Is CVE-2026-45684 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45684 being exploited in the wild.

How severe is CVE-2026-45684?

Medium severity, with a CVSS score of 4.9, published 2 June 2026.

Which products and versions are affected?

go.opentelemetry.io/obi (Go) >= 0.7.0, < 0.9.0, SEMVER:introduced=0.7.0,fixed=0.9.0; Opentelemetry Ebpf Instrumentation 0.7.0 to 0.8.x (before 0.9.0).

Is there a fix for CVE-2026-45684?

Yes. go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45684 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-45684?

Check whether you run go.opentelemetry.io/obi (Go), Opentelemetry Ebpf Instrumentation or Opentelemetry Otelhttp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45684: OpenTelemetry eBPF Instrumentation buffer over-read in log enricher

Q: Is there a fix for CVE-2026-45684?

Yes. go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45684 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-45684?

Check whether you run go.opentelemetry.io/obi (Go), Opentelemetry Ebpf Instrumentation or Opentelemetry Otelhttp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45684 · Severity: medium · CVSS 4.9 · Published 2026-06-02

OpenTelemetry eBPF Instrumentation is a tool used to monitor and collect data from running applications. A security flaw in its log enrichment feature could allow a local attacker to cause memory corruption or data leakage in an instrumented application. This could lead to application crashes, service instability, or the accidental exposure of sensitive information in system logs.

Technologies: go.opentelemetry.io/obi (Go), Opentelemetry Ebpf Instrumentation, Opentelemetry Otelhttp. Vendors: Go, Opentelemetry.

Quick answers

Is CVE-2026-45684 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45684 being exploited in the wild.
How severe is CVE-2026-45684?: Medium severity, with a CVSS score of 4.9, published 2 June 2026.
Which products and versions are affected?: go.opentelemetry.io/obi (Go) >= 0.7.0, < 0.9.0, SEMVER:introduced=0.7.0,fixed=0.9.0; Opentelemetry Ebpf Instrumentation 0.7.0 to 0.8.x (before 0.9.0).
Is there a fix for CVE-2026-45684?: Yes. go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45684 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-45684?: Check whether you run go.opentelemetry.io/obi (Go), Opentelemetry Ebpf Instrumentation or Opentelemetry Otelhttp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

go.opentelemetry.io/obi (Go): upgrade to 0.9.0 or later
```
go get go.opentelemetry.io/obi@v0.9.0
```

Technical details

A vulnerability exists in the OBI log enricher's eBPF code (specifically in the __fill_iov and __write functions) where it mishandles writev buffers. The code resolves only the first iovec entry but uses the total byte count (iov_iter.count) from all segments as the length for copy operations. When log injection is enabled, a local attacker can trigger a crafted multi-segment writev call, causing OBI to read and overwrite memory beyond the first segment using bpf_probe_read_user and bpf_probe_write_user. This results in a buffer over-read (CWE-126) and out-of-bounds write (CWE-787), potentially leading to memory disclosure in logs or process corruption. The issue is fixed in version 0.9.0.

Affected products

OpenTelemetry OpenTelemetry eBPF Instrumentation (OBI) 0.7.0 to 0.8.x (before 0.9.0)

Identifiers

CVE-2026-45684
GHSA-vvmg-8mjr-g6q3
GO-2026-5677

Timeline

2026-05-11: patched: Version 0.9.0 released
2026-05-12: advisory: GitHub Security Advisory GHSA-vvmg-8mjr-g6q3 published
2026-06-02: disclosed: CVE-2026-45684 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.