Medium severity · published Jun 2, 2026
CVE-2026-45679
OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive values, this behavior can exfiltrate tokens, PII, or other confidential input into telemetry backends and inject untrusted text into downstream analysis systems. This issue has been patched in version 0.9.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
opentelemetry-ebpf-instrumentation · open-telemetry
< 0.9.0 · source: vendor
EI
Ebpf Instrumentation · Opentelemetry
before 0.9.0 · source: NVD
Affected product
OP
opentelemetry-ebpf-instrumentation
open-telemetry
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45679
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45679
Product
https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0
Exploit
https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-8rrq-wcg8-cv5q
More from opentelemetry-ebpf-instrumentation
8.4
CVE-2026-41433
OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR
7.5
CVE-2026-45686
OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI
7.5
CVE-2026-45685
OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages
7.5
CVE-2026-45680
OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU
7.5
CVE-2026-45678
OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads