CVE-2026-45676: open-telemetry opentelemetry-ebpf-instrumentation Improper Input Validation
Vulnerability summary
CVE-2026-45676 is a medium (CVSS 5.5) Improper Input Validation vulnerability in open-telemetry opentelemetry-ebpf-instrumentation. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.5% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 02-06-2026PublishedVulnerability first disclosed.
- 02-06-2026Last modifiedVulnerability information updated.
Description
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI's replacement ELF parser trusts section offsets, counts, and string offsets from the executable file. A crafted local ELF can make OBI dereference invalid section pointers or slice past string tables, causing the agent to panic while determining the process language. This issue has been patched in version 0.9.0.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
6%
Versus all other CVEs
30-day change
0.00 pp
From 0.16% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundOpentelemetry Ebpf Instrumentation
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Go.opentelemetry.io1 product
- obi< 0.9.0
Open-telemetry1 product
Opentelemetry1 product
- ebpf_instrumentation< 0.9.0
3 vendors · 3 products
References
4 links- github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-wp73-mwgf-4jq9X Refsource CONFIRMWEBAdvisoryExploitVendor Advisory
- github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0X Refsource MISCWEBProductRelease Notes
