CVE-2024-42368

CVE-2024-42368 affects OpenTelemetry (OTel) collectors utilizing the bearertokenauth extension, where a timing attack vulnerability exists due to a non-constant time string comparison for bearer tokens. This allows malicious clients with network access to guess the configured token, potentially enabling the introduction of fabricated or bad data into the telemetry pipeline. The vulnerability has a CVSS score of 6.5 (Medium), indicating network-based exploitation with low attack complexity, leading to potential low integrity and availability impacts. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.