PT-2026-41784 · Opentelemetry · @Opentelemetry/Instrumentation

Mralias · Published 2026-05-18 · Updated 2026-06-25 · CVE-2026-45679

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenTelemetry eBPF Instrumentation versions prior to 0.9.0

Description OpenTelemetry eBPF Instrumentation exports raw Redis error text as the span status message. Because Redis error replies can contain sensitive values or attacker-controlled data, this behavior can lead to the exfiltration of tokens, personally identifiable information (PII), or other confidential input into telemetry backends. Additionally, it allows the injection of untrusted text into downstream analysis systems. The issue occurs because the getRedisError() function trims the raw error buffer and stores it directly in request.DBError.Description, which is subsequently returned as the exported status message for Redis spans when the span status is non-zero, without any sanitization beyond CRLF trimming.

Recommendations Update to version 0.9.0.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-117

CWE-532

Related Identifiers

CVE-2026-45679

GHSA-8RRQ-WCG8-CV5Q

GO-2026-5265

Affected Products

@Opentelemetry/Instrumentation

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45679.json · Exploit
• 🔥 https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-8rrq-wcg8-cv5q · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45679 · Security Note
• https://osv.dev/vulnerability/GHSA-8rrq-wcg8-cv5q · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5265 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-45679 · Vendor Advisory
• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0 · Note
• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation · Note