CVE-2026-47256

🗓️ 14 Sep 2026 17:28:15Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 88 Views🌐 WEB

Path traversal in OpenTelemetry Sentry exporter via service.name reaches privileged API endpoints.

Reporter	Title	Published	Views	Family All 23
Cvelist	CVE-2026-47256 OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token	14 Sep 202617:28	–	cvelist
Debian CVE	CVE-2026-47256	14 Sep 202617:28	–	debiancve
EUVD	EUVD-2026-77692	14 Sep 202617:28	–	euvd
Github Security Blog	opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token	18 Jun 202615:04	–	github
Mend	CVE-2026-47256	14 Sep 202617:28	–	mend
NVD	CVE-2026-47256	14 Sep 202618:17	–	nvd
osv_debian	DEBIAN-CVE-2026-47256	14 Sep 202618:17	–	osv_debian
osv_echo	ECHO-CD26-8AF5-522C	28 Sep 202600:02	–	osv_echo
osv_ghsa	GHSA-4JVG-4JFX-FMHC opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token	18 Jun 202615:04	–	osv_ghsa
osv_go	GO-2026-5126 opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token in github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter	25 Jun 202618:26	–	osv_go

Vulners

Node

opentelemetry opentelemetry_collector_contribRange<0.154.0

[
  {
    "vendor": "open-telemetry",
    "product": "opentelemetry-collector-contrib",
    "versions": [
      {
        "version": "< 0.154.0",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "open-telemetry",
    "product": "github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter",
    "versions": [
      {
        "version": "< 0.154.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/open-telemetry/opentelemetry-collector-contrib/commit/3113638f216143f523b57f447728464337ae4903
github	www.github.com/open-telemetry/opentelemetry-collector-contrib/security/advisories/GHSA-4jvg-4jfx-fmhc
github	www.github.com/open-telemetry/opentelemetry-collector-contrib/releases/tag/v0.154.0

Parameter	Position	Path	Description	CWE
projectSlug	path	/api/projects/	The Sentry exporter fails to validate the project slug resource attribute, allowing an attacker to use special characters to traverse paths or inject query data into the Sentry API URL.	CWE-22, CWE-74
projectSlug	path	/api/organizations/	The Sentry exporter fails to validate the project slug resource attribute, allowing an attacker to use special characters to traverse paths or inject query data into the Sentry API URL.	CWE-22, CWE-74
projectSlug	path	/api/members/	The Sentry exporter fails to validate the project slug resource attribute, allowing an attacker to use special characters to traverse paths or inject query data into the Sentry API URL.	CWE-22, CWE-74
projectSlug	path	/api/keys/	The Sentry exporter fails to validate the project slug resource attribute, allowing an attacker to use special characters to traverse paths or inject query data into the Sentry API URL.	CWE-22, CWE-74

25 Sep 2026 14:23Current

8.3High risk

Vulners AI Score8.3

CVSS 3.15.3

EPSS0.00437

SSVC