A flaw was found in OpenTelemetry Operator for Kubernetes. A tenant with permissions to create or update a ServiceMonitor resource can configure the `bearerTokenFile` field to point to the Collector's service account token path. This causes the Collector to send its mounted service account JSON Web Token (JWT) to an attacker-controlled scrape target. This vulnerability allows for information disclosure, potentially granting the attacker the same level of access as the OpenTelemetry Collector pod's service account within the Kubernetes API. This could lead to further enumeration and identification of targets, and potentially reading other sensitive files on the Collector pod.

OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth