CVE-2026-41433

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41433", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-20T15:32:33.815Z", "datePublished": "2026-04-24T19:26:19.701Z", "dateUpdated": "2026-04-25T01:52:06.558Z"}, "containers": {"cna": {"title": "OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-59", "lang": "en", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-8gmg-3w2q-65f4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-8gmg-3w2q-65f4"}, {"name": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.8.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.8.0"}], "affected": [{"vendor": "open-telemetry", "product": "opentelemetry-ebpf-instrumentation", "versions": [{"version": ">= 0.4.0, < 0.8.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T19:26:19.701Z"}, "descriptions": [{"lang": "en", "value": "OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From 0.4.0 to before 0.8.0, a flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbitrary host files when Java injection is enabled and OBI is running with elevated privileges. The injector trusted TMPDIR from the target process and used unsafe file creation semantics, enabling both filesystem boundary escape and symlink-based file clobbering. This vulnerability is fixed in 0.8.0."}], "source": {"advisory": "GHSA-8gmg-3w2q-65f4", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-8gmg-3w2q-65f4", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-25T01:51:46.381811Z", "id": "CVE-2026-41433", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-25T01:52:06.558Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41433", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-25T01:51:46.381811Z"}}}], "references": [{"url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-8gmg-3w2q-65f4", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-25T01:52:00.479Z"}}], "cna": {"title": "OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR", "source": {"advisory": "GHSA-8gmg-3w2q-65f4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "open-telemetry", "product": "opentelemetry-ebpf-instrumentation", "versions": [{"status": "affected", "version": ">= 0.4.0, < 0.8.0"}]}], "references": [{"url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-8gmg-3w2q-65f4", "name": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-8gmg-3w2q-65f4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.8.0", "name": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.8.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From 0.4.0 to before 0.8.0, a flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbitrary host files when Java injection is enabled and OBI is running with elevated privileges. The injector trusted TMPDIR from the target process and used unsafe file creation semantics, enabling both filesystem boundary escape and symlink-based file clobbering. This vulnerability is fixed in 0.8.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T19:26:19.701Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41433", "state": "PUBLISHED", "dateUpdated": "2026-04-25T01:52:06.558Z", "dateReserved": "2026-04-20T15:32:33.815Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-24T19:26:19.701Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "opentelemetry-ebpf-instrumentation", "vendor": "open-telemetry", "versions": [{"status": "affected", "version": ">= 0.4.0, < 0.8.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opentelemetry:opentelemetry_ebpf_instrumentation:*:*:*:*:*:go:*:*", "matchCriteriaId": "0EB079AD-FCC7-45B1-AEDF-66A539013EED", "versionEndExcluding": "0.8.0", "versionStartIncluding": "0.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From 0.4.0 to before 0.8.0, a flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbitrary host files when Java injection is enabled and OBI is running with elevated privileges. The injector trusted TMPDIR from the target process and used unsafe file creation semantics, enabling both filesystem boundary escape and symlink-based file clobbering. This vulnerability is fixed in 0.8.0."}, {"lang": "es", "value": "OpenTelemetry eBPF Instrumentation proporciona instrumentaci\u00f3n eBPF basada en el est\u00e1ndar OpenTelemetry. Desde 0.4.0 hasta antes de 0.8.0, un fallo en la ruta de inyecci\u00f3n del agente Java permite a un atacante local que controla una carga de trabajo Java sobrescribir archivos de host arbitrarios cuando la inyecci\u00f3n Java est\u00e1 habilitada y OBI se ejecuta con privilegios elevados. El inyector confiaba en TMPDIR del proceso objetivo y utilizaba sem\u00e1nticas de creaci\u00f3n de archivos inseguras, lo que permit\u00eda tanto el escape de l\u00edmites del sistema de archivos como la sobrescritura de archivos basada en enlaces simb\u00f3licos. Esta vulnerabilidad est\u00e1 corregida en 0.8.0."}], "id": "CVE-2026-41433", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41433", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-25T01:51:46.381811Z", "version": "2.0.3"}}]}, "published": "2026-04-24T20:16:27.803", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.8.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-8gmg-3w2q-65f4"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-8gmg-3w2q-65f4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-59"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.4.0,0.8.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "opentelemetry-ebpf-instrumentation", "vendor": "opentelemetry"}], "analysis": {"en": {"generated_at": "2026-04-28T13:34:40.320585+00:00", "value": {"mitigation_remediation": ["Upgrade to OpenTelemetry eBPF Instrumentation version 0.8.0 or newer.", "If an upgrade is not immediately possible, disable the Java agent injection feature or ensure it runs with minimal privileges.", "Restrict the TMPDIR used by the instrumentation so that it is not writable by untrusted processes."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary File Overwrite"}, "threat_synthesis": {"affected_systems": "The affected product is OpenTelemetry eBPF Instrumentation from the open-telemetry vendor, specifically versions 0.4.0 through any release before 0.8.0. Deployments that run Java injection with elevated privileges are susceptible.", "description_and_impact": "OpenTelemetry eBPF Instrumentation exposes a flaw in the Java agent injection path that lets a local attacker who controls a Java workload overwrite arbitrary files on the host when the injection feature is enabled. The vulnerability arises because the injector trusts the temporary directory of the target process and creates files with unsafe semantics, permitting both filesystem boundary escape and symlink-based clobbering. The flaw is classified as CWE-22 and CWE-59 and can compromise confidentiality, integrity, and availability of critical host files.", "risk_and_exploitability": "The EPSS score of less than 1\u202f% indicates that exploitation is expected to be rare, and the vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires local access to a Java process, the ability to trigger the Java agent injection, and that the instrumentation runs with elevated privileges. Under these conditions, an attacker could overwrite arbitrary host files, potentially compromising the entire system."}}}}, "created": "2026-04-28T09:17:51.875343+00:00", "updated": "2026-04-28T13:45:06.130749+00:00", "vendors": ["opentelemetry", "opentelemetry$PRODUCT$opentelemetry-ebpf-instrumentation"]}