Is CVE-2026-45681 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45681 being exploited in the wild.

How severe is CVE-2026-45681?

Medium severity, with a CVSS score of 5.9, published 2 June 2026.

Which products and versions are affected?

go.opentelemetry.io/obi (Go) < 0.9.0, SEMVER:introduced=0,fixed=0.9.0; Opentelemetry Ebpf Instrumentation < 0.9.0, Prior to 0.9.0.

Is there a fix for CVE-2026-45681?

Yes. go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45681 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45681?

Check whether you run go.opentelemetry.io/obi (Go) or Opentelemetry Ebpf Instrumentation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45681: OpenTelemetry eBPF Instrumentation out-of-bounds read in message-buffer fallback

Q: Is there a fix for CVE-2026-45681?

Yes. go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45681 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-45681?

Check whether you run go.opentelemetry.io/obi (Go) or Opentelemetry Ebpf Instrumentation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45681 · Severity: medium · CVSS 5.9 · Published 2026-06-02

OpenTelemetry eBPF Instrumentation is a tool used to monitor application performance and network traffic at the system level. A security flaw in how it handles temporary data storage could allow sensitive information from the server's memory to be accidentally leaked into the monitoring data (telemetry). This could result in unauthorized exposure of private data to anyone with access to the monitoring logs or dashboards.

Technologies: go.opentelemetry.io/obi (Go), Opentelemetry Ebpf Instrumentation. Vendors: Go, Opentelemetry.

Quick answers

Is CVE-2026-45681 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45681 being exploited in the wild.
How severe is CVE-2026-45681?: Medium severity, with a CVSS score of 5.9, published 2 June 2026.
Which products and versions are affected?: go.opentelemetry.io/obi (Go) < 0.9.0, SEMVER:introduced=0,fixed=0.9.0; Opentelemetry Ebpf Instrumentation < 0.9.0, Prior to 0.9.0.
Is there a fix for CVE-2026-45681?: Yes. go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45681 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45681?: Check whether you run go.opentelemetry.io/obi (Go) or Opentelemetry Ebpf Instrumentation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later
```
go get go.opentelemetry.io/obi@v0.9.0
```

Technical details

An out-of-bounds read vulnerability exists in the OpenTelemetry eBPF Instrumentation (OBI) fallback path. When a CPU migration/mismatch occurs, the system switches to a 256-byte stack-allocated fallback buffer (`fallback_buf`) but fails to update the associated length parameter (`real_size`), which can remain set to its maximum of 8KB. Consequently, downstream functions like `http_send_large_buffer` use the larger length to read from the smaller buffer, causing an over-read of adjacent memory. This leaked memory is then included in the telemetry exported by the agent. The issue is fixed in version 0.9.0 by clamping the fallback message buffer size.

Affected products

OpenTelemetry OpenTelemetry eBPF Instrumentation (OBI) Prior to 0.9.0

Identifiers

CVE-2026-45681
GHSA-r6c9-g6q5-qrf9
GO-2026-5610

Timeline

2026-05-11: patched: Version 0.9.0 released
2026-05-12: advisory: GitHub Security Advisory GHSA-r6c9-g6q5-qrf9 published
2026-06-02: disclosed: CVE-2026-45681 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.