Vulnerability · Published Apr 24, 2026 · Assigned by GitHub_M
CVE-2026-41433OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR
High 8.4
In plain English
A high-severity path traversal in opentelemetry-ebpf-instrumentation from open-telemetry. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From 0.4.0 to before 0.8.0, a flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbitrary host files when Java injection is enabled and OBI is running with elevated privileges. The injector trusted TMPDIR from the target process and used unsafe file creation semantics, enabling both filesystem boundary escape and symlink-based file clobbering. This vulnerability is fixed in 0.8.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | go.opentelemetry.io/obi | 0.8.0 | GHSA-8gmg-3w2q-65f4 |
| Go | go.opentelemetry.io/obi | 0.8.0 | GO-2026-5253 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| open-telemetry | opentelemetry-ebpf-instrumentation | >= 0.4.0, < 0.8.0 |
Weakness: CWE-22, CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H