Executive brief
OpenTelemetry eBPF Instrumentation is a tool used to monitor application performance and network traffic at the system level. A security flaw in how it handles temporary data storage could allow sensitive information from the server's memory to be accidentally leaked into the monitoring data (telemetry). This could result in unauthorized exposure of private data to anyone with access to the monitoring logs or dashboards.
Technical details
An out-of-bounds read vulnerability exists in the OpenTelemetry eBPF Instrumentation (OBI) fallback path. When a CPU migration/mismatch occurs, the system switches to a 256-byte stack-allocated fallback buffer (`fallback_buf`) but fails to update the associated length parameter (`real_size`), which can remain set to its maximum of 8KB. Consequently, downstream functions like `http_send_large_buffer` use the larger length to read from the smaller buffer, causing an over-read of adjacent memory. This leaked memory is then included in the telemetry exported by the agent. The issue is fixed in version 0.9.0 by clamping the fallback message buffer size.
Affected products
- OpenTelemetry OpenTelemetry eBPF Instrumentation (OBI) Prior to 0.9.0
Timeline
- 2026-05-11: patched: Version 0.9.0 released
- 2026-05-12: advisory: GitHub Security Advisory GHSA-r6c9-g6q5-qrf9 published
- 2026-06-02: disclosed: CVE-2026-45681 published to NVD