CVE-2026-45679
MEDIUMDescription
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive values, this behavior can exfiltrate tokens, PII, or other confidential input into telemetry backends and inject untrusted text into downstream analysis systems. This issue has been patched in version 0.9.0.
Is your site exposed to CVE-2026-45679?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| opentelemetry | ebpf_instrumentation |
References
Advisories & Patches
Exploits
Frequently Asked Questions
What is CVE-2026-45679? +
How severe is CVE-2026-45679? +
What products are affected by CVE-2026-45679? +
How do I check if I'm vulnerable to CVE-2026-45679? +
Related Vulnerabilities
Improper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Instant Privilege Access on Windows allows Log Injection-Tampering-Forging. This issue …
A vulnerability exists in Asset Suite for an authenticated user to manipulate the content of performance related log data or …
wire-ios is an iOS client for the Wire secure messaging application. From Wire iOS 3.111.1 to before 3.124.1, messages that …
The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates that string into …
OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 …
NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where a user can inject forged logs and executable …