Executive brief
OpenTelemetry eBPF Instrumentation is a tool used to monitor application performance at the system level. A security flaw in how it handles Java applications allows a local user to trick the monitoring tool into overwriting critical system files. This could allow an attacker to disrupt services, corrupt system integrity, or potentially gain higher administrative privileges on the host machine.
Technical details
A vulnerability exists in the Java agent staging logic within 'pkg/internal/java/java_inject.go'. The OBI injector improperly trusts the 'TMPDIR' environment variable from target processes and uses 'filepath.Join' with the target's root filesystem. Because 'filepath.Join' discards the root if the joined path is absolute, an attacker can provide a path like '/etc' to escape the intended container/process boundary. Additionally, the injector uses unsafe file creation semantics (O_TRUNC without O_EXCL), allowing attackers to use symlinks to redirect the file write to arbitrary host locations. This can be exploited by a local attacker with low privileges to overwrite files owned by the privileged OBI process. The issue is resolved in version 0.8.0.
Affected products
- OpenTelemetry OpenTelemetry eBPF Instrumentation (OBI) >= 0.4.0, < 0.8.0
Timeline
- 2026-04-16: patched: Version 0.8.0 released with security hardening
- 2026-04-16: advisory: GitHub Security Advisory GHSA-8gmg-3w2q-65f4 published
- 2026-04-24: disclosed: CVE-2026-41433 published to NVD