What’s Vulnerable › Vulnerabilities

CVE-2026-45679: OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-06-02 · updated 2026-07-22
• Weakness: CWE-117

Description

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive values, this behavior can exfiltrate tokens, PII, or other confidential input into telemetry backends and inject untrusted text into downstream analysis systems. This issue has been patched in version 0.9.0.

Affected products

• open-telemetry opentelemetry-ebpf-instrumentation: before 0.9.0 — fixed in 0.9.0

How to fix

Upgrade to a fixed version: open-telemetry opentelemetry-ebpf-instrumentation 0.9.0. Check the vendor advisory for mitigations.

References

• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0
• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-8rrq-wcg8-cv5q
• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-8rrq-wcg8-cv5q

Get alerted when CVE-2026-45679 or the next vulnerability affects your stack