PT-2026-36819 · Unknown · Opentelemetry.Exporter.Opentelemetryprotocol

Codywilliamson · Published 2026-04-30 · Updated 2026-05-26 · CVE-2026-42191

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenTelemetry.Exporter.OpenTelemetryProtocol versions 1.8.0 through 1.15.2

Description The OTLP disk retry feature silently falls back to Path.GetTempPath() when OTEL DOTNET EXPERIMENTAL OTLP RETRY is set to disk but OTEL DOTNET EXPERIMENTAL OTLP DISK RETRY DIRECTORY PATH is not configured. The exporter stores and loads *.blob files under fixed subdirectories (traces, metrics, logs) within that shared temporary root path. On multi-user systems where the temporary directory is accessible to other local accounts, this allows an attacker to write crafted *.blob files, which the OtlpExporterPersistentStorageTransmissionHandler() function then forwards to the OTLP endpoint under the application's identity. Additionally, attackers can read *.blob files to recover encoded telemetry payloads or deposit numerous oversized files to consume disk space and degrade retry-loop performance.

Recommendations Update to version 1.15.3. Configure a dedicated directory with strict ACL/ownership and least privilege for OTEL DOTNET EXPERIMENTAL OTLP DISK RETRY DIRECTORY PATH to ensure it is not shared across users. Avoid enabling disk retry in shared environments.

Fix

Weakness Enumeration

CWE-379

Related Identifiers

CVE-2026-42191

GHSA-4625-4J76-FWW9

Affected Products

Opentelemetry.Exporter.Opentelemetryprotocol

References · 10

• https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-4625-4j76-fww9 · Vendor Advisory
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/7106 · Patch
• https://osv.dev/vulnerability/GHSA-4625-4j76-fww9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42191 · Security Note
• https://github.com/open-telemetry/opentelemetry-dotnet · Note
• https://github.com/open-telemetry/opentelemetry-dotnet/commit/78dffdc5ebdf3dc090fdb94e3f1a32d3d1e26dfd · Note
• https://twitter.com/infoflowcloud/status/2054324861611245884 · Twitter Post
• https://twitter.com/CVEnew/status/2054324103105138906 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1t3jriw/resumen_diario_de_vulnerabilidades_04052026 · Reddit Post
• https://t.me/cveNotify/164715 · Telegram Post