Path Traversal in Open-Telemetry Opentelemetry-Ebpf-Instrumentation
CVE-2026-41433
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From 0.4.0 to before 0.8.0, a flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbitrary host files when Java injection is enabled and OBI is running with elevated privileges. The injector trusted TMPDIR from the target process and used unsafe file creation semantics, enabling both filesystem boundary escape and symlink-based file clobbering. This vulnerability is fixed in 0.8.0.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.002 (9.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H.
Affected products
- Open-telemetry Opentelemetry-ebpf-instrumentation — versions >= 0.4.0, < 0.8.0
- Opentelemetry Opentelemetry_ebpf_instrumentation
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2026-41433?
- CVE-2026-41433 is a high-severity vulnerability in Open-Telemetry Opentelemetry-Ebpf-Instrumentation, classified under Path Traversal. CVSS score: 8.4/10. Published 2026-04-24.
- How severe is CVE-2026-41433?
- High severity. CVSS v3 base score is 8.4 out of 10.