Summary
OpenTelemetry Collector Contrib's OIDC authenticator can miss JWKS updates when public_keys_file points to a file rotated through a Kubernetes-style projected-secret symlink. The verifier keeps the old key set, so tokens signed by a removed key can remain accepted until the Collector restarts. Affects oidcauthextension versions from 0.146.0 up to, but not including, 0.160.0. Fixed in 0.160.0.
Disclosure timeline
- Public disclosure
Credits
Reported by christos-cantina-security; remediation by jmacd, as credited in OpenTelemetry's advisory.