Executive brief
OpenTelemetry eBPF Instrumentation is a tool used to monitor application performance by capturing network traffic data. A security issue was identified where the tool automatically captures and exports raw error messages from Redis databases into monitoring dashboards and logs. Because these error messages can contain sensitive information like passwords, tokens, or personal data, an attacker could potentially trick the system into leaking confidential information into telemetry systems or inject misleading data into analysis tools.
Technical details
The vulnerability exists in the Redis instrumentation logic within OpenTelemetry eBPF Instrumentation (OBI). Specifically, in `pkg/ebpf/common/redis_detect_transform.go`, the `getRedisError` function trims raw error buffers and stores them directly in `request.DBError.Description` without sanitization. This description is subsequently exported as the status message for Redis spans in `pkg/appolly/app/request/span.go`. An attacker can trigger Redis errors containing sensitive or controlled strings (e.g., via malformed commands), which are then automatically exfiltrated to OTLP-exported telemetry backends. This issue is classified under CWE-117 (Improper Output Neutralization for Logs) and CWE-532 (Insertion of Sensitive Information into Log File). The issue is patched in version 0.9.0, which makes database error reporting optional and disabled by default.
Affected products
- OpenTelemetry OpenTelemetry eBPF Instrumentation (OBI) / go.opentelemetry.io/obi Prior to 0.9.0
Timeline
- 2026-05-11: patched: Version 0.9.0 released
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-06-02: disclosed: CVE-2026-45679 published to NVD