordigest-pinned827214c722b4
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.159.0
no fix listed

Open the chart page →

376
otel-collectorquench-otel-collectorVerified publisher0.0.161 of 1See more

otel-collector quench-otel-collector 0.0.16

1 of the 1 container images this version deploys carry CVE-2026-42602.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/otel-collectordigest-pinned695e7fd14483
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.159.0
no fix listed

Open the chart page →

81
tracing-stackquench-tracing-stackVerified publisher0.0.91 of 3See more

tracing-stack quench-tracing-stack 0.0.9

1 of the 3 container images this version deploys carry CVE-2026-42602.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/otel-collectordigest-pinned695e7fd14483
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.159.0
no fix listed

Open the chart page →

283
monitoringrocketchat-server0.0.171 of 9See more

monitoring rocketchat-server 0.0.17

1 of the 9 container images this version deploys carry CVE-2026-42602.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.143.03bc07732530c
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.143.0
no fix listed

Open the chart page →

6,859
anna-nginxstatic-nginx1.31.111 of 2See more

anna-nginx static-nginx 1.31.11

1 of the 2 container images this version deploys carry CVE-2026-42602.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:latest799dc6cf12c9
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.160.0
no fix listed

Open the chart page →

416
hesselinkme-nginxstatic-nginx1.31.111 of 2See more

hesselinkme-nginx static-nginx 1.31.11

1 of the 2 container images this version deploys carry CVE-2026-42602.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:latest799dc6cf12c9
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.160.0
no fix listed

Open the chart page →

416

Container images carrying it

12 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
otel/opentelemetry-collector-contrib:0.160.0:latest799dc6cf12c9
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.160.0
no fix listed
5
otel/opentelemetry-collector-contrib:0.156.0125bdbeb7590
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.156.0
no fix listed
2
ghcr.io/quenchworks/images/otel-collector695e7fd14483
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.159.0
no fix listed
2
grafana/otel-lgtm:0.11.1009d8c3ce4f3a
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.134.0
no fix listed
1
otel/opentelemetry-collector-contrib:0.143.03bc07732530c
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.143.0
no fix listed
1
otel/opentelemetry-collector-contrib:0.145.0a7343f018690
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.145.0
no fix listed
1
otel/opentelemetry-collector-contrib:0.154.0b3079f45e19b
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.154.0
no fix listed
1
otel/opentelemetry-collector-contrib:0.157.0f2f01157055a
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.157.0
no fix listed
1
otel/opentelemetry-collector-contrib:0.139.0faf125d656fa
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.139.0
no fix listed
1
signoz/signoz-otel-collector:v0.144.972aa1e4c1ec5
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.144.0
no fix listed
1
ghcr.io/openlit/openlit:1.24.02434560e8f0e
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.142.0
no fix listed
1
ghcr.io/quenchworks/images/otel-collector827214c722b4
github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension@v0.159.0
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.