CVE-2026-45404: OpenTelemetry-Go unsynchronized baggage map race condition

Executive brief

OpenTelemetry-Go's OpenTracing bridge component manages tracing spans and baggage metadata for distributed tracing. A concurrent access bug in an internal map can cause the application to crash when one part of the code sets baggage while another simultaneously reads correlation data, disrupting service availability. The vulnerability only affects applications using specific configuration (OpenTracing bridge with correlation hooks) and requires the same span to be accessed by multiple goroutines.

Technical details

The vulnerability is a race condition (CWE-362) involving an improper locking issue (CWE-667) in the extraBaggageItems map of the bridgeSpan struct in go.opentelemetry.io/otel/bridge/opentracing. The map is written without synchronization in SetBaggageItem (via updateOtelContext) and read without locking in correlationGetHook during correlation.MapFromContext invocation. Concurrent access from separate goroutines—one calling SetBaggageItem and another calling correlation.MapFromContext on the same span—triggers Go's fatal concurrent map access error, crashing the process. No authentication or network access is required; exploitation requires only the vulnerable code path to execute concurrently. Patch available in version 1.45.0.

Affected products

• OpenTelemetry opentelemetry-go >= 0.11.0, < 1.45.0

Timeline

• 2026-08-20: disclosed: Vulnerability published in GitHub Advisory Database

References

• https://api.github.com/users/pellared
• https://github.com/pellared
• https://api.github.com/users/pellared/gists%7B/gist_id%7D
• https://api.github.com/users/pellared/repos
• https://avatars.githubusercontent.com/u/5067549?v=4
• https://api.github.com/users/pellared/events%7B/privacy%7D