PT-2026-35073 · Opentelemetry · @Opentelemetry/Instrumentation

Mralias · Published 2026-04-17 · Updated 2026-05-14 · CVE-2026-41433

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenTelemetry eBPF Instrumentation versions 0.4.0 through 0.7.x

Description A flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbitrary host files when Java injection is enabled and the instrumentation is running with elevated privileges. The injector trusted the TMPDIR variable from the target process and used unsafe file creation semantics, which enables filesystem boundary escape and symlink-based file clobbering.

Recommendations Update to version 0.8.0.

Exploit

Fix

Link Following

Path traversal

Weakness Enumeration

CWE-59

CWE-22

Related Identifiers

CVE-2026-41433

GHSA-8GMG-3W2Q-65F4

Affected Products

@Opentelemetry/Instrumentation

References · 7

• 🔥 https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-8gmg-3w2q-65f4 · Exploit
• https://osv.dev/vulnerability/GHSA-8gmg-3w2q-65f4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41433 · Security Note
• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation · Note
• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.8.0 · Note
• https://t.me/cveNotify/163474 · Telegram Post
• https://twitter.com/CVEnew/status/2047798563007234465 · Twitter Post