CVE-2026-45679

Katalog CVE

CVSS 6.5 · Medium EPSS 0,21%

Kerentanan Improper Output Neutralization for Logs pada opentelemetry ebpf instrumentation. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive values, this behavior can exfiltrate tokens, PII, or other confidential input into telemetry backends and inject untrusted text into downstream analysis systems. This issue has been patched in version 0.9.0.

Rincian

Terbit di NVD

2 Juni 2026

Terakhir diubah

22 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-117: Improper Output Neutralization for Logs
CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-8rrq-wcg8-cv5q exploit · advisory vendor
• https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/tag/v0.9.0 product · release notes