CVE-2026-45679: OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages
Vulnerability summary
CVE-2026-45679 is a medium (CVSS 6.5) Improper Output Neutralization for Logs vulnerability in open-telemetry opentelemetry-ebpf-instrumentation. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11.4% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 5Timeline
- 02-06-2026PublishedVulnerability first disclosed.
- 02-06-2026Last modifiedVulnerability information updated.
Description
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive values, this behavior can exfiltrate tokens, PII, or other confidential input into telemetry backends and inject untrusted text into downstream analysis systems. This issue has been patched in version 0.9.0.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
Decrease -0.09 pp
From 0.30% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundOpentelemetry Ebpf Instrumentation
Maturity: poc
Weaknesses
CWE · root cause- CWE-117Improper Output Neutralization for LogsThe product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
- CWE-532Insertion of Sensitive Information into Log FileThe product writes sensitive information to a log file.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Go.opentelemetry.io1 product
- obi< 0.9.0
Open-telemetry1 product
Opentelemetry1 product
- ebpf_instrumentation< 0.9.0
3 vendors · 3 products
References
4 links- github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-8rrq-wcg8-cv5qX Refsource CONFIRMWEBAdvisoryExploitVendor Advisory
- github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0X Refsource MISCWEBProductRelease Notes
