# CVE-2026-45404: OpenTelemetry-Go unsynchronized baggage map race condition

Source: https://junglewise.ai/threats/cve-2026-45404-opentelemetry-go-unsynchronized-baggage-map-race-condition  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-45404 · Severity: medium · CVSS 4 · Published 2026-08-24

OpenTelemetry-Go's OpenTracing bridge component manages tracing spans and baggage metadata for distributed tracing. A concurrent access bug in an internal map can cause the application to crash when one part of the code sets baggage while another simultaneously reads correlation data, disrupting service availability. The vulnerability only affects applications using specific configuration (OpenTracing bridge with correlation hooks) and requires the same span to be accessed by multiple goroutines.

Technologies: [Opentelemetry-Go](https://junglewise.ai/threats/technologies/opentelemetry-go). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Opentelemetry](https://junglewise.ai/threats/vendors/opentelemetry).

## Quick answers

**Is CVE-2026-45404 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45404 being exploited in the wild.

**How severe is CVE-2026-45404?** Medium severity, with a CVSS score of 4, published 24 August 2026.

**Which products and versions are affected?** go.opentelemetry.io/otel/bridge/opentracing (Go) >= 0.11.0, < 1.45.0, SEMVER:introduced=0.11.0,fixed=1.45.0; Opentelemetry-Go >= 0.11.0, < 1.45.0.

**Is there a fix for CVE-2026-45404?** Yes. go.opentelemetry.io/otel/bridge/opentracing (Go): upgrade to 1.45.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45404 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-45404?** Check whether you run go.opentelemetry.io/otel/bridge/opentracing (Go) or Opentelemetry-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- go.opentelemetry.io/otel/bridge/opentracing (Go): upgrade to 1.45.0 or later

  ```sh
  go get go.opentelemetry.io/otel/bridge/opentracing@v1.45.0
  ```


## Technical details

The vulnerability is a race condition (CWE-362) involving an improper locking issue (CWE-667) in the extraBaggageItems map of the bridgeSpan struct in go.opentelemetry.io/otel/bridge/opentracing. The map is written without synchronization in SetBaggageItem (via updateOtelContext) and read without locking in correlationGetHook during correlation.MapFromContext invocation. Concurrent access from separate goroutines—one calling SetBaggageItem and another calling correlation.MapFromContext on the same span—triggers Go's fatal concurrent map access error, crashing the process. No authentication or network access is required; exploitation requires only the vulnerable code path to execute concurrently. Patch available in version 1.45.0.

## Affected products

- OpenTelemetry opentelemetry-go >= 0.11.0, < 1.45.0

## Identifiers

- CVE-2026-45404
- GHSA-42cj-99w8-cp2p
- GO-2026-6258

## Timeline

- 2026-08-20: disclosed: Vulnerability published in GitHub Advisory Database

## References

- [https://api.github.com/users/pellared](https://api.github.com/users/pellared)
- [https://github.com/pellared](https://github.com/pellared)
- [https://api.github.com/users/pellared/gists%7B/gist_id%7D](https://api.github.com/users/pellared/gists%7B/gist_id%7D)
- [https://api.github.com/users/pellared/repos](https://api.github.com/users/pellared/repos)
- [https://avatars.githubusercontent.com/u/5067549?v=4](https://avatars.githubusercontent.com/u/5067549?v=4)
- [https://api.github.com/users/pellared/events%7B/privacy%7D](https://api.github.com/users/pellared/events%7B/privacy%7D)

## Related threats

- [OpenTelemetry-Go BatchingProcessor CPU exhaustion via log emission](https://junglewise.ai/threats/cve-2026-81872-opentelemetry-go-batchingprocessor-cpu-exhaustion-via-log)
- [OpenTelemetry-Go OTLP log gRPC exporter TLS certificate validation bypass](https://junglewise.ai/threats/cve-2026-81871-opentelemetry-go-otlp-log-grpc-exporter-tls-certificate)
- [OpenTelemetry-Go attribute truncation bypass with Unicode replacement character](https://junglewise.ai/threats/cve-2026-81869-opentelemetry-go-attribute-truncation-bypass-with-unicode)
- [OpenTelemetry-Go endpoint URL logging in TracerProvider diagnostics](https://junglewise.ai/threats/cve-2026-81870-opentelemetry-go-endpoint-url-logging-in-tracerprovider)