CVE-2026-45683: open-telemetry opentelemetry-ebpf-instrumentation Buffer Under-read

Vulnerability summary

CVE-2026-45683 is a low (CVSS 3.8) Buffer Under-read vulnerability in open-telemetry opentelemetry-ebpf-instrumentation. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 02-06-2026
   PublishedVulnerability first disclosed.
2. 02-06-2026
   Last modifiedVulnerability information updated.

Description

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry. This issue has been patched in version 0.9.0.

• CWE-127Buffer Under-readThe product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer.
• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.