CVE-2026-42602: Azure Authenticator Extension Authentication Bypass

The National Vulnerability Database has detailed CVE-2026-42602, a high-severity authentication bypass affecting the Azure Authenticator Extension (azureauthextension) versions 0.124.0 through 0.150.0. This flaw allows an attacker with any valid Azure access token, regardless of its original scope, to authenticate to any OpenTelemetry receiver configured with auth: azure_auth. The vulnerability stems from the extension’s Authenticate method, which fails to properly validate incoming bearer tokens as JWTs.

Instead of proper JWT validation, the extension requests a new access token using its own configured credential and then performs a simple string comparison against the client’s supplied token. Crucially, the scope for this server-side token request is derived from the client-supplied Host header. This means a token minted for any Azure resource (e.g., ARM, Graph, Key Vault, Storage) that the service principal has ever accessed can be replayed to authenticate to the collector, provided the attacker manipulates the Host header to match. These tokens are replayable for their full issued lifetime, which can be several hours for managed identity tokens.

This is a significant logical flaw, scoring 8.1 (HIGH) on the CVSS scale. It effectively turns a scoped token into a universal key for any OpenTelemetry receiver using this specific Azure authentication mechanism, bypassing the intended security controls. The attacker’s calculus here is simple: if they have any valid token for any Azure resource, they can pivot to gain unauthorized access to OpenTelemetry collectors, potentially exfiltrating telemetry data or injecting malicious data.