CVE-2026-45679
Received Received - Intake
Redis Error Message Exposure in OpenTelemetry eBPF Instrumentation

Publication date: 2026-06-02

Last updated on: 2026-06-02

Assigner: GitHub, Inc.

Description
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive values, this behavior can exfiltrate tokens, PII, or other confidential input into telemetry backends and inject untrusted text into downstream analysis systems. This issue has been patched in version 0.9.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-02
Last Modified
2026-06-02
Generated
2026-06-02
AI Q&A
2026-06-02
EPSS Evaluated
N/A
NVD
EUVD
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
opentelemetry ebpf_instrumentation to 0.9.0 (exc)
open_telemetry opentelemetry_ebpf_instrumentation to 0.9.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.
CWE-117 The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

CVE-2026-45679 affects the OpenTelemetry eBPF Instrumentation (OBI) project versions before 0.9.0. The vulnerability arises because OBI exports raw Redis error text directly as span status messages without proper sanitization.

Since Redis error replies can contain attacker-controlled or sensitive information, this behavior can lead to the exposure of confidential data such as tokens or personally identifiable information (PII). Additionally, it allows injection of untrusted text into telemetry backends and downstream analysis systems.


How can this vulnerability impact me? :

This vulnerability can impact you by enabling the exfiltration of sensitive data, including tokens and PII, through telemetry systems.

It also risks contaminating downstream analysis systems with untrusted or malicious text, potentially compromising the integrity of telemetry data.

The vulnerability can be exploited remotely over the network without requiring privileges or user interaction, making it a moderate security risk.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, you should update the OpenTelemetry eBPF Instrumentation (OBI) to version 0.9.0 or later.

This update prevents the export of raw Redis error text as span status messages, thereby avoiding the exfiltration of sensitive information and injection of untrusted text into telemetry backends.


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

This vulnerability can lead to the exfiltration of sensitive information such as tokens, personally identifiable information (PII), or other confidential input into telemetry backends. Because regulations like GDPR and HIPAA require strict protection of sensitive and personal data, the unauthorized disclosure of such information through telemetry systems can result in non-compliance with these standards.

Additionally, the injection of untrusted text into downstream analysis systems can compromise data integrity, which is also a critical aspect of compliance frameworks. Therefore, organizations using vulnerable versions of OpenTelemetry eBPF Instrumentation may face increased risk of violating data protection and privacy regulations.

Updating to version 0.9.0 or later, which patches this issue, is necessary to mitigate these compliance risks.


How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability involves the OpenTelemetry eBPF Instrumentation (OBI) exporting raw Redis error text as span status messages, which may contain sensitive or attacker-controlled data. To detect this vulnerability on your system, you should check the version of the OpenTelemetry eBPF Instrumentation installed and inspect telemetry data for raw Redis error messages.

  • Verify the installed version of OpenTelemetry eBPF Instrumentation to ensure it is version 0.9.0 or later, as versions before 0.9.0 are vulnerable.
  • Search your telemetry backend or logs for span status messages containing raw Redis error texts that may include sensitive or unexpected data.
  • Example command to check the installed version (assuming a Linux environment and that the instrumentation is installed as a package): dpkg -l | grep opentelemetry-ebpf-instrumentation or rpm -qa | grep opentelemetry-ebpf-instrumentation
  • Example command to search logs or telemetry data for Redis error messages: grep -i 'redis error' /path/to/telemetry/logs or use a query in your telemetry backend to filter span status messages containing Redis error text.

Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart